Microsoft Sentinel pricing is mainly a charge per gigabyte of data ingested. You pay either pay-as-you-go per GB or a fixed daily commitment tier, from 100 GB a day (with a 50 GB tier in public preview). On top of that come retention beyond 90 days, data lake meters, and separate Azure charges for playbooks and functions. At Microsoft's US list price for the East US region, read on 23 September 2026, pay-as-you-go analytics ingestion was $4.30 per GB.
This guide explains each meter using only Microsoft's own pages, then works through three example bills. Every price below comes from Microsoft's Azure Retail Prices API, which Microsoft describes as its retail prices "without discount". Your contract, region and currency will change the numbers. For a quote, use Microsoft's cost estimator; the public pricing page shows no figures without it.
The pricing model at a glance
| Meter | What you pay for | East US list price (USD, 23 Sep 2026) |
|---|---|---|
| Analytics tier, pay-as-you-go | Each GB ingested into analytics tables | $4.30 per GB |
| Analytics tier, commitment tier | A fixed daily volume, with overage at the same effective rate | $296 a day for 100 GB ($2.96 per GB) |
| Retention beyond 90 days | Analytics data kept past the free 90 days | $0.10 per GB per month (Log Analytics retention meter) |
| Data lake ingestion | Each GB sent to lake-only tables | $0.05 per GB |
| Data lake processing | Transformations on lake-only ingestion | $0.10 per GB |
| Data lake storage | Data kept in the lake, billed at 6:1 compression | $0.026 per GB per month |
| Data lake query | Each GB of uncompressed data scanned by KQL | $0.005 per GB |
| Playbooks (Logic Apps Consumption) | Each connector action a playbook runs | $0.000125 standard, $0.001 enterprise |
The non-USD figures the same API returns are, in Microsoft's words, "for your reference". For UK buyers, the UK South reference price in GBP on the same date was £3.961 per GB pay-as-you-go and £272.41 a day for the 100 GB tier.
How each part of the bill works
Analytics tier: pay-as-you-go or commitment
Microsoft's billing documentation (updated 1 April 2026) says pricing "is based on the tier that the data is ingested into". The analytics tier is where detection rules, alerts and incidents run. Pay-as-you-go is the default and bills each GB, measured as 10^9 bytes.
Commitment tiers trade flexibility for a lower rate. Microsoft's example: a 100 GB a day tier bills the committed 100 GB, "plus any extra GB/day at the discounted effective rate for that tier". The effective per-GB price is the tier price divided by its daily volume. You can raise a tier at any time, which restarts the 31-day period. You can only lower it, or return to pay-as-you-go, after that period ends.
Microsoft's pricing page says commitment tiers run "from 100 GB to 50,000 GB" and save "up to 52% over Pay-As-You-Go rates". It also lists a 50 GB tier "available in public preview, with promotional pricing starting October 1, 2025, until December 31, 2026". Customers who join in that window keep the promotional price until 31 March 2027.
Commitment tiers compared
We divided each tier's daily list price by its volume and compared it with the $4.30 pay-as-you-go rate. The break-even column is the daily volume above which the tier costs less than paying per GB.
| Tier (per day) | Daily price | Effective per GB | Saving against pay-as-you-go | Break-even daily volume |
|---|---|---|---|---|
| 50 GB (preview) | $161.25 | $3.225 | 25% | 38 GB |
| 100 GB | $296.00 | $2.960 | 31% | 69 GB |
| 200 GB | $548.00 | $2.740 | 36% | 127 GB |
| 300 GB | $800.00 | $2.667 | 38% | 186 GB |
| 500 GB | $1,265.00 | $2.530 | 41% | 294 GB |
| 1,000 GB | $2,480.00 | $2.480 | 42% | 577 GB |
| 5,000 GB | $11,550.00 | $2.310 | 46% | 2,686 GB |
| 50,000 GB | $102,600.00 | $2.052 | 52% | 23,860 GB |
Source: Azure Retail Prices API, East US, USD, simplified pricing meters, read 23 September 2026. Tiers of 400, 2,000, 10,000 and 25,000 GB also exist.
The 52% saving at 50,000 GB matches Microsoft's "up to 52%" claim, which is a useful check that the API and the marketing page agree.
Data lake tier
The data lake is Microsoft's lower-cost store for secondary data and long retention, "for up to 12 years". The billing page lists five meters:
- Ingestion per GB, for tables set to the lake tier only.
- Processing per GB, for the same lake-only data. It covers "redaction, splitting, filtering, and normalization".
