Microsoft Sentinel Pricing and Key Features in 2026

With the Pay-As-You-Go model, Microsoft Sentinel is priced at $4.30 per GB of data ingested into the analytics tier, with exact rates varying by region. For environments with steady or high log ingestion, Microsoft offers Commitment Tiers that start at $296 per day for 100 GB, and the data lake tier stores high-volume logs from $0.05 per GB. Total cost depends on ingestion volume, data tier, region, and retention settings.

Note: The prices in this article are Microsoft’s list prices for the East US region, read on October 20, 2026, on the Microsoft Sentinel pricing page and the Azure Retail Prices API. Your price can differ by region, agreement, and currency.

This guide answers the following questions:

• What are the Microsoft Sentinel pricing models (Pay-As-You-Go, Commitment Tiers, the analytics tier, and the data lake tier)?
• What would Microsoft Sentinel cost for 50, 100, or 500 GB per day?
• How do you estimate the monthly Microsoft Sentinel cost for your daily volume and retention?
• How do you use the Sentinel cost estimator and the Azure pricing calculator?
• Which data sources are free, and what do Sentinel graph and the MCP server cost?
• How do you reduce Microsoft Sentinel costs?

Every answer uses Microsoft’s own published prices and documentation.

How Much Does Microsoft Sentinel Cost?

Microsoft Sentinel pricing starts at $4.30 per GB of ingested data for Pay-As-You-Go, while Commitment Tiers start at 100 GB per day, which costs $296 daily. Microsoft says commitment tiers save up to 52% over Pay-As-You-Go, and the largest tier, 50,000 GB per day at $102,600 a day, works out to $2.052 per GB.

Microsoft Sentinel is billed through your Azure subscription for the data you ingest, keep, and query. Analytics tier data is stored in an Azure Monitor Log Analytics workspace, and Microsoft points out that Sentinel is only a portion of your Azure bill: Logic Apps playbooks, Azure Functions connectors, and notebooks are charged at their own prices.

A larger ingestion budget still leaves the question of who reads a critical alert at 2 a.m. The UnderDefense Agentic AI SOC works on top of the Microsoft Sentinel you already run: AI agents investigate every alert, and analysts on shift 24/7 decide what happens next, so your team starts the morning with an answer.

Microsoft Sentinel Pricing Comparison

Microsoft Sentinel offers two payment options for the analytics tier: Pay-As-You-Go for variable ingestion and Commitment Tiers for predictable volumes. Pay-As-You-Go charges per GB ingested, while Commitment Tiers provide discounted rates in exchange for a minimum daily commitment, making them better suited for steady environments. The data lake tier is billed on its own meters.

Here’s an overview of the available options at East US list prices in October 2026.

Two more factors change the total:

• Analytics tier data is retained free for 90 days, and longer retention is billed per GB per month.
• Certain data sources, such as Azure Activity Logs and Office 365 Audit Logs, are ingested at no cost.

Both are covered below with Microsoft’s current rates, and the 50 GB promotional price is available to customers who sign up by December 31, 2026, and holds until March 31, 2027.

Is Azure Sentinel the Same as Microsoft Sentinel?

Yes. Azure Sentinel is the former name of Microsoft Sentinel. According to a Microsoft blog post, Microsoft renamed it at Microsoft Ignite in November 2021, together with other Azure security products, to show that they protect more than Azure. Searches for Azure Sentinel pricing or an Azure Sentinel pricing calculator lead to the same Microsoft Sentinel meters described in this guide.

The old name still appears in older scripts, documentation, and screenshots. One more change is scheduled: Microsoft says that after March 31, 2027, Microsoft Sentinel will be available only in the Microsoft Defender portal, and Azure portal users will be redirected there. The charges still appear on your Azure bill.

Microsoft Sentinel Packages Overview

Microsoft Sentinel packages differ based on ingestion predictability and log usage. Organizations can choose Pay-As-You-Go for flexible usage or Commitment Tiers for discounted, predictable costs. Additional pricing differences depend on the data tier (analytics or data lake) and data retention duration.

Microsoft Sentinel includes built-in threat detection that identifies and prioritizes risks, and it connects to Microsoft tools such as Azure and Microsoft 365, as well as third-party data sources. Microsoft compares its two data tiers as follows.

Microsoft Sentinel provides different options to meet varying organizational needs. Whether you require predictable costs, scalability, or optimized data usage, there is a plan adjusted to your objectives.

