Microsoft Sentinel Pricing Explained: Tiers, Meters, Examples

Microsoft Sentinel pricing is mainly a charge per gigabyte of data ingested. You pay either pay-as-you-go per GB or a fixed daily commitment tier, from 100 GB a day (with a 50 GB tier in public preview). On top of that come retention beyond 90 days, data lake meters, and separate Azure charges for playbooks and functions. At Microsoft's US list price for the East US region, read on 23 September 2026, pay-as-you-go analytics ingestion was $4.30 per GB.

The short version

• Analytics tier: $4.30 per GB pay-as-you-go, or $2.96 per GB on the 100 GB-a-day commitment tier. It is the only tier with real-time detection and hunting.
• Data lake: about $0.15 per GB to bring data in ($0.05 ingestion plus $0.10 processing). It is cheap, but Microsoft says lake-only data "isn't available for real-time analytics features and threat hunting".
• The real decision is which sources you can afford to watch in real time. Noisy sources such as firewall, DNS and proxy logs are usually the ones pushed to the lake.
• To model your own bill, use the worked examples below or our SIEM cost calculator.

This guide explains each meter using only Microsoft's own pages, then works through three example bills. Every price below comes from Microsoft's Azure Retail Prices API, which Microsoft describes as its retail prices "without discount". Your contract, region and currency will change the numbers. For a quote, use Microsoft's cost estimator; the public pricing page shows no figures without it.

The pricing model at a glance

The non-USD figures the same API returns are, in Microsoft's words, "for your reference". For UK buyers, the UK South reference price in GBP on the same date was £3.961 per GB pay-as-you-go and £272.41 a day for the 100 GB tier.

How each part of the bill works

Analytics tier: pay-as-you-go or commitment

Microsoft's billing documentation (updated 1 April 2026) says pricing "is based on the tier that the data is ingested into". The analytics tier is where detection rules, alerts and incidents run. Pay-as-you-go is the default and bills each GB, measured as 10^9 bytes.

Commitment tiers trade flexibility for a lower rate. Microsoft's example: a 100 GB a day tier bills the committed 100 GB, "plus any extra GB/day at the discounted effective rate for that tier". The effective per-GB price is the tier price divided by its daily volume. You can raise a tier at any time, which restarts the 31-day period. You can only lower it, or return to pay-as-you-go, after that period ends.

Microsoft's pricing page says commitment tiers run "from 100 GB to 50,000 GB" and save "up to 52% over Pay-As-You-Go rates". It also lists a 50 GB tier "available in public preview, with promotional pricing starting October 1, 2025, until December 31, 2026". Customers who join in that window keep the promotional price until 31 March 2027.

Commitment tiers compared

We divided each tier's daily list price by its volume and compared it with the $4.30 pay-as-you-go rate. The break-even column is the daily volume above which the tier costs less than paying per GB.

Source: Azure Retail Prices API, East US, USD, simplified pricing meters, read 23 September 2026. Tiers of 400, 2,000, 10,000 and 25,000 GB also exist.

The 52% saving at 50,000 GB matches Microsoft's "up to 52%" claim, which is a useful check that the API and the marketing page agree.

Data lake tier

The data lake is Microsoft's lower-cost store for secondary data and long retention, "for up to 12 years". The billing page lists five meters:

• Ingestion per GB, for tables set to the lake tier only.
• Processing per GB, for the same lake-only data. It covers "redaction, splitting, filtering, and normalization".
• Storage per GB per month, "based on a simple and uniform data compression rate of 6:1". Microsoft's example: 600 GB of raw data is billed as 100 GB.
• Query per GB of uncompressed data scanned by KQL queries or jobs.
• Advanced data insights per compute hour for notebooks ($0.15 an hour in East US).

Ingestion and processing charges do not apply to tables that keep data in both the analytics and lake tiers. Those pay the analytics rate instead.

Free data and free allowances

Three things reduce the billable volume:

1. Free trial. The first 10 GB a day on the analytics tier is free for 31 days, up to 20 workspaces per tenant. Automation and data lake charges still apply during the trial.
2. Always-free sources. Azure Activity logs, Sentinel health data, Office 365 audit logs (SharePoint, Exchange admin and Teams) and security alerts from Microsoft Defender products are free. Microsoft notes that the raw logs behind several Defender and Entra ID products are paid, even though their alerts are free.
3. Microsoft 365 E5 benefit. Microsoft's offer page gives Microsoft 365 E7, E5, A5, F5 and G5 customers "up to 5 MB per user per day" of eligible data. That covers Entra ID sign-in and audit logs, Defender for Cloud Apps shadow IT discovery logs, Purview Information Protection logs and Microsoft 365 advanced hunting data. A company with 2,000 E5 users therefore gets up to 10 GB a day of those sources free.