- Storage per GB per month, "based on a simple and uniform data compression rate of 6:1". Microsoft's example: 600 GB of raw data is billed as 100 GB.
- Query per GB of uncompressed data scanned by KQL queries or jobs.
- Advanced data insights per compute hour for notebooks ($0.15 an hour in East US).
Ingestion and processing charges do not apply to tables that keep data in both the analytics and lake tiers. Those pay the analytics rate instead.
Free data and free allowances
Three things reduce the billable volume:
- Free trial. The first 10 GB a day on the analytics tier is free for 31 days, up to 20 workspaces per tenant. Automation and data lake charges still apply during the trial.
- Always-free sources. Azure Activity logs, Sentinel health data, Office 365 audit logs (SharePoint, Exchange admin and Teams) and security alerts from Microsoft Defender products are free. Microsoft notes that the raw logs behind several Defender and Entra ID products are paid, even though their alerts are free.
- Microsoft 365 E5 benefit. Microsoft's offer page gives Microsoft 365 E7, E5, A5, F5 and G5 customers "up to 5 MB per user per day" of eligible data. That covers Entra ID sign-in and audit logs, Defender for Cloud Apps shadow IT discovery logs, Purview Information Protection logs and Microsoft 365 advanced hunting data. A company with 2,000 E5 users therefore gets up to 10 GB a day of those sources free.
Retention
Analytics data is kept free for 90 days. After that, Microsoft charges at the standard Log Analytics retention price, or you can move older data to the lake under "total retention". The difference is large, as the worked example shows.
Charges outside the Sentinel line
Microsoft states that Sentinel is "only a portion of the monthly costs in your Azure bill". Playbooks run on Azure Logic Apps. Notebooks and machine learning use Azure Machine Learning. Some data connectors use Azure Functions. Each is billed on its own meter. Removing Sentinel also does not remove the Log Analytics workspace or its charges.
Worked example: three monthly bills
These scenarios use only East US list prices from the Azure Retail Prices API, read 23 September 2026, in USD. A month is 30 days. They exclude tax, discounts, Azure Functions, Logic Apps and free allowances.
| Scenario | Daily volume | Configuration | Daily cost | Monthly cost |
|---|---|---|---|---|
| A | 80 GB | Pay-as-you-go at $4.30 per GB | $344.00 | $10,320 |
| A | 80 GB | 50 GB preview tier ($161.25) plus 30 GB overage at $3.225 | $258.00 | $7,740 |
| B | 150 GB | Pay-as-you-go at $4.30 per GB | $645.00 | $19,350 |
| B | 150 GB | 100 GB tier ($296) plus 50 GB overage at $2.96 | $444.00 | $13,320 |
| C | 150 GB | 100 GB tier for detection data; 50 GB of secondary logs to lake only at $0.05 + $0.10 per GB | $303.50 | $9,105 plus lake storage |
Scenario C shows why the lake matters. Sending 50 GB a day of low-value logs to the lake cuts the ingest bill by about a third against scenario B. The trade-off is real: data in the lake-only tier does not drive real-time analytics rules. Microsoft positions it for "secondary security data that is not needed for real time threat detection".
Retention example. Suppose you keep 150 GB a day for one year instead of 90 days. At steady state that is 275 extra days, or 41,250 GB. In analytics retention at $0.10 per GB per month, that costs about $4,125 a month. In the lake, the same data is billed at 6:1 compression as 6,875 GB, at $0.026, or about $179 a month, plus query charges when you search it.
How to cut the bill
Microsoft's own cost reduction guide and billing page list these levers. In rough order of impact:
- Match the commitment tier to your volume. Check actual daily ingestion, then pick the tier whose break-even point you clear on most days. Review it at each 31-day window.
- Buy a pre-purchase plan. Microsoft sells Sentinel commit units for a one-year term; eligible analytics costs draw them down automatically.
- Keep non-security data out. Microsoft advises a separate workspace for operational data "to ensure it doesn't incur Microsoft Sentinel costs".
- Send secondary data to the lake. Firewall, proxy and verbose logs that you keep for hunting and audit rarely need analytics-tier pricing.
- Use total retention for old data. Let data age out of analytics retention into the lake rather than paying analytics retention.
- Filter at the source. Data collection rules on the Azure Monitor Agent let you ingest only the Windows security events you select. Microsoft also warns that CEF logs with many extra fields land in the AdditionalExtensions table and can raise volume.
- Enable only the paid data types you use. Connectors that mix free and paid types let you pick. Microsoft's example is keeping free Defender for Cloud Apps alerts while leaving paid shadow IT reports off.
