Direct answer: using Azure official retail prices retrieved on 7 November 2026 (eastus, USD, pay-as-you-go/retail, excluding enterprise discounts and tax), Microsoft Sentinel's analytics tier pay-as-you-go rate is USD 4.30/GB. A 100 GB/day commitment tier costs USD 296/day (about USD 8,880/month at 30 days, or USD 2.96/GB, about 31% saving); 500 GB/day is USD 1,265/day (about USD 37,950/month, USD 2.53/GB, about 41% saving); 1,000 GB/day is USD 2,480/day (about USD 74,400/month, USD 2.48/GB, about 42% saving); the top 50,000 GB/day tier is USD 102,600/day (USD 2.052/GB, about 52% saving). The data lake tier uses a separate model: ingestion USD 0.05/GB, processing USD 0.10/GB, storage USD 0.026/GB-month (billed at 6:1 compression) and query USD 0.005/GB scanned. At 100 GB/day, 100% processing and 30-day retention, the data lake estimate is about USD 465/month; it is not a real-time detection tier, so the right approach is to put primary security data in analytics and high-volume secondary logs in the lake, not to choose one for everything.
This guide is for security operations, IT operations and procurement teams budgeting a SIEM, choosing log tiers and controlling retention costs. Prices come from Microsoft Sentinel's official pricing page and the Azure Retail Prices API (serviceName=Sentinel, armRegionName=eastus, retrieved 7 November 2026); tiering and retention rules come from Microsoft Learn billing and log-retention documentation. Official price facts, editorial calculations and excluded items are kept separate.
(1) Analytics is billed per GB (USD 4.30/GB); commitment tiers are billed per GB reserved per day. A commitment only pays off when actual usage is close to the reservation. (2) The data lake is cheaper because it trades real-time query/alerting for low-cost long-term retention plus per-scan query charges; it is not a replacement for the analytics tier. (3) 90 days of interactive retention is included in analytics; retention beyond 90 days, multiple workspaces, graph/notebook/SAP capabilities and similar items are billed separately.
Scope: per GB, per day, per scan - do not mix units
A Sentinel bill uses at least three units: analytics is billed per GB ingested (109 bytes, not GiB); commitment tiers are billed per GB reserved per day, multiplied by 30 for a month (not 730 hours); the data lake separately charges ingestion GB, processing GB, storage GB-month and query-scanned GB. Data lake storage is billed at a 6:1 compression ratio: 600 GB of raw data is billed as 100 GB. Monthly figures here assume 30 days; actual month length, region, currency, enterprise discounts and tax will change the result. All prices are eastus retail and exclude classic Log Analytics billing, notebook/graph compute, the SAP solution, MCP tools and other possible charges.
| Meter | Official rate (eastus) | Unit | Notes |
|---|---|---|---|
| Analytics pay-as-you-go | USD 4.30 | 1 GB | Default model; 90 days of interactive retention included |
| Basic Logs analysis | USD 1.00 | 1 GB | Lower-cost log plan, billed per GB |
| Data lake ingestion | USD 0.05 | 1 GB | Only for tables retained in the data lake tier only |
| Data processing | USD 0.10 | 1 GB | Redaction, splitting, filtering, normalisation |
| Data lake storage | USD 0.026 | 1 GB/month | Billed after 6:1 compression |
| Data lake query | USD 0.005 | 1 GB scanned | Uncompressed data scanned by KQL queries/jobs |
| Advanced Data Insights | USD 0.15 | 1 hour | Notebook sessions/jobs and custom graph compute |
Sources: Azure Retail Prices API (serviceName=Sentinel, armRegionName=eastus, type=Consumption, 7 November 2026); Microsoft Sentinel pricing page and Microsoft Learn billing documentation. Rates are retail and exclude enterprise/CSP discounts, tax and exchange rates; the Azure invoice governs.