Analytics Tier in Microsoft Sentinel

The analytics tier, called the Analytics Logs plan in older documentation, is the primary tier in Microsoft Sentinel and supports real-time detection, alerts, hunting, and advanced analytics. It is billed based on ingestion volume using either Pay-As-You-Go or Commitment Tiers and is intended for high-value security data that directly supports threat detection and response.

Analytics tier data supports all log types, with full analytics, alerts, and query capabilities. Microsoft recommends it for high-value security data such as identity logs, threat intelligence, and endpoint alerts. By monitoring this data with scheduled analytics rules, your team detects and responds to threats as they happen. The analytics tier can be used within two pricing frameworks.

Pay-As-You-Go

Pay-As-You-Go pricing charges for the exact amount of data ingested into Microsoft Sentinel, calculated per GB. It is best suited for organizations with fluctuating or unpredictable log volumes, as it offers flexibility without long-term commitments, though costs may be higher at scale compared to Commitment Tiers.

• This model charges based on the volume of data ingested into Microsoft Sentinel for security analysis and stored in the Azure Monitor Log Analytics workspace.
• Pricing is calculated per gigabyte, which Microsoft measures as one billion bytes.
• Ideal for organizations with variable or unpredictable data ingestion needs.
• Offers flexibility without a long-term commitment.

Tip: Microsoft offers a free 31-day trial in which the first 10 GB per day of analytics tier ingestion is free, for up to 20 workspaces per Azure tenant.

Commitment Tiers

Commitment Tiers provide discounted Microsoft Sentinel pricing in exchange for a minimum daily ingestion commitment, starting at 100 GB per day, plus a 50 GB tier in public preview at a promotional price. They are ideal for environments with stable, predictable log volumes and offer improved cost control compared to Pay-As-You-Go, with a minimum commitment period of 31 days.

• This model offers a fixed daily fee based on a chosen data tier, allowing for predictable costs and discounted pricing compared to Pay-As-You-Go rates.
• Organizations select a tier based on their expected data volume. Discounts increase with higher tiers.
• Usage above the tier is billed at the same discounted rate as the tier itself.
• A minimum commitment of 31 days is required, after which you can lower your tier or return to Pay-As-You-Go.
• Raising a tier takes effect at the start of the next UTC day and restarts the 31-day period.
• Commitment tiers apply per workspace and cannot be grouped across workspaces or subscriptions.

Microsoft defines the effective per-GB price as the tier’s daily price divided by its daily volume. At East US list prices in October 2026, the tiers work out as follows.

For 50, 100, and 500 GB per day, that means $161.25, $296, and $1,265 a day on a commitment tier, compared with $215, $430, and $2,150 a day at Pay-As-You-Go rates.

On simplified pricing, the analytics tier price includes the Log Analytics ingestion charge, so your bill shows one Sentinel line item. Workspaces created before July 2023 may still use classic pricing tiers that bill Log Analytics separately. Commitment tiers are especially beneficial for organizations with stable, high-volume data needs, offering significant cost savings while maintaining advanced security monitoring capabilities.

Data Lake Tier in Microsoft Sentinel

The data lake tier is Microsoft Sentinel’s low-cost tier for high-volume logs, such as network, firewall, and proxy logs, that you keep for forensics, historical analysis, and compliance. Microsoft made the Sentinel data lake generally available in September 2025. Data in this tier does not feed analytics rules or real-time hunting, and you query it with KQL jobs, notebooks, and summary rules.

Data lake billing uses a separate meter for each activity. At East US list prices in October 2026, the meters are:

Storage is billed on compressed data at a flat 6:1 rate, so in Microsoft’s example 600 GB of raw data is billed as 100 GB. Ingestion and processing charges don’t apply to analytics tier tables, which Microsoft mirrors into the data lake at no additional cost.

Basic and Auxiliary Logs: The Older Plans

Basic Logs and Auxiliary Logs are the older plans for high-volume data with relatively low security value. Microsoft’s pricing page now lists only the analytics tier and the data lake tier. Once a workspace is onboarded to the data lake, Microsoft bills its usage through the data lake meters in place of the long-term retention (formerly Archive), search, and auxiliary logs ingestion meters.

Basic Logs tables still exist in some workspaces, and you currently manage them from the Log Analytics workspace. Workspaces that don’t use the data lake find the legacy search, query, and restore prices on the Azure Monitor pricing page.