- Pool workspaces in a dedicated cluster. If workspaces in one region ingest 100 GB a day or more together, a Log Analytics dedicated cluster can share one commitment tier.
- Claim the free allowances. Check the E5 benefit and always-free sources before you size a tier.
NIST's Guide to Computer Security Log Management (SP 800-92) makes the same point from the other side: decide what each log source is for and how long you must keep it before you collect it. A per-GB bill rewards that discipline. For more options that apply to any SIEM, see our SIEM price reduction tactics, and for the costs that sit outside the licence line, read the hidden costs of SIEM.
Alternatives to per-GB pricing
Every lever above manages volume. Some teams would rather not price security by volume at all, because a per-GB model gives you a reason to collect less. Our SIEM alternatives comparison sets out which platforms charge per GB and which do not.
Where SenseOn fits. SenseOn is priced as an annual pool of Flex Intelligence Credits, with no per-GB ingestion charge for the telemetry its Universal Sensor sends. Edge processing removes around 40% of data before the pipeline starts, and storage is priced on compressed data on disk rather than raw ingest. One lightweight agent captures endpoint, network and identity telemetry on Windows, macOS and Linux, and SenseOn deploys alongside your existing SIEM and EDR. If you already run Sentinel, our SenseOn vs Microsoft Sentinel comparison covers when each fits, and the pricing page shows the credit plans.
Sources
- Microsoft Learn, Plan costs and understand pricing and billing for Microsoft Sentinel, updated 1 April 2026, accessed 23 September 2026
- Microsoft Learn, Reduce costs for Microsoft Sentinel, updated 14 June 2025, accessed 23 September 2026
- Microsoft Learn, Microsoft Sentinel data lake overview, updated 11 August 2025, accessed 23 September 2026
- Microsoft, Microsoft Sentinel pricing, accessed 23 September 2026
- Microsoft, Microsoft 365 E5 benefit offer for Microsoft Sentinel, accessed 23 September 2026
- Microsoft Learn, Azure Retail Prices REST API overview, updated 6 August 2024, accessed 23 September 2026
- Microsoft, Azure Retail Prices API, Sentinel meters, East US, read 23 September 2026 (Sentinel, Log Analytics and Logic Apps meters; GBP reference prices from the same API with currencyCode GBP, region uksouth)
- Microsoft, Azure Logic Apps pricing, accessed 23 September 2026
- NIST, SP 800-92: Guide to Computer Security Log Management, September 2006, accessed 23 September 2026
How SenseOn writes, checks and corrects its content: editorial standards.
Frequently asked questions
How much does Microsoft Sentinel cost per GB?
At Microsoft's US list price for East US, read on 23 September 2026, pay-as-you-go analytics ingestion is $4.30 per GB. Commitment tiers lower the effective rate, from $2.96 per GB at 100 GB a day to $2.052 per GB at 50,000 GB a day. Your own price depends on region, currency and agreement, so confirm it in Microsoft's cost estimator.
Is there a free tier of Microsoft Sentinel?
There is no permanent free tier, but three things cost nothing. A new workspace gets up to 10 GB a day free for 31 days. Some data sources are always free, including Azure Activity logs, Office 365 audit logs and alerts from Microsoft Defender products. Microsoft 365 E5, A5, F5 and G5 customers get up to 5 MB per user per day of eligible Microsoft 365 data at no charge.
What is the Microsoft Sentinel data lake tier and how is it billed?
The data lake tier is a lower-cost store for secondary security data and long retention, up to 12 years. It has separate meters for ingestion, processing, storage and query. At the East US list price on 23 September 2026 these were $0.05 per GB ingested, $0.10 per GB processed, $0.026 per GB per month stored and $0.005 per GB scanned. Storage is billed on data compressed at a flat 6:1 ratio.
When should I move from pay-as-you-go to a commitment tier?
When your steady daily volume is above the break-even point. At East US list prices, the 100 GB a day tier costs less than pay-as-you-go once you ingest about 69 GB a day. You can raise a tier at any time, but you can only lower it or return to pay-as-you-go after the 31-day commitment period.
Do Sentinel playbooks cost extra?
Yes. Playbooks run on Azure Logic Apps, which is billed separately from Sentinel. On the Consumption plan each action is metered: the Azure Retail Prices API listed standard connector actions at $0.000125 and enterprise connector actions at $0.001 in East US on 23 September 2026. For most teams this is small next to ingestion, but a playbook that fires on every alert can add up.