Retention

Analytics data is kept free for 90 days. After that, Microsoft charges at the standard Log Analytics retention price, or you can move older data to the lake under "total retention". The difference is large, as the worked example shows.

Charges outside the Sentinel line

Microsoft states that Sentinel is "only a portion of the monthly costs in your Azure bill". Playbooks run on Azure Logic Apps. Notebooks and machine learning use Azure Machine Learning. Some data connectors use Azure Functions. Each is billed on its own meter. Removing Sentinel also does not remove the Log Analytics workspace or its charges.

Worked example: three monthly bills

These scenarios use only East US list prices from the Azure Retail Prices API, read 23 September 2026, in USD. A month is 30 days. They exclude tax, discounts, Azure Functions, Logic Apps and free allowances.

Scenario C shows why the lake matters. Sending 50 GB a day of low-value logs to the lake cuts the ingest bill by about a third against scenario B. The trade-off is real: data in the lake-only tier does not drive real-time analytics rules. Microsoft positions it for "secondary security data that is not needed for real time threat detection". The next section sets out what that costs you in detection.

Retention example. Suppose you keep 150 GB a day for one year instead of 90 days. At steady state that is 275 extra days, or 41,250 GB. In analytics retention at $0.10 per GB per month, that costs about $4,125 a month. In the lake, the same data is billed at 6:1 compression as 6,875 GB, at $0.026, or about $179 a month, plus query charges when you search it.

To run these numbers for your own daily volume and retention, use our SIEM cost calculator. It uses the same list prices and shows every assumption.

Why not just put everything in the data lake?

It is the obvious question after scenario C. Lake-only ingestion and processing cost about $0.15 per GB together, against $4.30 per GB on the analytics tier. Why not send most data to the lake?

Because Microsoft's own tier comparison says what you give up. These rows are quoted from Manage data tiers and retention in Microsoft Sentinel (updated 2 July 2026). The price row is ours, from the Azure Retail Prices API.

The same page is plain about the limit. "Data in the Data Lake tier isn't available for real-time analytics features and threat hunting." Moving an existing table is worse: "When you change a table's tier from Analytics to Data Lake, all real-time analytics and hunting queries stop working."

The trade-off in one picture: the lake is cheap, but detection on it needs a scheduled job and a promotion back into the analytics tier. East US list prices, 23 September 2026.

What detection on lake data involves

Lake data is not lost, and you can still look for threats in it, but only through jobs you build and maintain. Microsoft offers two routes. KQL jobs (updated 1 July 2026) are "one-time or scheduled KQL queries" over the lake that write their results to a table. Summary rules (updated 2 July 2026) aggregate data "in the background" into a custom table. Neither raises an alert by itself. In Microsoft's own threat intelligence example, summary rule results land in a table that is "in the analytic tier and are charged accordingly", and you then create "an analytics rule in Microsoft Sentinel that alerts based on results" from that table.

Microsoft's pages set the limits:

• Freshness. New lake data has "a typical latency of up to 15 minutes before the data is available for querying".
• Start delay. A scheduled job's "start time must be at least 30 minutes after job creation or editing".
• Scale. Per tenant, 5 jobs can run at once and 100 can be enabled. A job over the concurrency limit "is rejected and not queued".
• Timeout. Each job query has a 1-hour execution timeout. Microsoft warns: "Partial results might be promoted if the job's query exceeds the one hour limit."
• Cost. Promoted data is billed at analytics-tier rates, which Microsoft notes are higher than the lake's, and each run pays the lake query meter of $0.005 per GB scanned.

So Sentinel asks you to decide, table by table, which data gets real-time detection, and to build jobs for the rest. The tables that go to the lake are the high-volume ones, because that is where the saving is: firewall, DNS, proxy and network flow logs. That is also where an intruder's movement shows. MITRE ATT&CK describes lateral movement as techniques "to enter and control remote systems on a network", and says of command and control that "adversaries commonly attempt to mimic normal, expected traffic to avoid detection". Our judgement: a lake-only network table saves money on exactly the records you would need to see that traffic as it happens.

