Direct answer: at the Azure Data Explorer (ADX) pricing page and Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), an ADX cluster consists of an engine cluster + data management cluster: engine nodes bill VM cost + ADX markup $0.11/vCore-hour, data management nodes bill VM cost only; storage, networking and Load Balancer are extra, and clusters bill per minute. The official 100-hour example: 8×D13 v2 (8 vCore) + 2×D3 v2, engine VM 478.40 + markup 704.00 + DM VM 45.80 = 1,228.20. At 730 hours: 2 nodes $2,492.22/month (engine 873.08 + markup 1,284.80 + DM 334.34), 4 nodes $4,650.10, 8 nodes $8,965.86. Markup is 51.6%–57.3% of the total and is the most underestimated line. Production requires at least 2 engine + 2 DM; Dev/Test is 1+1, has no SLA and no markup; stop/pause releases compute but keeps storage; engine can autoscale and DM is service-selected.
This guide is for data platform, SRE, security and procurement teams evaluating high-volume logs/telemetry/security analytics, or comparing ADX with Log Analytics/Fabric/Synapse. It explains engine/DM clusters, markup, the official 100-hour example, 2/4/8-node 730-hour TCO, Dev/Prod, stop/autoscale, storage and selection. Prices come from the Azure Data Explorer pricing page, the Azure Retail Prices API and Microsoft Learn (eastus, 9 November 2026). Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) The ADX bill = engine VM + markup + data management VM + storage/network; markup is per engine vCore and can exceed the VM cost (57.3% in the 8-node example). (2) Production needs at least 2 engine + 2 DM; Dev/Test is 1+1, has no SLA and no markup, which suits PoCs. (3) Stop/pause stops compute but keeps storage; engine can autoscale, DM is service-selected, and storage/network/LB are extra.
Two clusters: Engine + Data Management
ADX is not a single VM: the engine cluster handles queries/cache and bills VM cost + markup; the data management cluster handles ingestion/management and bills VM cost only, with its SKU/node count selected by the service based on engine size and ingestion. The official example uses 8×D13 v2 (8 vCore) engine + 2×D3 v2 DM; D13 v2 is $0.598/hour, D3 v2 $0.229/hour and markup $0.11/vCore-hour. Clusters bill per minute; storage, networking and Load Balancer are charged to the subscription.
| Component | Billing | Example |
|---|---|---|
| Engine VM | Per minute | D13 v2 $0.598/hour |
| ADX markup | $0.11/vCore-hour | D13 v2 8 vCore = $0.88/hour/node |
| Data Management VM | Per minute, VM only | D3 v2 $0.229/hour; 2 nodes |
| Storage | Azure Storage standard | Retention/hot cache |
| Network/Load Balancer | Standard | Extra |
| Dev/Test | 1 engine + 1 DM | No SLA, no markup |
Sources: Azure Data Explorer pricing page and Learn "Choose a SKU" (9 November 2026). Markup scales with engine vCore; DM SKU/node count is service-selected, with 2×D3 v2 in the example.
Official 100-hour example: $1,228.20
Official example: 8×D13 v2 engine (8 vCore) + 2×D3 v2 DM for 100 hours. Engine VM: 8×100×0.598 = $478.40; markup: 8×8×100×0.11 = $704.00; DM VM: 2×100×0.229 = $45.80; total $1,228.20. Markup is 57.3% of the total—higher than the engine VM—so estimating ADX from VM price alone badly undercounts.
| Item | Calculation | Amount |
|---|---|---|
| Engine VM | 8 × 100 × 0.598 | 478.40 |
| ADX markup | 8 × 8 × 100 × 0.11 | 704.00 |
| Data Management VM | 2 × 100 × 0.229 | 45.80 |
| Total | — | 1,228.20 |
Source: official example in the Azure Data Explorer pricing FAQ (9 November 2026). Excludes storage, network, Load Balancer, tax and discounts.