Commitment tiers: how much daily GB actually saves
A commitment tier (formerly Capacity Reservation) exchanges a fixed daily fee for a lower per-GB rate. Microsoft states that commitment tiers start at 100 GB/day; usage above the reservation is still billed at that tier's discounted rate; upgrades can be made at any time, but downgrades/exits require at least 31 days; a commitment applies per workspace and cannot be shared across workspaces or subscriptions. The 50 GB/day tier is a public preview promotion from 1 October 2025, with promotional pricing lockable until 31 March 2027 and varying by region. The table converts each eastus tier into an effective per-GB price and saving versus USD 4.30/GB, so you can compare it with your actual daily volume.
| Commitment (GB/day) | Daily fee (USD) | 30-day month | Effective (USD/GB) | Saving vs PAYG |
|---|---|---|---|---|
| 50 (public preview promo) | 161.25 | about 4,838 | 3.225 | about 25.0% |
| 100 | 296.00 | about 8,880 | 2.960 | about 31.2% |
| 200 | 548.00 | about 16,440 | 2.740 | about 36.3% |
| 500 | 1,265.00 | about 37,950 | 2.530 | about 41.2% |
| 1,000 | 2,480.00 | about 74,400 | 2.480 | about 42.3% |
| 5,000 | 11,550.00 | about 346,500 | 2.310 | about 46.3% |
| 50,000 | 102,600.00 | about 3,078,000 | 2.052 | about 52.3% |
Sources: Azure Retail Prices API (eastus, 7 November 2026). Effective price = daily fee / committed GB; saving = 1 - effective price / 4.30; monthly = daily fee x 30. Commitments apply per workspace and overage is billed at the tier's discounted rate. The 50 GB tier is a public preview promotion from 1 October 2025 to 31 December 2026, with pricing locked until 31 March 2027; check the official page for details.
Analytics TCO: 100/500/1,000 GB/day
Multiply average daily ingestion by 30 days and then by the unit rate to get the monthly analytics bill. At the USD 4.30/GB pay-as-you-go rate, 100/500/1,000 GB/day costs about USD 12,900/64,500/129,000 per month; with the matching commitment tier, about USD 8,880/37,950/74,400 per month. The key is not that a commitment is always cheaper, but that actual daily usage must be close to or above the reservation: if you use only 50 GB/day but buy the 100 GB tier, you still pay USD 8,880/month, more than the USD 6,450/month pay-as-you-go cost. Commitments can be upgraded but downgrades take 31 days, so lock in after one or two months of real usage data.
| Average daily ingestion | PAYG monthly (4.30/GB) | Matching commitment | Commitment monthly | Monthly difference | Saving |
|---|---|---|---|---|---|
| 100 GB/day | 12,900 | 100 GB/day | 8,880 | -4,020 | 31.2% |
| 500 GB/day | 64,500 | 500 GB/day | 37,950 | -26,550 | 41.2% |
| 1,000 GB/day | 129,000 | 1,000 GB/day | 74,400 | -54,600 | 42.3% |
Editorial calculation: monthly = daily GB x 30 x unit rate; commitment = daily fee x 30; excludes retention beyond 90 days, multiple workspaces, SAP/graph/notebook, tax and discounts. Use a 30-day rolling average, not the peak, for actual daily volume.
Data lake TCO: cheaper, but not "same function for less"
The data lake separates storage from compute: ingestion USD 0.05/GB, processing USD 0.10/GB, storage USD 0.026/GB-month (6:1 compression) and query USD 0.005/GB scanned. At 100 GB/day, 30-day retention, 100% processing and monthly queries scanning 10% of raw data: ingestion USD 150, processing USD 300, storage about USD 13 (3,000 GB / 6 x 0.026) and query about USD 1.5, for about USD 465/month. At 500 GB/day the estimate is about USD 2,323/month; at 1,000 GB/day about USD 4,645/month. The gap versus analytics comes mainly from giving up real-time detection/alerting and paying per scanned GB, so the lake is a retention tier for secondary logs, not a replacement for the primary SIEM.
| Average daily ingestion | Ingestion | Processing | Storage | Query | Monthly total |
|---|---|---|---|---|---|
| 100 GB/day | 150 | 300 | about 13 | about 1.5 | about 465 |
| 500 GB/day | 750 | 1,500 | about 65 | about 7.5 | about 2,323 |
| 1,000 GB/day | 1,500 | 3,000 | about 130 | about 15 | about 4,645 |
Editorial calculation: ingestion = daily x 30 x 0.05; processing = daily x 30 x 0.10 (assumes all data processed; zero if not processed); storage = daily x 30 / 6 x 0.026 (30-day retention, 6:1 compression); query = daily x 30 x 10% x 0.005 (assumes 10% of raw data scanned monthly). Excludes Advanced Data Insights, notebook/graph, tax and discounts; the invoice governs.
