Azure Sentinel Pricing | Microsoft Azure (2024)

  1. Home
  2. Azure pricing
  3. Microsoft Sentinel pricing
  • Request a pricing quote
  • Try Azure for free

Modern cloud-native SIEM and intelligent security analytics

Microsoft Sentinel brings together data, analytics, and workflows to unify and accelerate threat detection and response across your enterprise. Data for security analysis is stored in an Azure Monitor Log Analytics workspace where Microsoft Sentinel analyzes, interacts and derives insights from large volumes of data in seconds. Microsoft Sentinel is billed for the volume of data stored in a Log Analytics workspace and analyzed in Microsoft Sentinel.

Explore pricing options

Apply filters to customize pricing options to your needs.

Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, and the currency exchange rate. Prices are calculated based on US dollars and converted using Thomson Reuters benchmark rates refreshed on the first day of each calendar month. Sign in to the Azure pricing calculator to see pricing based on your current program/offer with Microsoft. Contact an Azure sales specialist for more information on pricing or to request a price quote. For more information on Azure pricing see frequently asked questions.

US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.

Learn more

Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.

US government entities are eligible to purchase Azure Government services from a licensing solution provider with no upfront financial commitment, or directly through a pay-as-you-go online subscription.

Learn more

Important—The price in R$ is merely a reference; this is an international transaction and the final price is subject to exchange rates and the inclusion of IOF taxes. An eNF will not be issued.

Microsoft Sentinel Pricing

Microsoft Sentinel is billed for the volume of data analyzed in Microsoft Sentinel and stored in Azure Monitor Log Analytics workspace. Data can be ingested as two different types of logs: Analytics Logs and Basic Logs.

Analytics Logs

Analytics logs in Microsoft Sentinel support all data types offering full analytics, alerts and no query limits. Analytics logs include high value security data that reflect the status, usage, security posture and performance of your environment. Analytics Logs are best monitored proactively, with scheduled alerts and analytics, enabling security detections. There are two ways to pay for the Microsoft Sentinel Service: Pay-As-You-Go and Commitment Tiers.

Pay-As-You-Go

With Pay-As-You-Go pricing, you are billed per gigabyte (GB) for the volume of data ingested for security analysis in Microsoft Sentinel and stored in the Azure Monitor Log Analytics workspace. Data volume is measured by the volume of data that will be stored in GB (10^9 bytes).

Commitment Tiers

With Commitment tiers you are billed a fixed fee based on the selected tier, enabling a predictable total cost for Microsoft Sentinel. Commitment tiers provide you a discount on the cost based on your selected tier compared to Pay-As-You-Go pricing. You have the flexibility to opt out of the commitment tier any time after the first 31 days of commitment.

Prices shown below reflect total cost for the analytics enabled by Microsoft Sentinel, including data ingestion charges for log analytics. Prices are calculated assuming the same commitment tiers are selected for Microsoft Sentinel and Azure Monitor Log Analytics. Customers have the flexibility to select different pricing tiers for Microsoft Sentinel and Azure Monitor Log Analytics based on their specific needs.

Price Tier Microsoft Sentinel Price Log Analytics Price Total Price Effective Per GB Price1 Savings Over Pay-As-You-Go
Pay-As-You-Go $- per GB-ingested $- per GB $- per GB $- per GB N/A
100 GB per day $- per day $- per day $- per day $- per GB $-
200 GB per day $- per day $- per day $- per day $- per GB $-
300 GB per day $- per day $- per day $- per day $- per GB $-
400 GB per day $- per day $- per day $- per day $- per GB $-
500 GB per day $- per day $- per day $- per day $- per GB $-
1,000 GB per day $- per day $- per day $- per day $- per GB $-
2,000 GB per day $- per day $- per day $- per day $- per GB $-
5,000 GB per day $- per day $- per day $- per day $- per GB $-

1Data ingested into Microsoft Sentinel exceeding the selected daily commitment tier is charged at the effective tier prices listed above.

Basic Logs

Basic Logs are usually verbose and contain a mix of high volume and low security value data without the full capabilities of analytics logs. They are not frequently used for deep analytics and alerts, and accessed on demand for ad-hoc querying, investigations and search. To help you reduce costs while you ingest more data, Microsoft Sentinel now offers a flexible pricing option for Basic Logs.

Analytics Logs Basic Logs
Data Types All Custom Logs2, Container Logs, and AppTraces
KQL Querying Capabilities Full Reduced
Alerts support Yes No
Query concurrency limits No Yes

2This only pertains to custom log tables created with the Data Collection Rule (DCR)-based custom logs API and configured to the Basic Log data plan.

