Microsoft Sentinel pricing is driven mainly by how much log data you ingest and analyze, how long you retain it, and which data tier you use. You can pay as you go per gigabyte or reserve a commitment tier for a discount at predictable volumes. Some Microsoft data sources can be ingested at no charge, and lower-cost data tiers suit high-volume logs used mainly for investigation. Good data planning is the difference between an affordable SIEM and a runaway bill.
Key Takeaways
- Cost = analytics ingestion + retention beyond included periods + optional features such as automation runs and data export.
- Commitment tiers lower the effective per-GB price when daily volumes are stable.
- Certain sources, such as Azure Activity logs and Microsoft 365 audit data for supported tables, are free to ingest; some Defender alerts are also free.
- Lower-cost log tiers and data lake options suit high-volume, low-value logs like firewall or proxy logs.
- Always check the official Azure pricing page for current regional rates.
How Microsoft Sentinel Pricing Works
| Cost component | What it covers |
|---|---|
| Analytics log ingestion | Data available for detections, hunting and workbooks |
| Commitment tiers | Pre-purchased daily GB volumes at discounted rates |
| Lower-cost log tiers | High-volume logs with limited query features |
| Data retention | Interactive retention beyond the included period and long-term archive |
| Automation | Logic Apps playbook executions |
| Search and restore | Querying archived data |
How to Estimate Your Sentinel Cost
- List all log sources: Entra ID sign-ins, Microsoft 365, Defender, firewalls, servers, SaaS apps.
- Estimate daily GB per source, using a pilot workspace for 2–4 weeks if possible.
- Separate free sources from billable ones.
- Decide which logs need analytics tier and which can use lower-cost tiers.
- Define retention requirements from compliance needs.
- Model pay-as-you-go versus commitment tiers using the Azure pricing calculator.
10 Ways to Control Sentinel Costs
- Start with a pilot to measure real volumes.
- Use free data connectors first for Microsoft sources.
- Filter noisy events at the source or with data collection rules.
- Route verbose logs to lower-cost tiers.
- Avoid duplicate ingestion of the same events through multiple connectors.
- Choose a commitment tier once daily volume is stable.
- Set retention per table instead of one global policy.
- Monitor ingestion with the workspace usage workbook and alerts on anomalies.
- Review unused tables and connectors quarterly.
- Combine Sentinel cost reviews with your wider Azure FinOps program.
Sentinel vs Defender XDR: Where Data Lives
Microsoft Defender XDR provides detection across endpoints, identity, email and cloud apps. Sentinel adds a SIEM layer for third-party logs, custom detections, long-term retention and SOAR automation. Many organizations start with Defender XDR and add Sentinel for broader visibility. See our Defender XDR deployment service.
Need help prioritizing log sources? Our NIST CSF 2.0 guide explains how detection fits your overall program.
How Skytech Enterprise Helps
Our Microsoft Sentinel deployment service designs workspaces, data collection rules, detections and playbooks with cost controls built in, for organizations in the USA and UAE. Request a Sentinel cost and coverage review.
Frequently Asked Questions
Is Microsoft Sentinel priced per user?
No. Sentinel is primarily priced by data volume ingested and retained, not by users or devices.
What data is free in Microsoft Sentinel?
Microsoft lists certain sources as free, such as Azure Activity logs, Office 365 audit logs for supported tables and some Microsoft security alerts. Check current documentation as the list can change.
What is a Sentinel commitment tier?
A commitment tier is a fixed daily ingestion volume purchased at a discounted rate compared with pay-as-you-go pricing.
How can we reduce Sentinel costs quickly?
Filter noisy logs, move verbose sources to lower-cost tiers, remove duplicate connectors and adjust retention per table.
Do we need Sentinel if we have Defender XDR?
Not always. Defender XDR covers Microsoft workloads well. Sentinel is valuable when you need third-party log correlation, custom detections, SOAR and long retention.
How long does Sentinel retain data?
Sentinel includes an initial retention period for analytics data, with configurable longer retention and archive options at additional cost.