Key takeaways
- Microsoft Sentinel costs $4.30 per GB on pay-as-you-go in the East US region, and prices vary by region.
- Commitment tiers start at 100 GB a day for $296, which brings the effective price down to $2.96 per GB and lower on larger tiers.
- The 100 GB tier becomes cheaper than pay-as-you-go once you ingest about 69 GB a day.
- Several Microsoft sources are free to ingest, including Azure Activity logs, Office 365 audit logs and Microsoft Defender alerts.
- The biggest saving comes from filtering low-value data before it reaches Sentinel, not from negotiating the price per GB.
Microsoft Sentinel is billed on the security data it takes in and stores, not on the number of users or devices you protect. This guide breaks down Microsoft’s list prices, shows which pricing tier suits which daily data volume, explains what you can ingest for free, and works through real monthly bills. For a wider introduction to the platform, start with our Microsoft Sentinel SIEM guide.
How much does Microsoft Sentinel cost?
Microsoft Sentinel costs $4.30 per GB of data ingested on pay-as-you-go in the East US region. The alternative is a commitment tier: a fixed daily price starting at $296 for 100 GB a day, which works out to about $2.96 per GB. Prices vary by region and currency, so check Microsoft’s Sentinel pricing page for your own region.
Pay-as-you-go. You pay only for what you ingest each day, with no commitment. This suits businesses with low or unpredictable data volumes, and anyone still working out how much data their sources produce.
Commitment tiers. You commit to a set amount of data each day and pay a fixed daily price, whether or not you use all of it. In return, the price per GB drops as the tier gets bigger. Tiers run from 100 GB up to 50,000 GB a day.
Microsoft Sentinel commitment tiers (East US list prices)
Source: Microsoft Sentinel pricing, East US, checked on 31 October 2026. The last column shows the daily volume at which the tier’s fixed price matches the same volume on pay-as-you-go.
The 50 GB tier is a promotion for smaller customers. Microsoft accepts sign-ups until 31 December 2026 and holds the price until 31 March 2027, according to its Sentinel pricing page.
These prices cover the analytics tier, where data is used for detection and investigation. Long-term storage, automation and AI tools are billed separately, and the next section covers them. To see how this per-GB model compares with another major SIEM, read our comparison of Microsoft Sentinel and Splunk.
What does Microsoft Sentinel charge for?
Microsoft Sentinel charges for data ingested into the analytics tier, for keeping that data longer than 90 days, and for the data lake tier. The automation and AI services you add on top are billed on top of that. Ingestion is usually the largest part of the bill, but the other items add up as your setup grows.
Microsoft Sentinel cost components (East US list prices)
Sources: Microsoft Sentinel pricing and Microsoft Learn: Sentinel billing, checked on 31 October 2026.
Analytics tier or data lake?
The analytics tier is where Sentinel runs detection rules, investigations and hunting, so it holds the data you need to act on quickly. Examples are identity sign-ins, endpoint alerts and email security events.
The Sentinel data lake is a much cheaper place for high-volume logs that you must keep but rarely search, such as firewall and proxy traffic. It costs a fraction of analytics ingestion. The trade-off is that some features, including analytics rules and playbooks, don’t run directly on data held only in the lake.
Costs that sit outside Sentinel
Playbooks run on Azure Logic Apps, and some data connectors run on Azure Functions. Both appear on your Azure bill as separate services. Security Copilot is billed through its own capacity units, whether or not you use it with Sentinel. Count all three when you estimate what Sentinel will cost you in practice. To see what playbooks actually automate, read our guide to SIEM vs SOAR.
Is Microsoft Sentinel free?
Microsoft Sentinel is not free, but several data sources cost nothing to ingest, and new workspaces get a free trial of 10 GB a day for 31 days. Many Microsoft 365 customers also get extra Microsoft data free each day through their licence.
Free to ingest
- Azure Activity logs
- Office 365 audit logs, covering SharePoint activity, Exchange admin activity and Teams
- Microsoft Sentinel health data
- Security alerts from Microsoft Defender products
Paid
- Raw Microsoft Defender data, such as device and email event logs
- Microsoft Entra ID sign-in and audit logs, unless covered by the E5 benefit below
- Firewall, network and other non-Microsoft logs
- Any data kept in the analytics tier beyond 90 days
Source: Microsoft Learn: Sentinel billing, checked on 31 October 2026.
The difference between alerts and raw logs is the detail most people miss. A Defender alert costs nothing to bring into Sentinel. The underlying event data behind it is billed like any other source. For how Defender alerts and Sentinel fit together, read Microsoft Sentinel vs Defender XDR.
The free trial
New Sentinel workspaces can ingest up to 10 GB a day free for the first 31 days, with up to 20 trial workspaces per Azure tenant. Use the trial to measure how much data your sources really produce before you pick a pricing tier.