2 / 4 / 8-node 730-hour TCO
Scaling the official example to 730 hours: 2 nodes $2,492.22/month (engine 873.08 + markup 1,284.80 + DM 334.34), 4 nodes $4,650.10 (engine 1,746.16 + markup 2,569.60 + DM 334.34), 8 nodes $8,965.86 (engine 3,492.32 + markup 5,139.20 + DM 334.34). Markup share rises with node count: 51.6% at 2 nodes, 55.3% at 4, 57.3% at 8. DM is still modelled as 2×D3 v2; the service selects the actual SKU/nodes.
| Engine nodes | Engine VM/month | Markup/month | DM/month | Total/month | Markup share |
|---|---|---|---|---|---|
| 2 | 873.08 | 1,284.80 | 334.34 | 2,492.22 | 51.6% |
| 4 | 1,746.16 | 2,569.60 | 334.34 | 4,650.10 | 55.3% |
| 8 | 3,492.32 | 5,139.20 | 334.34 | 8,965.86 | 57.3% |
Editorial calculation: 730 hours/month; D13 v2 $0.598/hour, 8 vCore; markup $0.11/vCore-hour; DM 2×D3 v2 at $0.229/hour. Excludes storage, network, LB, tax and discounts; actual DM SKU/nodes are service-selected.
Markup: the $0.11/vCore-hour multiplier
Markup depends only on engine vCore: D13 v2 has 8 vCore, so each node costs 8×0.11 = $0.88/hour in markup; 2/4/8 nodes cost $1.76/$3.52/$7.04 per hour, or $1,284.80/$2,569.60/$5,139.20 per 730 hours. This is why adding a node is not just VM cost: each D13 v2 adds $0.598 VM + $0.88 markup = $1.478/hour. Larger-vCore SKUs scale markup proportionally.
| Item | Value | Note |
|---|---|---|
| D13 v2 vCore | 8 | Official example |
| Markup/node-hour | 0.88 | 8 × 0.11 |
| 2-node markup/hour | 1.76 | 730h = 1,284.80 |
| 4-node markup/hour | 3.52 | 730h = 2,569.60 |
| 8-node markup/hour | 7.04 | 730h = 5,139.20 |
| Total increment/node-hour | 1.478 | VM 0.598 + markup 0.88 |
| Dev/Test markup | 0 | No markup, no SLA |
Sources: Azure Data Explorer pricing page (markup $0.11/vCore-hour, D13 v2 $0.598/hour, Dev tier no markup). Actual vCore count varies by SKU.
Dev/Test, stop/pause and autoscale
ADX offers Production (at least 2 engine + 2 DM, with SLA) and Dev/Test (1 engine + 1 DM, no SLA, no markup, lowest cost). Stop/pause releases compute and keeps storage; restarting resumes compute billing. Engine supports autoscale by load, DM is service-selected, and storage/network/LB always bill at standard rates. Markup supports 1/3-year reserved capacity; the discount follows the purchase page.
| Mode/lever | Rule | Cost impact |
|---|---|---|
| Production | ≥2 engine + 2 DM | SLA, markup applies |
| Dev/Test | 1 engine + 1 DM | No SLA, no markup |
| Stop/pause | Compute released, storage kept | Saves compute, not storage |
| Autoscale | Engine nodes by load | Cost follows node count |
| DM | Service-selected SKU/nodes | VM only |
| Storage/network/LB | Standard | Retention/traffic |
| Markup reservation | 1/3-year reserved | Discount per purchase page |
Sources: Azure Data Explorer pricing page and Learn "Choose a SKU" (9 November 2026). Dev/Test has no SLA; stopped/paused clusters still bill storage/network.
ADX vs Log Analytics vs Fabric vs Synapse
Choose by data shape: ADX for high-throughput telemetry/logs, complex KQL and low-latency queries over large data; Log Analytics for Azure-native ops/SIEM/alerting; Fabric for lakehouse/BI/Power BI integration; Synapse for SQL/Spark warehousing. ADX's cost advantage is "high query volume + large telemetry", but include engine VM + markup + DM + storage; low-volume/small data may be simpler on Log Analytics or Fabric.
| Scenario | Prefer | Why/check first |
|---|---|---|
| High-throughput telemetry/logs, complex KQL | ADX | Engine+markup+DM+storage |
| Azure-native ops/SIEM/alerting | Log Analytics | Per-GB ingestion/retention |
| Lakehouse/BI/Power BI | Fabric | CU capacity/OneLake |
| SQL/Spark warehousing | Synapse | DWU/serverless pools |
| PoC/dev/test | ADX Dev/Test | 1+1, no SLA, no markup |
| Intermittent/low load | Stop/pause | Saves compute only |
| Stable 1/3 years | Markup reserved | Discount per purchase page |
Editorial selection framework, not a vendor recommendation; see each pricing page for other services. Sources: Learn docs and pricing page (9 November 2026).
