Plan costs and understand Microsoft Sentinel pricing and billing

As you plan your Microsoft Sentinel deployment, you typically want to understand its pricing and billing models to optimize your costs. Microsoft Sentinel's security analytics data is stored in an Azure Monitor Log Analytics workspace. Billing is based on the volume of data analyzed in Microsoft Sentinel and stored in the Log Analytics workspace. The cost of both is combined in a simplified pricing tier. Learn more about the simplified pricing tiers or learn more about Microsoft Sentinel pricing in general.

Before you add any resources for Microsoft Sentinel, use the Azure pricing calculator to help estimate your costs.

Costs for Microsoft Sentinel are only a portion of the monthly costs in your Azure bill. Although this article explains how to plan costs and understand the billing for Microsoft Sentinel, you're billed for all Azure services and resources your Azure subscription uses, including Partner services.

This article is part of the Deployment guide for Microsoft Sentinel.

Free trial

Enable Microsoft Sentinel on an Azure Monitor Log Analytics workspace and the first 10 GB/day is free for 31 days. The cost for both Log Analytics data ingestion and Microsoft Sentinel analysis charges up to the 10 GB/day limit are waived during the 31-day trial period. This free trial is subject to a 20 workspace limit per Azure tenant.

Usage beyond these limits is charged per the pricing listed on the Microsoft Sentinel pricing page. Charges related to extra capabilities for automation and bring your own machine learning are still applicable during the free trial.

During your free trial, find resources for cost management, training, and more on the News & guides > Free trial tab in Microsoft Sentinel. This tab also displays details about the dates of your free trial, and how many days left until the trial expires.

Identify data sources and plan costs accordingly

Identify the data sources you're ingesting or plan to ingest to your workspace in Microsoft Sentinel. Microsoft Sentinel allows you to bring in data from one or more data sources. Some of these data sources are free, and others incur charges. For more information, see Free data sources.

Estimate costs and billing before using Microsoft Sentinel

Use the Microsoft Sentinel pricing calculator to estimate new or changing costs. Enter Microsoft Sentinel in the Search box and select the resulting Microsoft Sentinel tile. The pricing calculator helps you estimate your likely costs based on your expected data ingestion and retention.

For example, enter the GB of daily data you expect to ingest in Microsoft Sentinel, and the region for your workspace. The calculator provides the aggregate monthly cost across these components:

• Microsoft Sentinel: Analytics logs and auxiliary/basic logs
• Azure Monitor: Retention
• Azure Monitor: Data Restore
• Azure Monitor: Search Queries and Search Jobs

Understand the full billing model for Microsoft Sentinel

Microsoft Sentinel offers a flexible and predictable pricing model. For more information, see the Microsoft Sentinel pricing page. Workspaces older than July 2023 might have Log Analytics workspace charges separate from Microsoft Sentinel in a classic pricing tier. For the related Log Analytics charges, see Azure Monitor Log Analytics pricing.

Microsoft Sentinel runs on Azure infrastructure that accrues costs when you deploy new resources. It's important to understand that there could be other, extra infrastructure costs that might accrue.

How you're charged for Microsoft Sentinel

Pricing is based on the types of logs ingested into a workspace. Analytics logs typically make up most of your high value security logs. Basic logs tend to be verbose with low security value. It's important to note that billing is done per workspace on a daily basis for all log types and tiers.

Analytics logs

There are two ways to pay for the analytics logs: Pay-As-You-Go and Commitment Tiers.

• Pay-As-You-Go is the default model, based on the actual data volume stored and optionally for data retention beyond 90 days. Data volume is measured in GB (10⁹ bytes).

• Log Analytics and Microsoft Sentinel have Commitment Tier pricing, formerly called Capacity Reservations. These pricing tiers are combined into simplified pricing tiers that are more predictable and offer substantial savings compared to Pay-As-You-Go pricing.

  Commitment Tier pricing starts at 100 GB per day. Any usage above the commitment level is billed at the Commitment tier rate you selected. For example, a Commitment tier of 100 GB per day bills you for the committed 100 GB data volume, plus any extra GB/day at the discounted effective rate for that tier. The Effective Per GB Price is simply the Microsoft Sentinel Price divided by the Tier GB per day quantity. For more information, see Microsoft Sentinel pricing.

  Increase your Commitment tier anytime to optimize costs as your data volume increases. Lowering the Commitment tier is only allowed every 31 days. To see your current Microsoft Sentinel pricing tier, select Settings in Microsoft Sentinel, and then select the Pricing tab. Your current pricing tier is marked as Current tier.

  To set and change your Commitment tier, see Set or change pricing tier. Switch any workspaces older than July 2023 to the simplified pricing tiers experience to unify billing meters. Or, continue to use the classic pricing tiers that separate out the Log Analytics pricing from the classic Microsoft Sentinel classic pricing. For more information, see simplified pricing tiers.

Auxiliary logs and Basic logs

Basic logs are a low-cost option, and Auxiliary logs a super-low-cost option, for ingesting high-volume, low-value data sources. They are charged at a flat, low rate per GB. They have the following limitations, among others:

• Reduced querying capabilities
• 30-day interactive retention
• No support for scheduled alerts

These two log types are best suited for use in playbook automation, ad-hoc querying, investigations, and search. For more information, see:

• Log retention plans in Microsoft Sentinel
• Log sources to use for Auxiliary Logs ingestion

To learn more about the difference between interactive retention and long-term retention (formerly known as archive), see Manage data retention in a Log Analytics workspace.