The Microsoft 365 E5 data benefit
Microsoft Sentinel is not included in Microsoft 365 E5 and is billed separately. However, Microsoft 365 E5, E7, A5, F5 and G5 customers get up to 5 MB per user per day of Microsoft 365 data ingested free. That covers Entra ID sign-in and audit logs, Defender for Cloud Apps shadow IT discovery logs, Purview Information Protection logs and Microsoft 365 advanced hunting data. For a 200-person company, that is about 1 GB a day. The benefit needs an Enterprise Agreement, Enterprise Agreement Subscription or Cloud Solution Provider agreement, and it applies automatically.
Book a call with CyberQuell to have your Microsoft Sentinel data sources and costs reviewed by analysts who run Sentinel around the clock.
Pay-as-you-go or commitment tier: which is cheaper?
A commitment tier becomes cheaper than pay-as-you-go once your daily ingestion stays above the tier’s break-even point. For the 100 GB tier at East US prices, that’s about 69 GB a day. Below that, pay-as-you-go costs less, because a commitment tier charges its full daily price even on days you ingest less.
How to find your break-even point
Divide the tier’s daily price by the pay-as-you-go rate. For the 100 GB tier, that’s $296 ÷ $4.30 = about 69 GB a day. If your average daily ingestion is above that number, the tier saves you money.
Three worked examples (East US list prices)
Prices checked on 31 October 2026. The 50 GB promotional tier is open to sign-ups until 31 December 2026.
What happens when you go over your tier
You don’t pay pay-as-you-go rates on the extra data. According to Microsoft’s billing guide, usage above your commitment tier is billed at that tier’s effective per-GB rate, shown as a separate line on your Azure bill. That’s why, in the 130 GB example, the 100 GB tier still beats a jump to the 200 GB tier ($548 a day).
The rules to plan around
- The 31-day lock. You can raise your tier at any time, but you can only lower it, or move back to pay-as-you-go, 31 days after your last change. Raising the tier restarts that 31-day period.
- One workspace at a time. Commitment tiers apply to a single workspace and can’t be pooled across workspaces or subscriptions.
- Pre-purchase for a further discount. Microsoft also sells Sentinel commit units for a one-year term, which are drawn down automatically as you use Sentinel.
The safest approach
Start on pay-as-you-go, track your daily ingestion for at least a month with the Workspace Usage Report workbook, then move to the tier that matches your steady volume. Moving too early locks you into a daily charge for data you may not produce.
What would Microsoft Sentinel cost a mid-sized business?
At East US list prices, a business ingesting 20 GB a day on pay-as-you-go pays about $2,580 a month for Microsoft Sentinel analytics ingestion. That’s before free data sources and any Microsoft 365 E5 benefit are taken off. The real figure depends almost entirely on how much data your sources send each day.
Illustrative monthly bills (30 days, analytics ingestion only, East US)
Calculated from Microsoft’s East US list prices, checked on 31 October 2026. These are worked calculations, not quotes. Retention beyond 90 days, the data lake, playbooks and Security Copilot are extra.
What decides your daily volume
The number of employees matters less than which sources you connect and how much detail each one sends. The sources that usually add the most data are:
- Microsoft Entra ID sign-in logs: every sign-in by every user and app
- Endpoint telemetry: raw device events from Microsoft Defender for Endpoint
- Firewall and network logs: often the single largest source, and the best candidate for the cheaper data lake
- Windows security events: high volume when collected at the “All events” level
Free sources, such as Office 365 audit logs and Defender alerts, don’t count towards these numbers.
How the E5 benefit changes the bill
Microsoft 365 E5 customers get up to 5 MB per user per day of eligible Microsoft 365 data free. For 200 users, that’s about 1 GB a day, or roughly $129 a month at the pay-as-you-go rate, taken off before billing starts.
Estimate your own bill
Microsoft’s Sentinel cost estimator works out a monthly figure from the sources and volumes you enter. The more accurate route is the free trial: connect your real sources, measure a month of ingestion, then plug that figure into the tables above.
Ingestion is only part of the cost of running Sentinel. The people who watch it are usually the bigger line, as we explain in the true cost of running an internal SOC.
What makes Microsoft Sentinel bills grow?
Microsoft Sentinel bills grow when more data is ingested than your detections actually need. This usually comes from a new connector set to collect everything, a spike in log volume during an incident, or data kept in the analytics tier for longer than necessary. Most cost surprises trace back to one of the five causes below.
1. Verbose connectors
Some connectors collect far more than security needs by default. Windows security events at the “All events” level and firewall traffic logs are the most common examples. Microsoft offers a “Common” event set for Windows that keeps the events used for detection and drops much of the rest.
2. Spikes during incidents and changes
A malware outbreak, a misconfigured device or a new application can multiply log volume overnight. On pay-as-you-go, that spike is billed in full. On a commitment tier, anything above the tier is billed at the tier rate, so a sustained spike still costs money.
