Direct answer: at the Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), Azure Monitor Log Analytics prices are: Analytics Logs $2.30/GB (first 5 GB per billing account per month free), Basic Logs $0.50/GB and Auxiliary Logs $0.05/GB. Analytics includes 31 days of retention (90 days with Microsoft Sentinel); Basic/Auxiliary each include 30 days. Beyond that, interactive retention is $0.10/GB-month and long-term archive is $0.02/GB-month. Basic/Auxiliary queries bill at $0.005/GB scanned; Analytics queries are included. Commitment tiers run from 100 GB/day at $196/day ($1.96/GB, $5,880 per 30 days) to 50,000 GB/day at $73,600/day ($1.472/GB). At 100 GB/day all-Analytics, PAYG is $6,888.50/month versus $5,880 for the 100 GB commitment, a $1,008.50 (14.6%) saving. Splitting 100 GB/day into 50 GB Analytics + 30 GB Basic + 20 GB Auxiliary costs about $3,918.50/month in ingestion, $2,970 (43.1%) less than all-Analytics. Hidden costs are separate: restore $0.10/GB-day (2 TB/12-hour minimum, about $204.80 per day), export $0.10/GB, replication $0.25/GB and search jobs $0.005/GB.
This guide is for SRE, platform/observability, finance and procurement teams reducing an Azure monitoring bill. It explains the Analytics/Basic/Auxiliary table plans, the 5 GB free allowance and 31/30-day retention, 100–50,000 GB/day commitment tiers, 50/100/500/1,000 GB/day TCO, mixed plans, hidden costs and a 90-day optimization checklist. Prices come from the Azure Monitor pricing page, the Azure Retail Prices API and Microsoft Learn (eastus, 9 November 2026). Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) Choose the table plan before comparing unit prices: Auxiliary $0.05, Basic $0.50 and Analytics $2.30 differ by 46×. (2) The 5 GB free allowance is Analytics-only, and commitment tiers cover Analytics only; Basic/Auxiliary do not participate. (3) The 31/30-day retention is included in ingestion; interactive retention is $0.10, archive $0.02, and restore/export/replication are extra.
Three table plans: a 46× spread between $0.05, $0.50 and $2.30
Azure Monitor Logs is not one price; it prices by table plan. Analytics suits high-value data used for continuous monitoring and real-time alerting; Basic suits troubleshooting data queried within 30 days at a moderate rate; Auxiliary suits audit, compliance and verbose logs that are stored but rarely queried. All three can coexist per table in one workspace, so putting every log in Analytics is usually not the cheapest design.
| Table plan | Ingestion | Included retention | Query | Alerting/capability | Typical use |
|---|---|---|---|---|---|
| Analytics | $2.30/GB (first 5 GB/account/month free) | 31 days (90 with Sentinel) | Included | Full KQL, alerts, Insights | Continuous monitoring, real-time detection |
| Basic | $0.50/GB | 30 days | $0.005/GB scanned | Simple log alerts (preview) | Occasional troubleshooting, incident response |
| Auxiliary | $0.05/GB | 30 days | $0.005/GB scanned | No alerting | Audit, compliance, verbose logs |
Sources: Azure Monitor pricing page, Learn "Azure Monitor Logs cost calculations" and "Table plans" (eastus, 9 November 2026). Basic/Auxiliary 30-day retention can extend to 12 years; Analytics interactive retention reaches 2 years and total retention 12 years (4,383 days).
The 5 GB free allowance and retention: 31/30 days included, then $0.10 or $0.02
Analytics ingestion includes the first 5 GB per billing account per month free, then $2.30/GB; Basic/Auxiliary have no such allowance. Retention has two layers: interactive retention (real-time queries) beyond 31 days costs $0.10/GB-month for Analytics; long-term retention/archive (queried with search jobs) costs $0.02/GB-month and is available for Analytics, Basic and Auxiliary up to 12 years. Extending 100 GB/day from 31 to 90 days keeps an extra 5,900 GB: about $590/month interactive versus $118/month archived, a 5× difference.
| Item | Price | Basis/minimum |
|---|---|---|
| Analytics ingestion | $2.30/GB | First 5 GB per billing account per month free |
| Basic ingestion | $0.50/GB | Includes 30 days; no 5 GB allowance |
| Auxiliary ingestion | $0.05/GB | Includes 30 days; no 5 GB allowance |
| Interactive retention (Analytics) | $0.10/GB-month | Beyond 31 days; up to 2 years |
| Long-term archive | $0.02/GB-month | Analytics/Basic/Auxiliary; up to 12 years |
| Basic/Auxiliary query | $0.005/GB scanned | Based on scanned volume, not rows returned |
| Search job | $0.005/GB scanned | Plus ingestion of search results |
| Data restore | $0.10/GB-day | 2 TB and 12-hour minimum; rounded up |
| Data export | $0.10/GB | Exported JSON bytes; Auxiliary not yet supported |
| Workspace replication | $0.25/GB | Cross-region copy; Auxiliary not yet supported |
| Platform logs | $0.25/GB | Platform logs exported via diagnostic settings |
Sources: Azure Monitor pricing page and Azure Retail Prices API (eastus, 9 November 2026). Retention bills per GB-month, prorated daily; the 2 TB restore minimum is an editorial example based on the official rule. 1 TB = 1,024 GB.
