Microsoft Sentinel is priced on the data you ingest, not on seats. Commitment tiers, free Defender data, and cheaper log tiers decide the bill. Ingestion discipline is the whole game.
Microsoft Sentinel is priced by data ingestion, not by seats. Commitment tiers, free Microsoft Defender data, and cheaper log tiers decide the bill. Ingestion discipline, not feature choice, is what controls Sentinel cost.
Sentinel is priced on the volume of data you ingest and analyze, billed per gigabyte, with no per seat license.
The bill has two parts. A Sentinel analysis charge sits on top of the underlying Log Analytics workspace ingestion cost. Microsoft sets both on its Sentinel pricing page.
Ingestion volume is the only variable that moves the number materially. Feature choice, connector count, and analytics rules carry no license fee. What you route into the workspace does.
The buyer side implication is blunt. Because the meter reads volume, cost control is an architecture problem, not a procurement discount. A good unit rate cannot rescue an estate that ingests everything into the analytics tier.
Pay as you go bills every gigabyte at the standard rate with no reservation. Commitment tiers reserve a daily volume at a lower effective rate. Microsoft documents the mechanics in its billing guide.
The first 90 days of retention on ingested data carry no charge. Retention past 90 days bills at standard Log Analytics rates, so long tail storage is a separate lever from ingestion.
Classic workspaces still show two line items, a Log Analytics charge and a Sentinel charge. The simplified pricing tier collapses these into one meter, covered next.
The simplified pricing tier bills Sentinel and Log Analytics on one combined per gigabyte meter instead of two separate line items.
Microsoft introduced simplified pricing so a single commitment covers both the ingestion cost and the Sentinel analysis cost. Classic billing kept them apart, with Sentinel charges prefixed Classic since July 1, 2023.
Under the simplified tier, a commitment applies to the whole combined meter. On dedicated clusters, Sentinel usage bills at the cluster rate and counts toward one shared allocation. Microsoft explains enrollment in its simplified pricing documentation.
The switch can lower cost when a pre purchase plan now covers both meters, or when old separate tiers were mismatched. It is a billing model change, not a discount. Model both before enrolling.
A 50 GB per day commitment tier entered public preview on October 1, 2025, with promotional pricing running through December 31, 2026. It gives smaller estates a committed rate below the former 100 GB floor.
The buyer side implication is that mid size operations that could not fill 100 GB per day now have a committed option. Confirm the promotional window and the rate after it before you plan around this tier.
Commitment tiers reserve a fixed daily ingestion volume for a lower effective per gigabyte rate, and the higher the commitment, the deeper the discount.
Microsoft offers commitment tiers from 100 GB per day up to 50,000 GB per day, plus the new 50 GB preview tier. Bands step through 100, 200, 300, 400, 500, 1,000, 2,000, and 5,000 GB per day and higher.
Sentinel pricing options at a glance
| Option | How it bills | Best for | Watch out for |
|---|---|---|---|
| Pay as you go | Per gigabyte ingested | Low or variable volume | Highest unit rate |
| Commitment tier | Reserved daily volume | Steady predictable volume | Over committing to peak |
| Basic and auxiliary logs | Reduced per gigabyte | High volume low value logs | Limited query features |
| Data lake | Low cost retention | Long term storage | Separate query model |
A commitment bills the reserved volume whether or not you use it. Overshoot and the excess falls back to pay as you go at the tier rate. Undershoot and you still pay for the full reservation.
Size the commitment to steady state ingestion, not to peak. A commitment set to peak pays for headroom you rarely use. Measure a full month of real volume before you commit.
You can raise a tier at any time, but a decrease is locked for 31 days after each change, per Microsoft. Size conservatively, then step up, because stepping down carries a wait.
The buyer side move is to leave predictable base load on a commitment and let genuine spikes ride pay as you go. Chasing every peak with reserved volume inflates the floor you pay every day.
Cost tracks the daily ingestion band, so the right pricing model and levers change as volume climbs from tens to thousands of gigabytes per day.