Hidden costs and 90-day checklist
Seven extra costs: storage (hot cache/retention), network/Load Balancer, DM nodes (service-selected, may grow with ingestion), autoscale ceiling, markup scaling with vCore, Dev/Test no SLA and storage still billing after stop. 90 days: weeks 1–2 inventory daily ingestion GB, retention, query concurrency/latency and peak engine nodes; weeks 2–4 model VM+markup+DM using the official example; weeks 4–6 run a Dev/Test PoC and KQL tests; weeks 6–8 evaluate autoscale, stop policy and retention; weeks 8–10 compare Log Analytics/Fabric/Synapse; weeks 10–12 evaluate markup reservations and vertical SKU scaling.
FAQ
How is Azure Data Explorer billed?
By engine cluster + data management cluster: engine nodes bill VM cost + markup $0.11/vCore-hour; DM nodes bill VM cost only; storage, network and Load Balancer are extra, and clusters bill per minute. The official example 8×D13 v2 + 2×D3 v2 for 100h = $1,228.20.
Why is markup higher than the VM?
Markup is per engine vCore: D13 v2 has 8 vCore × 0.11 = $0.88/node-hour, while the VM is $0.598/node-hour, so markup is larger. In the 8-node example, markup $704 vs engine VM $478.40, 57.3% of the total. Larger-vCore SKUs scale markup proportionally.
How much is the 100-hour example?
8×D13 v2 engine + 2×D3 v2 DM: engine VM 478.40 + markup 704.00 + DM VM 45.80 = $1,228.20. Excludes storage, network, LB, tax and discounts.
How much is 8 nodes for 730 hours?
8×D13 v2 + 2×D3 v2: engine 3,492.32 + markup 5,139.20 + DM 334.34 = $8,965.86/month; 2 nodes $2,492.22; 4 nodes $4,650.10. DM is modelled as 2×D3 v2; actual SKU/nodes are service-selected.
What is a Data Management node?
The DM cluster handles ingestion/management; its SKU and node count are selected by the ADX service based on engine size and ingestion (2×D3 v2 in the example). It bills VM cost only, no markup. Production requires at least 2 DM nodes.
Does stopping/pausing save money?
It saves compute: stop releases compute and keeps storage; restart resumes compute billing, while storage/network still bill. Suits Dev/Test/intermittent workloads, not continuous production.
What are Dev/Test limits?
1 engine + 1 DM, no SLA, lowest cost, no markup; suits PoC/dev/test. Production needs at least 2 engine + 2 DM for the SLA.
How do ADX, Log Analytics and Fabric compare?
Choose ADX for high-throughput telemetry/logs, complex KQL and low-latency queries over large data; Log Analytics for Azure-native ops/SIEM/alerting; Fabric for lakehouse/BI/Power BI; Synapse for SQL/Spark warehousing. Low-volume/small data may not justify ADX; compare VM+markup+DM+storage together.
Research method and limitations
This article separates "official price facts" from "editorial calculations": D13 v2 $0.598/hour, D3 v2 $0.229/hour, markup $0.11/vCore-hour and the 100h example $1,228.20 come from the Azure Data Explorer pricing FAQ; markup shares and the 2/4/8-node 730h TCO are editorial; Production 2+2/Dev 1+1, no SLA, service-selected DM, stop releases compute/keeps storage, autoscale, and separate storage/network/LB come from the pricing page and Learn "Choose a SKU" (eastus, 9 November 2026).
Eight limitations: (1) only eastus list prices, excluding tax/CSP/enterprise discounts; (2) 730-hour months; (3) the main TCO excludes storage, network, LB and tax; (4) DM is modelled as 2×D3 v2, while the service selects the actual SKU/nodes; (5) no real ingestion/KQL benchmark; (6) markup reservation discounts are not quantified; (7) SKUs/regions/availability change; (8) streaming ingestion, follower, Fabric mirroring and other advanced billing are not covered.
Sources and basis
- Microsoft Azure, Azure Data Explorer Pricing: azure.microsoft.com/en-us/pricing/details/data-explorer. Markup $0.11/vCore-hour, D13 v2/D3 v2 example, 100h bill, stop/autoscale, separate storage/network/LB. Accessed 9 November 2026.
- Azure Retail Prices API (productName contains Data Explorer, eastus): prices.azure.com/api/retail/prices. ADX markup $0.11/hour. Accessed 9 November 2026.
- Microsoft Learn, Choose a SKU: learn.microsoft.com/en-us/azure/data-explorer/manage-cluster-choose-sku. Production 2+2/Dev 1+1, no SLA, service-selected DM, compute/storage optimized, RI. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.