Commitment tiers: 100–50,000 GB/day, 31-day term
A commitment tier buys a fixed daily GB volume at a lower unit price: the minimum is 100 GB/day, the maximum 50,000 GB/day, and the term is 31 days. Upgrades take effect the next day at 12:01 AM UTC; reductions or opt-out wait 31 days, and every change resets the 31-day clock; a tier can be lowered once within 6 hours of configuration. Usage above the commitment is still billed at that tier's per-GB rate (not back to PAYG), and unused commitment does not roll over. Tiers cover Analytics Logs only; Basic/Auxiliary do not participate. Multiple workspaces can share a tier through a Dedicated Cluster, but clusters also start at 100 GB/day and have no PAYG option.
| Tier (GB/day) | Price (/day) | 30 days | Effective /GB | Discount vs $2.30 |
|---|---|---|---|---|
| 100 | 196 | 5,880 | 1.96 | 14.8% |
| 200 | 368 | 11,040 | 1.84 | 20.0% |
| 300 | 540 | 16,200 | 1.80 | 21.7% |
| 400 | 704 | 21,120 | 1.76 | 23.5% |
| 500 | 865 | 25,950 | 1.73 | 24.8% |
| 1,000 | 1,700 | 51,000 | 1.70 | 26.1% |
| 2,000 | 3,320 | 99,600 | 1.66 | 27.8% |
| 5,000 | 8,050 | 241,500 | 1.61 | 30.0% |
| 10,000 | 15,640 | 469,200 | 1.564 | 32.0% |
| 25,000 | 37,950 | 1,138,500 | 1.518 | 34.0% |
| 50,000 | 73,600 | 2,208,000 | 1.472 | 36.0% |
Sources: Azure Retail Prices API (eastus, 9 November 2026); discounts are editorial calculations versus Analytics PAYG at $2.30/GB. Microsoft says commitment tiers save up to about 30%; current API rates imply about 36% at the 50,000 GB/day tier, so check the purchase page. 30 days is a conversion, not the billing period.
Four scenarios: 50 / 100 / 500 / 1,000 GB/day
Using 30 days, Analytics, only the 5 GB free allowance, and no retention/query/export: 50 GB/day (1,500 GB/month) is $3,438.50 PAYG and below the 100 GB/day minimum, so it stays PAYG; 100 GB/day (3,000 GB) is $6,888.50 PAYG versus $5,880 on the 100 GB tier, saving $1,008.50 (14.6%); 500 GB/day (15,000 GB) is $34,488.50 versus $25,950, saving $8,538.50 (24.8%); 1,000 GB/day (30,000 GB) is $68,988.50 versus $51,000, saving $17,988.50 (26.1%).
| Daily volume | GB/month | PAYG/month | Tier | Commitment/month | Saving |
|---|---|---|---|---|---|
| 50 GB | 1,500 | 3,438.50 | None (100 minimum) | — | — |
| 100 GB | 3,000 | 6,888.50 | 100 GB | 5,880.00 | 1,008.50 (14.6%) |
| 500 GB | 15,000 | 34,488.50 | 500 GB | 25,950.00 | 8,538.50 (24.8%) |
| 1,000 GB | 30,000 | 68,988.50 | 1,000 GB | 51,000.00 | 17,988.50 (26.1%) |
| 5,000 GB | 150,000 | 344,988.50 | 5,000 GB | 241,500.00 | 103,488.50 (30.0%) |
Editorial calculation: 30 days; Analytics $2.30/GB; 5 GB/month free applied first; commitment = daily price × 30; excludes retention, queries, restore/export/replication, Sentinel, tax and discounts. Actual days and daily volume change the result.