Basic Logs will be accessible for interactive queries for the first 8 days. Afterwards archived logs can be enabled to store the data. Searching data in Basic Logs are subject to additional billing. Prices below are not inclusive of Log Analytics Basic Logs. Please refer to the Azure Monitor pricing for the related data ingestion charges.

Feature Price
Basic Logs analysis $- per GB of data ingested
Basic Logs search queries $- per GB of data scanned

Log Data Retention

Once Microsoft Sentinel is enabled on your Azure Monitor Log Analytics workspace, every GB of data ingested into the workspace, excluding Basic Logs, can be retained at no charge for the first 90 days. Retention beyond 90 days and up to 2 years will be charged per the standard Azure Monitor pricing retention prices. Your data is accessible via interactive queries.

Log Data Archive

Microsoft Sentinel offers a fully managed, cost-effective data archiving solution for logs that need to be kept for several years for compliance and can be accessed to investigate an incident. You can store your archive data for up to 7 years. Searching archived logs is done using asynchronous search jobs which incur a cost for the data scanned. Archived logs can also be restored to enable full interactive analytics query capabilities. Please refer to the Azure Monitor pricing pricing for the related retention and query charges.

Search Jobs

Search jobs are asynchronous queries that fetch records and make the results available in a search table created at the time of search and available within your workspace for further analytics. The search job uses parallel processing for executing the search job across long time horizons and spanning extremely large datasets. Search jobs can be run on any type of log and are ideally adapted for searching logs in Log Data Archive and Basic Logs. Search jobs will be charged by the amount of data scanned to complete the search.

Feature Price
Search Jobs $- per GB of data scanned

Log Data Restore

Bring historical log data into the current hot cache for high performing queries and analytics. Simply specify a target table and a specific time range for the data you wish to restore, and in a few minutes the target log data is available within the workspace with full KQL support for high performance queries. Log Data Restore is ideally adapted for restoring historical logs stored in Log Data Archive.

Feature Price
Log Data Restore $- per GB per day

Data ingested into Microsoft Sentinel exceeding the selected daily commitment tier is charged at the effective tier prices listed above.

A minimum charge of 2TB for 12-hours applies to every restore; pro-rated hourly

Microsoft Sentinel solution for SAP

The Microsoft Sentinel solution for SAP can monitor, detect and respond to sophisticated threats throughout the business logic and application layers for SAP systems hosted on Azure, GCP, AWS, or on-premises. It collects application logs from across the entire SAP system and then sends those logs to an Azure Monitor Log Analytics workspace in Microsoft Sentinel for continuous threat monitoring.

The Microsoft Sentinel solution for SAP will be billed as an add-on charge from May 1, 2023 at $- per system ID (production SID only) per hour in addition to the existing Microsoft Sentinel consumption-billing model. The solution will be free when a workspace is in a Microsoft Sentinel free trial.

Please see offer page for more details.

Feature Price
SAP Threat Protection $- per SID hour

Free trial

Try Microsoft Sentinel free for the first 31 days. Microsoft Sentinel can be enabled at no additional cost on an Azure Monitor Log Analytics workspace, subject to the limits stated below.

  • New workspaces can ingest up to 10GB/day of log data for the first 31-days at no cost. Both Log Analytics data ingestion and Microsoft Sentinel charges are waived during the 31-day trial period. This free trial is subject to a 20 workspace limit per Azure tenant.
  • Existing workspaces can enable Microsoft Sentinel at no additional cost. Only the Microsoft Sentinel charges are waived during the 31-day trial period.

Usage beyond these limits will be charged per pricing listed on this page. Charges related to additional capabilities for automation and bring your own machine learning are still applicable during the free trial.

Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5 and G5 customers

Microsoft 365 E5, A5, F5 and G5 and Microsoft 365 E5, A5, F5 and G5 Security customers can receive a data grant of up to 5MB per user/day to ingest Microsoft 365 data. The data sources included in this offer include:

  • Azure Active Directory (Azure AD) sign-in and audit logs
  • Microsoft Defender for Cloud Apps shadow IT discovery logs
  • Microsoft Information Protection logs
  • Microsoft 365 advanced hunting data

For more information, please visit: Microsoft 365 E5 benefit offer with Microsoft Sentinel | Microsoft Azure

Microsoft Sentinel free data sources

In addition, following Microsoft 365 data sources are always free for all Microsoft Sentinel users as an ongoing Microsoft Sentinel benefit:

  • Azure Activity Logs
  • Office 365 Audit Logs (all SharePoint activity and Exchange admin activity)
  • Alerts from Microsoft Defender for Cloud, Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint and Microsoft Defender for Cloud Apps
  • For more information on Microsoft Sentinel free data sources please see plan costs for Microsoft Sentinel.