3. Retention longer than needed
The first 90 days in the analytics tier are free. Beyond that, every GB is charged each month. Logs kept only for audit or compliance are usually cheaper in the Sentinel data lake.
4. Connectors nobody uses
Data sources switched on during a trial or a past project often keep sending logs that no rule or analyst ever looks at. They add cost without adding protection.
5. Duplicate data
The same logs can arrive twice, for example when a source sends to two workspaces, or when raw logs are ingested alongside the alerts already created from them.
How to spot it early
Microsoft’s Workspace Usage Report workbook shows which tables and sources drive your ingestion and how that changes day by day. A monthly review catches most of these problems before they show up on the invoice. You can also set an Azure cost alert that emails you when spending passes a set amount.
How to reduce Microsoft Sentinel costs
The biggest saving comes from filtering low-value data before it’s ingested, using data collection rules. After that, move logs you rarely search to the data lake tier and match your commitment tier to your steady volume. Microsoft’s guide to reducing Sentinel costs recommends the same order: cut what comes in before you negotiate what it costs.
1. Connect the free sources first
Start with Azure Activity logs, Office 365 audit logs and Microsoft Defender alerts, which cost nothing to ingest. Add paid sources one at a time, so you can see what each one adds to the bill.
2. Filter data before it’s ingested
Data collection rule transformations let you drop events or columns before they reach Sentinel, so you never pay for them. For example, keep denied connections from a firewall but drop routine allowed traffic, or drop unused fields from verbose logs.
3. Send rarely searched logs to the data lake
Firewall, proxy and DNS logs are often needed for investigations and audits but rarely searched day to day. In the Sentinel data lake, they cost $0.05 per GB to ingest instead of $4.30.
4. Move to the right commitment tier
Once a month of data shows your steady daily volume, move to the tier whose break-even point sits below it. Revisit the choice after big changes, such as adding a new office or a new major data source.
5. Pre-purchase commit units
If you expect to use Sentinel for at least a year, Sentinel commit units bought upfront give a further discount and are drawn down automatically.
6. Keep non-security data in a separate workspace
Performance and application logs that only your IT team uses don’t need Sentinel’s security analytics. Keeping them in a separate Log Analytics workspace stops them from being billed at Sentinel rates.
7. Consider a dedicated cluster at high volume
At 100 GB a day or more across several workspaces, an Azure Monitor dedicated cluster can combine their volume under one commitment tier.
8. Review spend every month
The Workspace Usage Report workbook shows which sources drive your ingestion. A monthly review, together with an Azure cost alert, catches growth before it becomes a surprise.
What to avoid
Don’t cut costs by switching off the sources your detections depend on, such as identity sign-ins or endpoint alerts. A cheaper Sentinel that can’t see an attack costs more in the end.
Does a managed Sentinel service change what you pay Microsoft?
No. With a managed Microsoft Sentinel service, Microsoft still bills Sentinel ingestion to your own Azure subscription. The provider charges separately for monitoring, investigation and response. What changes is who keeps that Microsoft bill under control.
What you pay, and to whom
Why the provider’s pricing model matters
Some providers charge by data volume, so their fee rises every time your log volume does. CyberQuell prices its managed Microsoft Sentinel service on the number of devices monitored, not on log volume. It’s a fixed monthly fee with no setup fees, so adding a data source doesn’t change what you pay CyberQuell.
How a managed service keeps the Microsoft bill in check
The analysts who watch your incidents also see which sources are noisy and which detections actually use them. They tune connectors, apply data collection rules and move rarely searched logs to the data lake as part of the day-to-day work, rather than waiting for a cost review.
Your data stays yours
With CyberQuell, the Sentinel workspace stays in your own Azure tenant and is accessed through Azure Lighthouse, which you can review and revoke at any time. Your logs, rules and Microsoft billing remain in your name throughout.
For a full breakdown of what a managed SIEM includes and how providers price it, read what SIEM as a service includes and what it costs.
Final thoughts
Microsoft Sentinel pricing comes down to one number: how much data you send in each day. At $4.30 per GB on pay-as-you-go, or $2.96 per GB on the 100 GB tier, the price per GB matters far less than the volume you multiply it by. Free sources, the E5 data benefit and the data lake can all take a real share off the bill before you ever think about tiers.
The order of work is simple. Connect the free sources, filter what you don’t need, move rarely searched logs to the data lake, then pick the tier that fits your steady volume. Repeat the check every month, because data volumes change as your business does. If you’re still deciding whether Sentinel is the right SIEM at all, our guide to what Microsoft Sentinel is and how it works covers what it does and what it takes to run.
Book a call with CyberQuell to get Microsoft Sentinel monitored 24/7 for a fixed monthly fee based on your devices, not your log volume, with a 15-minute response SLA on critical and high-severity alerts.
.png)