Mixed table plans: 100 GB/day split 50/30/20
Split 100 GB/day into 50 GB Analytics + 30 GB Basic + 20 GB Auxiliary: Analytics 1,500 GB/month after the 5 GB allowance is $3,438.50; Basic 900 GB is $450; Auxiliary 600 GB is $30; total $3,918.50/month, $2,970 (43.1%) less than all-Analytics at $6,888.50. The trade-off: Basic/Auxiliary have only 30-day retention, queries bill by scan, and Auxiliary has no alerting. If those tables need real-time queries beyond 30 days or full alerting, they cannot simply move down.
| Plan | GB/day | GB/month | Unit price | Monthly |
|---|---|---|---|---|
| Analytics | 50 | 1,500 | $2.30 (first 5 GB free) | 3,438.50 |
| Basic | 30 | 900 | $0.50 | 450.00 |
| Auxiliary | 20 | 600 | $0.05 | 30.00 |
| Total | 100 | 3,000 | — | 3,918.50 |
| Baseline: all Analytics | 100 | 3,000 | $2.30 (first 5 GB free) | 6,888.50 |
| Saving | — | — | — | 2,970.00 (43.1%) |
Editorial calculation: 30 days; excludes Basic/Auxiliary query scans ($0.005/GB), long-term retention, alerts/workbooks/Sentinel, tax and discounts. If 300 GB of Basic/Auxiliary data is scanned per month, query cost is about $1.50, small relative to ingestion.
Hidden costs: queries, restore, export, replication and metrics
Seven items usually explain a bill above "GB × unit price": Basic/Auxiliary query scans ($0.005/GB), search jobs ($0.005/GB plus result ingestion), restore ($0.10/GB-day, 2 TB/12-hour minimum, about $204.80 per day), export ($0.10/GB), workspace replication ($0.25/GB), platform logs ($0.25/GB) and advanced platform metrics ($0.11 per 10M samples; platform metrics themselves are free and retained 90 days). Alert rules, notifications, Web Tests and Microsoft Sentinel bill separately; with Sentinel enabled, Basic/Auxiliary ingestion may be metered by Sentinel and Analytics included retention becomes 90 days.
| Scenario | Preferred plan | Why/check first |
|---|---|---|
| Real-time alerting/continuous monitoring | Analytics | Full KQL, alerts; 31 days included |
| Troubleshooting within 30 days | Basic | $0.50/GB; query by scan; simple alerts preview |
| Audit/compliance/verbose | Auxiliary | $0.05/GB; no alerting; 30 days included |
| High, stable daily volume | Analytics + commitment | ≥100 GB/day; 31-day term |
| Multiple workspaces | Dedicated Cluster | Share a tier; 100 GB/day minimum; no PAYG |
| Low-cost long-term retention | Archive $0.02/GB-month | Search jobs at $0.005/GB |
| Cross-region DR | Workspace replication | $0.25/GB; Auxiliary not supported |
Editorial selection framework, not a vendor recommendation; actual plans depend on table type, region, feature availability and compliance. Source: Azure Monitor pricing page (9 November 2026).
90-day optimization checklist
Use 90 days to move through "inventory tables → assign plans → reduce noise → tier retention → commitment → review". Weeks 1–2: measure GB/day, query frequency, alerting dependencies and retention needs per table, and flag candidates for Basic/Auxiliary. Weeks 2–4: migrate one or two low-risk tables and verify query scan cost, the 30-day limit and alerting gaps. Weeks 4–6: use DCR filtering/transformations to drop unused fields, checking the official Log Processing billing rules. Weeks 6–8: cut interactive retention to 31 days, move long-term data to archive and clean soft-deleted data. Weeks 8–10: compare PAYG against commitment tiers using stable Analytics GB/day, and confirm the 31-day term and downgrade limits. Weeks 10–12: review restore/export/replication/metrics/Sentinel meters and set budget alerts.
FAQ
How is Azure Monitor Log Analytics billed?
By table plan and GB: Analytics $2.30/GB (first 5 GB per billing account per month free), Basic $0.50/GB, Auxiliary $0.05/GB; retention beyond the included period is $0.10/GB-month interactive or $0.02/GB-month archived; Basic/Auxiliary queries bill at $0.005/GB scanned, while Analytics queries are included.
How does the 5 GB free allowance work?
It applies only to Analytics Logs, as the first 5 GB per billing account per month, not per workspace or per day. Basic/Auxiliary have no such allowance, and commitment tiers do not change the 5 GB calculation.
How do I choose Analytics, Basic or Auxiliary?
Use Analytics for high-value data that needs real-time alerting and full KQL; Basic for troubleshooting within 30 days at moderate query frequency ($0.50/GB); Auxiliary for audit, compliance and rarely queried verbose logs ($0.05/GB). They can mix per table in one workspace, but Basic/Auxiliary have limited retention, alerting and query capability.
How much do commitment tiers save, and what are the limits?