Microsoft Sentinel Pricing Calculator and Licensing

Microsoft offers two tools for estimating Sentinel costs. The Microsoft Sentinel cost estimator is a guided tool that reflects your actual pricing, adds usage recommendations, and projects costs over three years with growth modeling. It requires an Entra ID sign-in. Without one, Microsoft points you to the Azure Pricing Calculator for general estimates.

How to Use the Azure Pricing Calculator for Sentinel

The calculator is only as accurate as the volumes you enter, so collect them first. A practical sequence looks like this:

1. Measure your daily ingestion per data source for at least 30 days.
2. Decide which tables need real-time detection and which can move to the data lake tier.
3. Add Microsoft Sentinel to the calculator and choose your region.
4. Enter your analytics tier volume and compare Pay-As-You-Go with the nearest commitment tier.
5. Add analytics retention beyond 90 days and data lake storage for total retention.
6. Add Logic Apps, Azure Functions, and notebook usage if you run them.

Subtract free data sources and any Microsoft 365 E5 data grant before you compare the result with a quote.

A Worked Estimate for 100 GB a Day

Take a workspace that ingests 100 GB a day into the analytics tier and must keep one year of data. The figures below are an illustration at East US list prices in October 2026:

• The 100 GB commitment tier costs $296 a day, about $8,880 for a 30-day month.
• The first 90 days of analytics retention are included in that price.
• Keeping the other 275 days in the analytics tier adds 27,500 GB at $0.10 per GB per month, about $2,750 a month once the year fills up.
• Keeping those 275 days in the data lake tier bills the same 27,500 GB as about 4,583 GB compressed, at $0.026 per GB, about $119 a month.

The retention choice moves this bill more than the tier choice does, so set analytics and total retention per table before you commit. This estimate covers the platform only: the people who tune analytics rules and answer incidents are a separate line, and managed SIEM pricing is one way to put a number on it.

Microsoft Sentinel Licensing

Microsoft prices Sentinel by the data you ingest, retain, and query, through your Azure subscription. Commitment tiers are set per workspace, and a Log Analytics dedicated cluster lets workspaces in one region that together ingest 100 GB a day or more share one commitment.

Two licensing details lower the bill. Microsoft 365 E5, E7, A5, F5, and G5 customers get a data grant for Microsoft 365 data, covered in the free data sources section below. You can also pre-purchase Microsoft Sentinel commit units for a one-year term, and eligible analytics tier costs are deducted from them automatically.

Data Retention Costs in Microsoft Sentinel

Retention is the second half of a Sentinel bill, and Microsoft splits it into two states with different prices.

Interactive and Total Retention

Interactive retention, which Microsoft now calls analytics retention, keeps data hot for analytics rules, hunting, and fast queries. A Microsoft Sentinel workspace retains this data free for 90 days. You can extend it to up to two years, billed at the Log Analytics retention price of $0.10 per GB per month in East US, as of October 2026.

Total retention keeps data longer in the data lake tier, for up to 12 years. By default, total retention equals analytics retention and adds no cost. The days beyond analytics retention are billed as data lake storage at $0.026 per GB per month, on compressed data.

When you shorten total retention, Microsoft waits 30 days before removing the data, so you can revert a configuration mistake. Microsoft Defender XDR data keeps its own 30-day default in advanced hunting, and extending it to 90 days in the analytics tier incurs ingestion charges with free storage.

CEF Ingestion Costs

CEF logs from firewalls, proxies, and other appliances land in the CommonSecurityLog table, which holds the standard CEF fields. Fields beyond the standard schema land in AdditionalExtensions, and Microsoft warns that these can carry higher ingestion volumes than the standard fields, because their content varies. Check what your appliances send there before you size a commitment tier.

Costs After Resource Deletion

Removing Microsoft Sentinel doesn’t remove the Log Analytics workspace it was deployed on, or any separate charges that workspace incurs. If you decommission Sentinel, review the workspace, its retention settings, and the connectors and Azure Functions that still send data to it.

Free Data Sources and Ingestion Credits

Microsoft Sentinel ingests some data at no charge for every customer. Microsoft’s billing documentation lists these free sources:

• Azure Activity Logs.
• Microsoft Sentinel health monitoring data.
• Office 365 Audit Logs, including all SharePoint activity, Exchange admin activity, and Teams.
• Security alerts from Microsoft Defender XDR, Defender for Cloud, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender for Endpoint.
• Microsoft Entra ID Protection alerts and Microsoft Defender XDR incidents.

