How much does Microsoft Sentinel cost?
By Michael Scherenberg, CISSP, CISM. Published
Microsoft Sentinel is billed mainly on how much data you ingest and how long you keep it. Your cost depends on log volume, the tier each data source lands in, and your retention choices, rather than a per-seat or per-user price. Two organizations of the same size can see very different bills.
This article explains how the pricing model works. It does not list rates: prices vary by region and change over time, so check Microsoft's official Microsoft Sentinel pricing page for current numbers.
How Sentinel billing works
Sentinel runs on top of a Log Analytics workspace. You are charged for the data that flows into that workspace and for keeping it beyond the included retention period. Every firewall, identity, endpoint and cloud log you connect adds to the volume, so the bill tracks the data you collect, not the number of analysts or users.
Pay-as-you-go vs commitment tiers
With pay-as-you-go, you pay for each gigabyte ingested into the analytics tier. Commitment tiers let you reserve a fixed daily volume at a discounted effective rate. Commitments make sense once ingestion is steady and predictable; if you commit too high you pay for capacity you do not use, and if you commit too low the overage is billed at the commitment rate.
Analytics tier vs data lake tier
The analytics tier holds the data your detections, hunting queries and workbooks run against in near real time, and it is the most expensive place to store logs. The data lake tier is a lower-cost option for high-volume, lower-value logs you need for investigations, compliance or occasional queries. Routing each source to the right tier is one of the biggest cost levers available.
Retention costs
Each workspace includes a period of interactive retention at no extra charge. Keeping data longer, for audit or regulatory reasons, is billed per gigabyte per month. Long retention on verbose sources adds up quietly, so set retention per table based on what you actually need rather than one workspace-wide value.
Data sources that are free to ingest
Microsoft does not charge ingestion for some sources, such as Azure Activity logs, Office 365 audit logs and alerts from Microsoft Defender products. The list and its conditions change, so confirm current free sources on the Microsoft Sentinel pricing page before planning around them.
Where costs usually grow
Costs usually grow from verbose sources collected without filtering: firewall and proxy logs, DNS, Windows security events at full verbosity, and duplicated data sent through more than one connector. Uncommitted ingestion, retention set longer than required, and high-volume logs sitting in the analytics tier instead of the data lake tier are the other common causes.
How to estimate your bill
Start by measuring daily ingestion per table in your workspace, then decide which tier each source belongs in and how long it must be kept. Apply current regional rates from Microsoft's pricing page or the Azure pricing calculator, and compare pay-as-you-go against the nearest commitment tier. Review the estimate after a month of real data, since ingestion often differs from the plan.