How SenseOn handles the same choice

SenseOn's detection and hunting are not tied to one storage tier: you choose, per log source, which data goes to Detection & Response. It detects at three speeds: in real time on the endpoint (the Universal Sensor), in near real time across every log source you route to Detection & Response, as it streams through SenseOn's message queue, and with behavioural analytics that run about every five minutes across those same sources. Humans and AI agents can search and hunt across the Observability and Compliance pipelines, for as long as you keep your data, with no restore step. So you get data-lake storage economics (compressed storage) with detection as your routed data arrives, and search, hunting, posture management and dashboards over the data you keep.

The difference comes from who the tiers are designed for. Sentinel's tiering is designed around a person running an interactive query, so older lake data needs a job and a promotion before it can raise an alert. SenseOn is built for agents, not only for analysts at a console. Its long-running AI agents do the long-horizon queries and hunts in the background, so a query over older, colder data can take a little longer without anyone waiting on it. Data rolls from one tier to the next automatically, and you choose, per source, which pipeline it goes to: Detection & Response for detection, or Observability and Compliance for search and hunting.

Sentinel rows: the Microsoft Learn pages cited above and the Azure Retail Prices API, East US, 23 September 2026. SenseOn rows: SenseOn product pages.

How to cut the bill

Microsoft's own cost reduction guide and billing page list these levers. In rough order of impact:

1. Match the commitment tier to your volume. Check actual daily ingestion, then pick the tier whose break-even point you clear on most days. Review it at each 31-day window.
2. Buy a pre-purchase plan. Microsoft sells Sentinel commit units for a one-year term; eligible analytics costs draw them down automatically.
3. Keep non-security data out. Microsoft advises a separate workspace for operational data "to ensure it doesn't incur Microsoft Sentinel costs".
4. Send secondary data to the lake. Verbose logs you keep only for audit and forensics rarely need analytics-tier pricing. Before you move firewall, DNS or proxy logs, read the section above: lake-only data loses real-time analytics and hunting.
5. Use total retention for old data. Let data age out of analytics retention into the lake rather than paying analytics retention.
6. Filter at the source. Data collection rules on the Azure Monitor Agent let you ingest only the Windows security events you select. Microsoft also warns that CEF logs with many extra fields land in the AdditionalExtensions table and can raise volume.
7. Enable only the paid data types you use. Connectors that mix free and paid types let you pick. Microsoft's example is keeping free Defender for Cloud Apps alerts while leaving paid shadow IT reports off.
8. Pool workspaces in a dedicated cluster. If workspaces in one region ingest 100 GB a day or more together, a Log Analytics dedicated cluster can share one commitment tier.
9. Claim the free allowances. Check the E5 benefit and always-free sources before you size a tier.

NIST's Guide to Computer Security Log Management (SP 800-92) makes the same point from the other side: decide what each log source is for and how long you must keep it before you collect it. A per-GB bill rewards that discipline. For more options that apply to any SIEM, see our SIEM price reduction tactics, and for the costs that sit outside the licence line, read the hidden costs of SIEM.

Alternatives to per-GB pricing

Every lever above manages volume. Some teams would rather price security on outcomes, because a bill driven only by volume gives you a reason to collect less. Our SIEM alternatives comparison sets out how each platform charges for data.

Where SenseOn fits. If you are sizing a Sentinel commitment tier, or deciding which tables to push to the lake, the question SenseOn answers is different: how do you keep detection on the log sources you route to Detection & Response, and let people and AI agents search older data for as long as you keep it, with no restore step? SenseOn is priced as an annual pool of Flex Intelligence Credits. You pay for outcomes: detection and response across your data, analytics included, and the investigations its AI completes. Data volume is one meter, not the whole bill. Three levers bring the cost down: edge processing removes unnecessary data before the pipeline, Weave (SenseOn's security engineering agent) routes data down three pipelines with storage separated from compute, and ClickHouse compression means storage is priced on the compressed volume. Together they cut costs by about 40% against a traditional SIEM, and the price also covers the AI agents that investigate and resolve cases. One lightweight Universal Sensor captures endpoint, network and identity telemetry on Windows, macOS and Linux (Linux network telemetry needs kernel 5.2 or later with eBPF; older kernels give process telemetry, and a network probe covers segments where no agent can run). Out-of-the-box integrations bring in Microsoft 365, AWS and identity provider signals. SenseOn deploys alongside your existing SIEM and EDR, so you can run it next to Sentinel for a 14 to 28 day proof window and compare on your own data before you change anything. Our SenseOn vs Microsoft Sentinel comparison covers when each fits, and the pricing page shows the credit plans.