How to tier logs: primary to analytics, secondary to the lake
Microsoft's guidance is clear: primary security data (authentication, EDR/antivirus, cloud audit, threat intelligence, external alerts) belongs in the analytics tier for near-real-time detection, alerting and interactive hunting; secondary security data (network, firewall, proxy, NetFlow, TLS/SSL certificate and IoT logs) belongs in the data lake for long-term retention, forensics and historical analysis. Basic Logs suits low-cost, low-query-frequency logs. Separating "data that must alert in real time" from "data you only query during an incident" is the most effective cost control, more fundamental than switching commitment tiers.
| Log type | Examples | Suggested tier | Why |
|---|---|---|---|
| Primary security data | Authentication, EDR, cloud audit, threat intelligence, alerts | Analytics | Needs near-real-time detection, alerting and frequent queries |
| High-volume secondary data | Firewall, proxy, NetFlow, TLS/SSL, IoT | Data lake | Low value density, high volume, mainly forensic/historical |
| Low-query logs | Compliance archive, debug logs, non-critical app logs | Basic Logs / data lake | Rarely queried; prioritise storage cost |
| Dual-retention data | Primary data needing both real-time detection and long retention | Analytics + data lake | Query in analytics during retention, then keep long-term in the lake |
Sources: Microsoft Learn log-retention documentation and Microsoft Sentinel pricing FAQ (accessed 7 November 2026). Specific table names, retention settings and dual-retention billing follow official documentation and the Azure invoice; confirm detection-rule dependencies before tiering.
Cost-control checklist: what the bill hides
Beyond the ingestion rate, a SIEM bill is amplified by retention beyond 90 days, multiple workspaces each with their own commitment, data lake processing/query, notebook/graph compute, the SAP solution, MCP/security compute units and "collected but never queried" logs. The most effective action is usually to cut low-value log sources first, then discuss commitment tiers; a commitment only lowers the unit price, it does not reduce the total you pay for useless data.
| Cost item | Trigger | Control |
|---|---|---|
| Retention beyond 90 days | Analytics interactive retention over 90 days | Set retention by data type; move long-term data to the lake |
| Multiple workspaces | Commitments cannot be shared across workspaces | Consolidate where possible; size each commitment separately |
| Data processing | Redaction/splitting/normalisation in the lake | Enable only for tables that need it; assess the benefit first |
| Query scan volume | KQL queries/jobs scanning large volumes in the lake | Narrow time ranges/columns; use summary tables instead of full scans |
| Notebook/graph | Advanced Data Insights, custom graphs | Budget compute hours by project; avoid idle sessions |
| SAP/MCP and similar | SAP solution, MCP tools, SCUs | Budget separately; monitor actual calls |
| Low-value logs | Collected but not used for detection/investigation | Stop collecting/filter first, then consider a commitment |
Sources: Microsoft Learn billing documentation and the Microsoft Sentinel pricing page (accessed 7 November 2026); this is an editorial cost-control checklist, not an official commitment. Specific meters and free allowances follow the official page and invoice.
FAQ
Is Sentinel billed per GB or per day?
Both. Analytics pay-as-you-go is USD 4.30/GB; commitment tiers charge a fixed daily fee for a reserved number of GB per day (for example, 100 GB/day at USD 296/day), with overage billed at that tier's discounted rate. The data lake charges separately for ingestion GB, processing GB, storage GB-month and query-scanned GB.
How do I choose a commitment tier, and what happens to overage?
Compare one or two months of actual average daily usage (not peak) with each tier's effective price. Commitment tiers start at 100 GB/day, can be upgraded at any time, and require at least 31 days before downgrade/exit; overage is billed at the tier's discounted rate. If usage stays well below the reservation, the fixed daily fee costs more.
Is the data lake tier almost free?
No. Data lake ingestion is USD 0.05/GB, processing USD 0.10/GB, storage USD 0.026/GB-month (6:1 compression) and query USD 0.005/GB scanned. It is much cheaper than analytics, but lacks real-time detection/alerting; it suits long-term retention of secondary logs, not replacing the primary SIEM.