The table below maps daily volume to the model most estates should default to, the lever that moves the bill most, and the trap that catches buyers at that scale. Volumes are illustrative bands, not quotes.
| Ingestion band | Default model | Biggest lever | Watch out for |
|---|---|---|---|
| Under 50 GB per day | Pay as you go | Free Defender and E5 grant | Committing before volume is steady |
| 50 to 100 GB per day | 50 GB preview or pay as you go | E5 grant and basic logs | Promotional rate expiry |
| 100 to 500 GB per day | Commitment tier | Data tiering and transformation | Sizing to peak not base load |
| 500 to 5,000 GB per day | Commitment plus data lake | Auxiliary logs and lake retention | Verbose logs in analytics tier |
| Over 5,000 GB per day | High tier plus dedicated cluster | Cluster commitment and lake | Unmodeled multi year lock in |
Read the table as a starting posture, not a rule. An estate heavy in verbose firewall logs may drop a band simply by routing that traffic to auxiliary tiers before it reaches a commitment calculation.
Two paths cut cost: free Microsoft Defender security data and the cheaper log tiers that hold high volume, low value data.
Microsoft Defender XDR alerts and incidents ingest at no charge. The SecurityAlert and SecurityIncident tables, including alerts from Defender for Endpoint, Identity, Office 365, and Cloud Apps, are free per the billing guide.
The caveat matters. Although the alerts are free, the raw underlying logs for several Defender and Microsoft Entra ID data types are paid ingestion. Route the alert tables, not every raw log, to avoid paying twice.
Basic and auxiliary logs ingest high volume, low value data at a fraction of the analytics rate. Microsoft explains the table plans in its table tiers documentation. Route verbose sources there.
The trade is query capability. Cheaper tiers limit interactive query and some analytics features, so keep detection critical tables on analytics and push archival noise down. Match the tier to how you query the data.
The common advice is to ingest everything into Sentinel so nothing is missed, then optimize later. We disagree. More data does not mean more security, it means a larger bill, and the verbose sources that inflate cost rarely change a detection outcome. In our reviews the cheapest and most effective Sentinel deployments fed only the logs that earned their place, routed high volume noise to cheaper tiers, and leaned on the free Defender path. The buyer side move is to design ingestion before turning the taps on, not to ingest broadly and tune under budget pressure later. Detection value comes from the right logs, not all logs.
Microsoft 365 E5, A5, F5, and G5 licenses grant up to 5 MB of free Sentinel data ingestion per user per day.
The grant applies to a defined set of security data types tied to those suites. Microsoft states the benefit as up to 5 MB per user per day on its Sentinel pricing page. It offsets qualifying ingestion before paid volume begins.
| Qualifying E5 users | Free data per day | Free data per month |
|---|---|---|
| 1,000 | 5 GB | about 150 GB |
| 5,000 | 25 GB | about 750 GB |
| 10,000 | 50 GB | about 1,500 GB |
| 25,000 | 125 GB | about 3,750 GB |
The math is simple. Multiply your qualifying E5 seat count by 5 MB, and that is the daily free allowance against eligible data. A 10,000 seat estate absorbs roughly 50 GB per day before paid ingestion starts.
The buyer side implication is to reconcile the grant before sizing a commitment. Many estates already own E5 and never apply the benefit, so they commit to volume they could have ingested free.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
Sentinel does not bill for security. It bills for data. The cheapest Sentinel is the one fed only the logs that earn their place.
Defender XDR shifts security signal onto free alert tables while leaving raw telemetry as paid ingestion, so the interplay decides how much you pay.
When Sentinel runs in the unified Defender portal, XDR alerts and incidents arrive free. Detection content built on those tables carries no ingestion cost, unlike the same signal rebuilt from raw logs.
| Data type | Ingestion cost | Buyer move |
|---|---|---|
| SecurityAlert and SecurityIncident | Free | Base detections here |
| Raw Defender for Endpoint and Identity logs | Paid | Ingest only if hunted |
| Microsoft Entra ID sign in logs | Paid | Filter to needed events |
| Defender for Servers security events | 500 MB per node per day free | Claim the benefit |
Defender for Servers Plan 2 adds a 500 MB per node per day free data benefit for specific security tables, pooled across machines in a subscription, per the data ingestion benefit documentation.