Sources

• Microsoft Learn, Plan costs and understand pricing and billing for Microsoft Sentinel, updated 1 April 2026, accessed 23 September 2026
• Microsoft Learn, Reduce costs for Microsoft Sentinel, updated 14 June 2025, accessed 23 September 2026
• Microsoft Learn, Manage data tiers and retention in Microsoft Sentinel, updated 2 July 2026, accessed 23 September 2026
• Microsoft Learn, Create jobs in the Microsoft Sentinel data lake, updated 1 July 2026, accessed 23 September 2026
• Microsoft Learn, Aggregate Microsoft Sentinel data with summary rules, updated 2 July 2026, accessed 23 September 2026
• MITRE, ATT&CK Lateral Movement, TA0008 and Command and Control, TA0011, accessed 23 September 2026
• Microsoft Learn, Microsoft Sentinel data lake overview, updated 11 August 2025, accessed 23 September 2026
• Microsoft, Microsoft Sentinel pricing, accessed 23 September 2026
• Microsoft, Microsoft 365 E5 benefit offer for Microsoft Sentinel, accessed 23 September 2026
• Microsoft Learn, Azure Retail Prices REST API overview, updated 6 August 2024, accessed 23 September 2026
• Microsoft, Azure Retail Prices API, Sentinel meters, East US, read 23 September 2026 (Sentinel, Log Analytics and Logic Apps meters; GBP reference prices from the same API with currencyCode GBP, region uksouth)
• Microsoft, Azure Logic Apps pricing, accessed 23 September 2026
• NIST, SP 800-92: Guide to Computer Security Log Management, September 2006, accessed 23 September 2026

How SenseOn writes, checks and corrects its content: editorial standards.

Frequently asked questions

How much does Microsoft Sentinel cost per GB?

At Microsoft's US list price for East US, read on 23 September 2026, pay-as-you-go analytics ingestion is $4.30 per GB. Commitment tiers lower the effective rate, from $2.96 per GB at 100 GB a day to $2.052 per GB at 50,000 GB a day. Your own price depends on region, currency and agreement, so confirm it in Microsoft's cost estimator.

Is there a free tier of Microsoft Sentinel?

There is no permanent free tier, but three things cost nothing. A new workspace gets up to 10 GB a day free for 31 days. Some data sources are always free, including Azure Activity logs, Office 365 audit logs and alerts from Microsoft Defender products. Microsoft 365 E5, A5, F5 and G5 customers get up to 5 MB per user per day of eligible Microsoft 365 data at no charge.

What is the Microsoft Sentinel data lake tier and how is it billed?

The data lake tier is a lower-cost store for secondary security data and long retention, up to 12 years. It has separate meters for ingestion, processing, storage and query. At the East US list price on 23 September 2026 these were $0.05 per GB ingested, $0.10 per GB processed, $0.026 per GB per month stored and $0.005 per GB scanned. Storage is billed on data compressed at a flat 6:1 ratio.

Why not send all Microsoft Sentinel data to the data lake tier?

Because lake-only data loses real-time detection and hunting. Microsoft's tier comparison says data in the data lake tier "isn't available for real-time analytics features and threat hunting", and that when you move a table from analytics to the lake, "all real-time analytics and hunting queries stop working". You can still detect on lake data, but only through scheduled KQL jobs or summary rules you build. New lake data typically takes up to 15 minutes to become queryable, a job must start at least 30 minutes after you create it, a tenant can run 5 jobs at once with 100 enabled, and each job query times out after an hour. To raise an alert, results are promoted to an analytics-tier table, billed at analytics rates, where an analytics rule runs; each run also pays $0.005 per GB scanned. The sources teams move to the lake, such as firewall, DNS and proxy logs, are often where lateral movement and command-and-control show. SenseOn takes a different approach: behavioural analytics run about every five minutes on the sources you route to Detection & Response, and humans and its AI agents can search and hunt the Observability and Compliance pipelines for as long as you keep the data, with no restore step.

When should I move from pay-as-you-go to a commitment tier?

When your steady daily volume is above the break-even point. At East US list prices, the 100 GB a day tier costs less than pay-as-you-go once you ingest about 69 GB a day. You can raise a tier at any time, but you can only lower it or return to pay-as-you-go after the 31-day commitment period.

Do Sentinel playbooks cost extra?

Yes. Playbooks run on Azure Logic Apps, which is billed separately from Sentinel. On the Consumption plan each action is metered: the Azure Retail Prices API listed standard connector actions at $0.000125 and enterprise connector actions at $0.001 in East US on 23 September 2026. For most teams this is small next to ingestion, but a playbook that fires on every alert can add up.