Simplified pricing tiers

Simplified pricing tiers combine the data analysis costs for Microsoft Sentinel and ingestion storage costs of Log Analytics into a single pricing tier. The following screenshot shows the simplified pricing tier that all new workspaces use.

Switch any workspace configured with classic pricing tiers to the simplified pricing tiers. For more information on how to Switch to new pricing, see Enroll in a simplified pricing tier.

Combining the pricing tiers offers a simplification to the overall billing and cost management experience, including visualization in the pricing page, and fewer steps estimating costs in the Azure calculator. To add further value to the new simplified tiers, the current Microsoft Defender for Servers P2 benefit granting 500 MB of security data ingestion into Log Analytics is extended to the simplified pricing tiers. This change greatly increases the financial benefit of bringing eligible data ingested into Microsoft Sentinel for each virtual machine (VM) protected in this manner. For more information, see FAQ - Microsoft Defender for Servers P2 benefit granting 500 MB.

Understand your Microsoft Sentinel bill

Billable meters are the individual components of your service that appear on your bill and are shown in Microsoft Cost Management. At the end of your billing cycle, the charges for each meter are summed. Your bill or invoice shows a section for all Microsoft Sentinel costs. There's a separate line item for each meter.

To see your Azure bill, select Cost Analysis in the left navigation of Cost Management. On the Cost analysis screen, find and select the Invoice details from All views.

The costs shown in the following image are for example purposes only. They're not intended to reflect actual costs. Starting July 1, 2023, legacy pricing tiers are prefixed with Classic.

Microsoft Sentinel and Log Analytics charges might appear on your Azure bill as separate line items based on your selected pricing plan. Simplified pricing tiers are represented as a single sentinel line item for the pricing tier. Ingestion and analysis are billed on a daily basis. If your workspace exceeds its Commitment tier usage allocation in any given day, the Azure bill shows one line item for the Commitment tier with its associated fixed cost, and a separate line item for the cost beyond the Commitment tier, billed at the same effective Commitment tier rate.

Learn how to view and download your Azure bill.

Costs and pricing for other services

Microsoft Sentinel integrates with many other Azure services, including Azure Logic Apps, Azure Notebooks, and bring your own machine learning (BYOML) models. Some of these services might have extra charges. Some of Microsoft Sentinel's data connectors and solutions use Azure Functions for data ingestion, which also has a separate associated cost.

Learn about pricing for these services:

• Automation-Logic Apps pricing
• Notebooks pricing
• BYOML pricing
• Azure Functions pricing

Any other services you use might have associated costs.

Interactive and long-term data retention costs

After you enable Microsoft Sentinel on a Log Analytics workspace, consider these configuration options:

• Retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard Log Analytics retention prices.
• Specify different retention settings for individual data types. Learn about retention by data type.
• Enable long-term retention for your data so you have access to historical logs. Long-term retention is a low-cost retention state for the preservation of data for such things as regulatory compliance. It's charged based on the volume of data stored and scanned. Learn how to configure interactive and long-term data retention policies in Azure Monitor Logs.
• Enroll tables that contain secondary security data in the Auxiliary logs plan. This plan allows you to store high-volume, low-value logs at a low price, with a lower-cost 30-day interactive retention period at the beginning to allow for summarization and basic querying. To learn more about the Auxiliary logs plan and other plans, see Log retention plans in Microsoft Sentinel.

Other CEF ingestion costs

CEF is a supported Syslog events format in Microsoft Sentinel. Use CEF to bring in valuable security information from various sources to your Microsoft Sentinel workspace. CEF logs land in the CommonSecurityLog table in Microsoft Sentinel, which includes all the standard up-to-date CEF fields.

Many devices and data sources support logging fields beyond the standard CEF schema. These extra fields land in the AdditionalExtensions table. These fields could have higher ingestion volumes than the standard CEF fields, because the event content within these fields can be variable.

Costs that might accrue after resource deletion

Removing Microsoft Sentinel doesn't remove the Log Analytics workspace Microsoft Sentinel was deployed on, or any separate charges that workspace might be incurring.

Free data sources

The following data sources are free with Microsoft Sentinel:

• Azure Activity Logs
• Microsoft Sentinel Health
• Office 365 Audit Logs, including all SharePoint activity, Exchange admin activity, and Teams
• Security alerts, including alerts from the following sources:
  • Microsoft Defender XDR
  • Microsoft Defender for Cloud
  • Microsoft Defender for Office 365
  • Microsoft Defender for Identity
  • Microsoft Defender for Cloud Apps
  • Microsoft Defender for Endpoint
• Alerts from the following sources:
  • Microsoft Defender for Cloud
  • Microsoft Defender for Cloud Apps

Although alerts are free, the raw logs for some Microsoft Defender XDR, Defender for Endpoint/Identity/Office 365/Cloud Apps, Microsoft Entra ID, and Azure Information Protection (AIP) data types are paid.

The following table lists the data sources in Microsoft Sentinel and Log Analytics that aren't charged. For more information, see excluded tables.

¹ For more information, see Auditing and health monitoring for Microsoft Sentinel.

For data connectors that include both free and paid data types, select which data types you want to enable.

Learn more about how to connect data sources, including free and paid data sources.

Learn more

• Monitor costs for Microsoft Sentinel
• Reduce costs for Microsoft Sentinel
• Learn how to optimize your cloud investment with Microsoft Cost Management.
• Learn more about managing costs with cost analysis.
• Learn about how to prevent unexpected costs.
• Take the Cost Management guided learning course.
• For more tips on reducing Log Analytics data volume, see Azure Monitor best practices - Cost management.

Next steps

In this article, you learned how to plan costs and understand the billing for Microsoft Sentinel.