The alerts are free, while the raw logs from Defender XDR, the individual Defender products, Microsoft Entra ID, and Azure Information Protection are paid data types, so choose data types connector by connector.

Two credits reduce the paid volume further. The 31-day free trial waives up to 10 GB a day of analytics tier ingestion. Microsoft 365 E5, E7, A5, F5, and G5 customers, including the Security editions, get a data grant of up to 5 MB per user per day for Entra ID sign-in and audit logs, Defender for Cloud Apps discovery logs, Purview Information Protection logs, and Microsoft 365 advanced hunting data.

Microsoft estimates on its Microsoft 365 E5 benefit page that the grant saves up to $2,200 a month on a typical 3,500-seat deployment, based on East US Pay-As-You-Go prices. The grant is applied to your bill automatically, with no sign-up.

Sentinel Graph and MCP Server Billing

Sentinel graph and the Sentinel MCP server are the newest cost lines on a Sentinel bill. Microsoft introduced both in preview in September 2025, and the Azure Retail Prices API lists the Graph meter from April 1, 2026, at $3 per compute hour in East US.

Sentinel Graph

The graph views built into the Defender and Purview portals, such as the hunting graph and blast radius visualizations, carry no charge. Custom graphs are billed per compute hour on the graph meter, for building a graph in notebooks and for querying it from notebooks, the Defender portal, the Graph Query APIs, or the MCP graph tools.

Microsoft calculates the charge from vCores and run time. Graph builds use 49 vCores and queries use 6, with a minimum query time of one minute. At $3 per vCore hour, a five-minute build costs about $12.25 and a one-minute query about $0.30. The notebook compute and storage used to prepare the graph’s data are billed separately on the data lake meters.

Sentinel MCP Server

The MCP server exposes Sentinel platform capabilities to AI agents, and Microsoft charges nothing for the server itself. Each tool bills the meter it uses: the data exploration tools use the data lake query meter, the graph tools use the graph meter, and the triage tool is free once Sentinel or Microsoft Defender is set up in the Defender portal.

The entity analyzer tool also consumes Security Compute Units (SCUs) for its AI reasoning, plus data lake query charges. Existing SCU entitlements apply, and usage beyond your Microsoft 365 E5 entitlement is billed as SCU overage. If you plan to connect AI agents to Sentinel, budget for their queries the way you budget for your analysts’ KQL.

How to Cut Microsoft Sentinel Costs

Microsoft’s own cost guidance names the levers, and most of them reduce the volume you pay for. Work through them in this order:

1. Measure ingestion per table for 30 days and match your commitment tier to the pattern.
2. Move network, firewall, and proxy logs that no analytics rule uses to the data lake tier.
3. Keep non-security operations data in a separate workspace, outside Sentinel.
4. Filter Windows Security Events at the source with data collection rules.
5. Keep analytics retention at the free 90 days and extend total retention in the data lake.
6. Enable the free data sources and confirm that the Microsoft 365 E5 data grant applies.
7. Pool workspaces that ingest 100 GB a day or more in one region on a dedicated cluster.
8. Pre-purchase commit units if your analytics tier spend is predictable for a year.

Revisit the tier monthly at first. You can raise a commitment tier at any time, while lowering it or returning to Pay-As-You-Go has to wait until the 31-day period ends.

How Can UnderDefense Help You Maximize Microsoft Sentinel SIEM?

If you pay for Sentinel ingestion and nobody is on shift at 2 a.m., critical incidents wait in the queue until morning. The Agentic AI SOC works on top of your Sentinel workspace without replacing it: AI agents investigate every alert, and UnderDefense analysts make the response decisions around the clock.

Detection engineering also cuts the false positives your SIEM generates, so your team works the incidents that matter. UnderDefense is rated 4.9 out of 5 from 57 reviews on G2, as of October 2026, and one reviewer describes what changed outside business hours:

“We no longer have to worry about missing a critical issue outside of work hours. Escalations come to us fully explained, including what happened, what was ruled out, and what actually needs our input.”

Bohdan P., Founder & CEO, IT services company of 50 or fewer employees, G2, August 2026

The same reviewer notes that the platform needed a few weeks to calibrate to their stack. Expect detection tuning on your Sentinel data to take from a few weeks to a few months, as reviewers report.

Bring one noisy analytics rule and a week of Sentinel incidents. Book a Sentinel triage demo

Frequently Asked Questions