From 100 GB/day at $196/day ($1.96/GB) to 50,000 GB/day at $73,600/day ($1.472/GB), about 14.8%–36% below $2.30/GB. The minimum is 100 GB/day with a 31-day term; upgrades take effect the next day, while reductions/opt-out wait 31 days and reset the clock on every change. They cover Analytics only; Basic/Auxiliary do not participate; usage above the commitment still bills at the tier's per-GB rate.
How much does 90-day or one-year retention cost?
Analytics includes 31 days (90 with Sentinel); Basic/Auxiliary include 30 days. Beyond that, interactive retention is $0.10/GB-month and archive is $0.02/GB-month. Extending 100 GB/day from 31 to 90 days keeps an extra 5,900 GB: about $590/month interactive or $118/month archived. Archive reaches 12 years and is queried with search jobs ($0.005/GB scanned).
How are Basic/Auxiliary queries charged?
At $0.005/GB of data scanned, not per row returned; Analytics queries are free. Search jobs also bill $0.005/GB scanned plus ingestion of the results. Larger query ranges and wider scans cost more, so Basic/Auxiliary suit data that is rarely queried and queried narrowly.
Why is the bill higher than the ingestion estimate?
Common causes: retention beyond 31/30 days ($0.10 interactive, $0.02 archive), Basic/Auxiliary query scans, restore ($0.10/GB-day with a 2 TB/12-hour minimum), export ($0.10/GB), replication ($0.25/GB), platform logs ($0.25/GB), advanced metrics ($0.11 per 10M samples) and separate Sentinel/alert charges.
How do Log Analytics and Microsoft Sentinel split the bill?
Log Analytics is the underlying log platform; Sentinel is the SIEM built on it. With Sentinel enabled, Basic/Auxiliary ingestion may be metered by Sentinel, Analytics included retention becomes 90 days, and commitment tiers may follow Sentinel tiers. Confirm whether the workspace has Sentinel before comparing "Log Analytics + Sentinel" total cost rather than the Log Analytics unit price alone.
Research method and limitations
This article separates "official price facts" from "editorial calculations": Analytics $2.30/GB, Basic $0.50/GB, Auxiliary $0.05/GB, interactive retention $0.10/GB-month, archive $0.02/GB-month, Basic/Auxiliary query $0.005/GB, search job $0.005/GB, export $0.10/GB, restore $0.10/GB-day, replication $0.25/GB, platform logs $0.25/GB, advanced metrics $0.11 per 10M samples and the 100–50,000 GB/day tiers come from the Azure Monitor pricing page and the Azure Retail Prices API (eastus, 9 November 2026); the 31/30-day included retention, 2-year interactive/12-year total retention, the three table plans, Analytics-only commitment coverage, the 31-day term and same-tier overage come from Microsoft Learn (cost-logs, data-retention-archive, data-platform-logs).
Eight limitations: (1) only eastus list prices, excluding tax, CSP/CMP markups and enterprise discounts; (2) 30-day months, without modelling every month length; (3) the 5 GB allowance is per billing account and is not split across subscriptions; (4) commitment tiers are converted linearly from daily prices, without daily-volume swings, unused commitment or downgrade constraints; (5) no real query-scan benchmark, so Basic/Auxiliary query cost may be underestimated; (6) Sentinel, Defender, Application Insights, Workbooks, alert notifications and Web Tests are not fully covered; (7) DCR filtering/transformation Log Processing fees are not modelled (official rules are being phased in, so check current status before purchase); (8) prices, plan availability and regions change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure Monitor Pricing: azure.microsoft.com/en-us/pricing/details/monitor. Three table plans, 5 GB free, 31/30/90-day retention, commitment rules, query/export/restore/replication, metrics and alerts. Accessed 9 November 2026.
- Azure Retail Prices API (serviceName=Azure Monitor / Log Analytics, eastus): prices.azure.com/api/retail/prices. $2.30/$0.50/$0.05, $0.10/$0.02, $0.005, $0.10, $0.25, $0.11 and the 100–50,000 GB/day tiers. Accessed 9 November 2026.
- Microsoft Learn, Azure Monitor Logs cost calculations and options: learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs. Three plans, 31-day inclusion, Analytics-only commitment coverage, same-tier overage, Dedicated Cluster. Accessed 9 November 2026.
- Microsoft Learn, Manage data retention in a Log Analytics workspace: learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-archive. 30/31-day defaults, 2-year interactive, 12-year total, 4-day minimum. Accessed 9 November 2026.
- Microsoft Learn, Azure Monitor Logs table plans: learn.microsoft.com/en-us/azure/azure-monitor/logs/data-platform-logs. Analytics/Basic/Auxiliary capabilities, query windows and use cases. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.