Sentinel Cost Planning
Use this page to separate the main Sentinel cost levers: ingestion commitment, table plans, retention, and Microsoft 365 data grants. Use the Azure pricing calculator for exact regional prices before estimating a deployment.
Commitment Strategy
Commitment tiers are a billing choice for the Analytics tier. The exact regional price and savings percentage should come from the Azure pricing page, but the operational rule is stable: pick the lowest tier that matches sustained daily ingestion, and remember that lowering a tier requires waiting through the commitment period.
| Choice | Use when | Planning note |
|---|---|---|
| Pay as you go | Variable or pilot workloads | No daily commitment; data is billed by analyzed GB and optional retention beyond the included period. |
| 100 GB/day commitment | Predictable production ingestion at or above 100 GB/day | Microsoft Learn states commitment pricing starts at 100 GB/day; overage is billed at the effective rate for the selected tier. |
| 200-500 GB/day commitments | Growing workspaces with stable daily volume | The Azure pricing page publishes intermediate commitment tiers such as 200, 300, 400, and 500 GB/day; validate the current regional discount before quoting. |
| 1,000-50,000 GB/day commitments | Large enterprise or multi-workspace estates | Higher tiers are listed on the Azure pricing page and can provide the largest savings versus pay-as-you-go. |
| Dedicated cluster | Large multi-workspace estates | Can aggregate eligible workspace ingestion, but cluster commitment and unused commitment still need explicit modeling. |
Table Plan Decision
Pick the table plan by detection value first, then optimize verbose sources with Basic or Auxiliary when the documented query and feature limitations are acceptable.
flowchart TD
A[New log source] --> B{Used for detections}
B -->|Yes| C[Analytics table]
B -->|No| D{Needs frequent investigation}
D -->|Yes| E[Basic table]
D -->|No| F[Auxiliary table]
C --> G[Set interactive retention]
E --> H[Check query limitations]
F --> I[Use search jobs for rare investigations]| Plan | Use for | Constraint |
|---|---|---|
| Analytics | Security detections, incidents, hunting, automation, and multi-table KQL | Query price is included. Sentinel workspaces include 90 days of analytics retention at no extra charge; total retention can extend up to 12 years. |
| Basic | Verbose troubleshooting data that still needs lower-cost interactive access | Reduced ingestion cost. Query price is not included; Basic/Auxiliary queries are charged by data scanned and are limited to one table plus supported lookup/union patterns. |
| Auxiliary | Low-touch audit/compliance data with infrequent searches | Lowest ingestion tier for supported custom logs. Queries are unoptimized and charged by data scanned. Data export rules are not supported. |
| Search jobs | Historical or rare investigations over Basic, Auxiliary, or long-retained data | Supported across Analytics, Basic, and Auxiliary; use scoped time windows because scan volume drives cost. |
Credits and No-Cost Sources
| Source | Cost lever | Planning note |
|---|---|---|
| Microsoft 365 E7, E5, A5, F5, G5 | Eligible Microsoft 365 data can receive an ingestion grant | Model the grant separately from non-Microsoft 365 sources. Microsoft describes the benefit as up to 5 MB per licensed user per day for eligible Microsoft 365 data. |
| Free Sentinel data sources | AzureActivity, SentinelHealth, OfficeActivity, SecurityIncident, and selected SecurityAlert records are listed as free data types | The raw logs behind some Defender, Entra, and AIP sources can still be paid even when alerts/incidents are free. |
| Defender XDR data | SecurityIncident and SecurityAlert from Defender XDR are free data types; raw XDR event tables may be billable | Validate source-by-source before sizing commitment. |
| Custom logs and third-party sources | Usually billable ingestion | Use DCR transformations and table plans to control volume |
Free Data Type Checklist
Microsoft lists these Sentinel and Log Analytics data types as not charged. Use table-level usage reports to confirm what is actually landing as free versus billable in the workspace.
| Connector/source | Free data type |
|---|---|
| Azure Activity | AzureActivity |
| Microsoft Sentinel Health | SentinelHealth |
| Microsoft 365 | OfficeActivity for SharePoint, Exchange, and Teams |
| Microsoft Defender for Cloud | SecurityAlert (Azure Security Center) |
| Microsoft Defender for IoT | SecurityAlert (Azure Security Center for IoT) |
| Microsoft Defender XDR | SecurityIncident and SecurityAlert |
| Microsoft Defender for Endpoint | SecurityAlert (MDATP) |
| Microsoft Defender for Identity | SecurityAlert (AATP) |
| Microsoft Defender for Cloud Apps | SecurityAlert (MCAS) |
| Microsoft Defender for Office 365 | SecurityAlert (OATP) |
| Microsoft Entra ID Protection | SecurityAlert (IPC) |
Defender Cloud Naming Trap
Cost and connector labels may preserve older product names. Keep SaaS/CASB telemetry separate from cloud infrastructure and workload telemetry when estimating raw event ingestion.
| Product | Planning note |
|---|---|
| Defender for Cloud Apps (MDCA) | SaaS/CASB product. In Defender XDR hunting, CloudAppEvents is populated by Defender for Cloud Apps. Some Sentinel alert labels still show the older MCAS naming. |
| Defender for Cloud (MDC) | Cloud infrastructure and workload product. In Defender XDR hunting, CloudAuditEvents and related Cloud* infrastructure tables are populated by Defender for Cloud. Some Sentinel alert labels still use Azure Security Center naming. |