Table of Contents
DSI AI Processing and Compute Units Lead to Large Bills
Reading MVP Dino Caputo’s cautionary tale about Microsoft Security Copilot reminded me about a similar experience I had with the preview version of Purview Data Security Investigations (DSI). Dino reports how easy it is for a tenant to consume Security Compute Units (SCUs) to run up a bill of thousands of dollars. He makes the excellent point that enabling SCU consumption without the “right data sources, telemetry, and cost controls can result in significant unexpected spend with little or no usable output.”
I wish I had known this when I set out to test the preview version of DSI (reported here). As an experienced eDiscovery practitioner, I am comfortable with the user interface and the initial processing flow used to create an investigation and find items of interest for that investigation from Microsoft 365 data sources like mailboxes and sites.
DSI operates on a pay-as-you-go (PAYG) basis and charges for the Azure storage used to hold the items found by investigations and the AI processing to reason over and analyze the items to generate trends and insights that might be valuable to investigators. Paying for storage is straightforward – the more an investigation finds, the more Azure will charge to store the items. It’s good encouragement to refine searches to focus in on what’s really needed for an investigation instead of what might be needed.
Compute Units Drive DSI Costs
The problems arise with the compute units required for AI processing. In my mind, I didn’t use any compute units because I didn’t bring a DSI case through to performing vector processing and deep content analysis (I didn’t feel that I had good enough test data for this purpose). But what I didn’t realize is that DSI pre-provisioned compute units and charged for those units even if they were not used (this doesn’t happen in the GA version). All of which led to a very unpleasant shock when I reviewed the charged applied to my Azure subscription some days later and discovered that I had incurred over a thousand dollars of charges for compute units (Figure 1).
I complained bitterly about the unfairness of charging for compute units that were never used. Fortunately, Microsoft took swift action to fix the problem. Indeed, the DSI engineering team had already figured out that charging customers for unused resources was not a good way to encourage use of their solution, and the generally available version of DSI does not pre-provision security units when investigations start. You’ll certainly pay for compute units if you use AI to process data found by an investigation, but only from the point where you start that processing.
The Case for More Transparent DSI Charging
Microsoft publishes reasonable guidelines to help investigators understand how to manage DSI costs. However, I have my doubts about how many investigators or tenant administrators will read the guidance. I guess that the temptation to plunge in and see what happens when AI processes investigation case data is just too high. In summary, there’s still too high a probability that DSI can generate unexpected heavy costs. Those costs might be absorbed without question on a corporate credit card, but that’s no reason to allow the situation to persist.
I had a chance to talk to Christophe Fiessinger, who is one of the presenters at the DSI Ask Me Anything event on Thursday, February 5 at 10AM PST, and suggested that the DSI user interface should be a lot more proactive about driving cost awareness. For example, when an investigator performs a search and reviews the search results, the UX should display the costs for processing the set of results found by the search. Each DSI case should display the total incurred cost of the investigative processing to date together with an indication of how much it will cost over the next month.
The necessary information to highlight charges is available and DSI includes a usage dashboard to show administrators details of costs incurred by investigations, but it would be more apparent if the information appeared on a per-case basis. Although Azure includes a cost management module (in preview) for PowerShell, getting charging data out isn’t as easy as you might think.
More PAYG, More Charges to Understand
Microsoft cannot stuff everything into Microsoft 365 E5. Solutions like DSI are of interest to a relatively small number of the overall Microsoft 365 base, and it makes sense that the solutions are available on a PAYG basis for those that need them. As with anything in life, it also makes sense for people to understand likely charges before doing something. After all, unexpected charges are a recipe for unhappiness.
Learn how to use Purview eDiscovery and other solutions and to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.