What does 100 GB/day cost?
Analytics pay-as-you-go is about USD 12,900/month; the 100 GB/day commitment is about USD 8,880/month (about 31% saving). If the same 100 GB/day were placed entirely in the data lake, with 100% processing, 30-day retention and 10% queried, the estimate is about USD 465/month - but it cannot provide real-time alerting.
Why does the data lake still charge for query and processing?
The lake separates storage from compute: storage is cheap, but queries are billed by uncompressed data scanned, and processing (redaction, splitting, filtering, normalisation) is billed per GB. This makes long-term retention cheap while charging for compute actually used.
Can a commitment tier be shared across workspaces?
No. Microsoft states that a commitment applies per workspace and cannot be grouped across workspaces or subscriptions. Size each workspace separately; before consolidating, check data residency, access control and detection-rule requirements.
When does the 50 GB commitment promotion end?
The official page says the 50 GB/day tier has been in public preview since 1 October 2025, with the promotion running to 31 December 2026; customers who buy during that period can lock the promotional price until 31 March 2027. Pricing varies by region and cannot be combined with other Sentinel discounts.
What free allowances exist?
The official page mentions up to 5 MB per user per day of free ingestion for key security logs; after enabling Sentinel, the first 10 GB/day of analytics is free for 31 days (subject to limits such as 20 workspaces per tenant); the data lake preview includes 30 days of free storage, and processing may also be free during preview. Check the official page and invoice for details.
Research method and limitations
This article separates "official price facts" from "editorial calculations": analytics USD 4.30/GB, Basic Logs USD 1.00/GB, data lake USD 0.05/0.10/0.026/0.005 and all commitment daily fees come from the Azure Retail Prices API (serviceName=Sentinel, eastus, Consumption, 7 November 2026); tiering rules, 90-day retention, 6:1 compression, per-workspace commitments and the 50 GB promotion come from the Microsoft Sentinel pricing page and Microsoft Learn billing/retention documentation. Monthly costs, TCO, savings percentages and tiering recommendations are editorial calculations.
Eight limitations: (1) only eastus retail prices are used, excluding other regions, enterprise/CSP discounts, tax and exchange rates; (2) monthly figures assume 30 days; (3) the data lake TCO assumes 100% processing, 30-day retention and 10% of raw data queried monthly; (4) notebook/graph, SAP, MCP/SCU and classic Log Analytics billing are not included; (5) no detection-rule or query-performance testing was performed, so tiering recommendations must be validated against your own sources; (6) prices and promotions change and should be re-queried after publication; (7) this is not procurement, commercial or legal advice; (8) other SIEM vendors are not covered, so it cannot support a claim that Sentinel is cheaper than any particular alternative.
Sources and basis
- Microsoft, Microsoft Sentinel pricing: azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/. Analytics/data lake tiers, 100-50,000 GB commitment tiers, up to 52% savings, 50 GB promotion, 5 MB/user/day free, 30 days of free data lake storage. Accessed 7 November 2026.
- Microsoft, Azure Retail Prices API (serviceName=Sentinel, armRegionName=eastus): prices.azure.com/api/retail/prices. Analytics USD 4.30/GB, Basic Logs USD 1.00, data lake ingestion 0.05, processing 0.10, storage 0.026, query 0.005, and all commitment daily fees. Accessed 7 November 2026.
- Microsoft Learn, Plan costs and understand Microsoft Sentinel billing: learn.microsoft.com/en-us/azure/sentinel/billing. Analytics pay-as-you-go/commitment, 90-day interactive retention, data lake ingestion/processing/storage/query, 6:1 compression, dual retention, free trial. Accessed 7 November 2026.
- Microsoft Learn, Log retention tiers in Microsoft Sentinel: learn.microsoft.com/en-us/azure/sentinel/log-plans. Primary vs secondary security data, 90-day default interactive retention in analytics (up to two years), data lake positioning. Accessed 7 November 2026.
Data cut-off 7 November 2026; prices and rules follow Microsoft official pages/APIs and the Azure invoice; not procurement, commercial or legal advice.