The buyer side implication is to map every security table to free, granted, or paid before onboarding. Two identical estates can pay very differently based only on which path each table travels.
Verbose sources ingested into the analytics tier drive almost every Sentinel cost overrun.
The pattern repeats across estates. High volume feeds land in the most expensive tier by default, the free and granted paths sit unused, and commitments are sized to a peak that rarely returns.
Filter at the source, route noise to cheaper tiers, and resize commitments to steady state. Microsoft offers concrete guidance in its cost reduction documentation.
Ingestion time transformation is the sharpest tool. Data collection rules can drop or reshape events, such as trimming Windows Security Events, before they bill. Cutting fields and rows at the source beats archiving them cheaply later.
Keep hot detection data in analytics for the free 90 day window, then move aged data to the lower cost data lake instead of paying analytics retention.
Every workspace retains ingested data free for 90 days. Beyond that, analytics retention bills at standard Log Analytics rates, so long horizons on the analytics tier get expensive fast.
The Sentinel data lake holds large volumes of secondary and lower fidelity data at a lower rate, with a separate query model. During preview Microsoft offered 30 days of free lake storage and free data processing.
The buyer side move is to split retention by use. Keep the tables your analysts query interactively on analytics, and push compliance and long tail data to the lake, where storage is cheap and query is occasional.
Three moves control the bill without weakening detection: design ingestion first, route by value, and size commitments to steady state.
Decide which sources earn analytics ingestion before you onboard them. Design beats retrofitting under budget pressure, because turning off a live feed is harder than never turning it on.
Send high value logs to analytics, noise to basic and auxiliary tiers, and security signal through the free Defender and granted paths. Every table should have a named home and a reason.
Measure a month, then commit to steady state volume and leave peaks on pay as you go. Revisit the tier after each major onboarding, since base load moves as the estate grows.
What to do next comes down to a short, ordered checklist that moves volume off the analytics tier before any commitment is signed.
Microsoft Sentinel is priced by the volume of data ingested and analyzed, billed per gigabyte. Pricing combines a Sentinel analysis charge and the underlying Log Analytics cost, so ingestion volume is the main driver.
Commitment tiers let you reserve a daily ingestion volume at a discount against pay as you go. The more you commit per day, the lower the effective per gigabyte rate, provided the commitment matches real volume.
Much Microsoft Defender XDR alert and security data flows into Sentinel at no ingestion charge. Routing security signal through the free Defender path instead of paid ingestion is a major cost lever.
Basic and auxiliary log tiers ingest high volume, low value data at a much lower per gigabyte rate than analytics logs. Verbose sources can be routed to these cheaper tiers when full analytics is not needed.
The Sentinel data lake provides lower cost long term storage and querying for large volumes of security data. It separates cheap retention from the higher cost analytics tier.
Microsoft 365 E5, A5, F5, and G5 licenses grant up to 5 MB of free Sentinel data ingestion per user per day. A 10,000 seat estate absorbs roughly 50 GB per day before paid ingestion starts.
The simplified pricing tier bills Sentinel and Log Analytics on one combined per gigabyte meter instead of two separate line items. A single commitment then covers both the ingestion and analysis charges.
Verbose log sources ingested into the analytics tier without filtering. Firewall, proxy, and endpoint logs at full volume are the usual culprits, and they inflate the bill without adding detection value.
In our reviews, filtering verbose sources and routing to cheaper tiers typically cut Sentinel ingestion cost by 25 to 45 percent without losing detection coverage. The range depends on how unfiltered the original feed was.
Ingesting everything into the analytics tier on the assumption that more data means more security. It means more cost. Detection value comes from the right logs, not all logs.
Microsoft renewal moves, the EA framework, the M365 SKU framework, the Copilot framework, and the buyer side moves across the full Microsoft estate.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