Automation and bring your own machine learning

Microsoft Sentinel integrates with many other Azure services providing enhanced capabilities for Security Information and Event Management (SIEM) and Security Orchestration and Automation and Response (SOAR). Some of these services may have additional charges:

  • You can use Azure Logic Apps to automate your security responses. Please refer to Azure Logic Apps pricing page for related costs.
  • You can bring in your own machine learning models for customized analysis. Please refer to Azure Machine Learning Studio and Azure Databricks pricing to understand the related costs.

Azure pricing and purchasing options

Azure Sentinel Pricing | Microsoft Azure (1)

Connect with us directly

Get a walkthrough of Azure pricing. Understand pricing for your cloud solution, learn about cost optimization and request a custom proposal.

Talk to a sales specialist

See ways to purchase

Purchase Azure services through the Azure website, a Microsoft representative, or an Azure partner.

Explore your options

Additional resources

Azure Sentinel Pricing | Microsoft Azure (2)

Microsoft Sentinel

Learn more about Microsoft Sentinel features and capabilities.

Azure Sentinel Pricing | Microsoft Azure (3)

Pricing calculator

Estimate your expected monthly costs for using any combination of Azure products.

Azure Sentinel Pricing | Microsoft Azure (4)

SLA

Review the Service Level Agreement for Microsoft Sentinel.

Azure Sentinel Pricing | Microsoft Azure (5)

Documentation

Review technical tutorials, videos, and more Microsoft Sentinel resources.

Frequently asked questions

Frequently asked questions about Azure pricing

  • Commitment tiers allow you to reserve a fixed amount of daily data ingestion capacity for Azure Monitor and Microsoft Sentinel for a fixed, predictable daily fee. You can upgrade your requested commitment at any time. Your new commitment tier will be effective at the start of the next UTC day. However, the minimum commitment period before you can opt out or reduce your capacity reservation is 31 days.

  • Commitment tiers are applicable at a workspace level and cannot be grouped across workspaces or subscriptions.

  • Any Azure services that you use in addition to Microsoft Sentinel are charged per their applicable pricing. For example – Log Analytics, Logic Apps, Machine Learning, Solutions etc.

  • There are no additional charges for Microsoft Sentinel features that are in preview (indicated by a “Preview” tag) beyond associated data ingestion and retention costs. Pricing for features that are in preview will be announced in the future and a notice will be provided prior to the end of the preview. Should you choose to continue using preview features after the notice period, you will be billed at the applicable rates.

  • Not all data types are suitable for Basic logs. While Basic logs provide a reduced-price option to bring in infrequently used, low security value data; they are limited in querying capabilities, don’t provide schedules alerts support, and are retained for 8-days. They are best used for ad-hoc querying, investigations and search scenarios. Customers can ingest Custom Logs, Container Logs, and AppTraces as Basic logs in a Log Analytics Workspace.

Talk to a sales specialist for a walk-through of Azure pricing. Understand pricing for your cloud solution.

Request a pricing quote

Get free cloud services and a $200 credit to explore Azure for 30 days.

Try Azure for free

Added to estimate. Press 'v' to view on calculator View on calculator

Can we help you?

Azure Sentinel Pricing | Microsoft Azure (2024)

FAQs

How do I reduce Azure Sentinel costs? ›

  1. Set or change pricing tier. ...
  2. Separate non-security data in a different workspace. ...
  3. Turn on basic logs data ingestion for data that's high-volume low security value (preview) ...
  4. Optimize Log Analytics costs with dedicated clusters. ...
  5. Reduce long-term data retention costs with Azure Data Explorer or archived logs (preview)
Sep 20, 2022

How is Azure Sentinel charged? ›

With Pay-As-You-Go pricing, you are billed per gigabyte (GB) for the volume of data ingested for security analysis in Microsoft Sentinel and stored in the Azure Monitor Log Analytics workspace. Data volume is measured by the volume of data that will be stored in GB (10^9 bytes).

What license is required for Azure Sentinel? ›

An Azure Active Directory license and tenant, or an individual account with a valid payment method, are required to access Azure and deploy resources.

How much is Sentinel per month? ›

The price of the Deep Sentinel system is $399. The purchase of Deep Sentinel systems also requires the minimum purchase of a one-year commitment to this monthly monitoring. That is an additional $720 for the 12 months of coverage at $60 per month.

Is Sentinel free in Azure? ›

Azure Sentinel is billed based on the volume of data ingested for analysis in Azure Sentinel and stored in the Azure Monitor Log Analytics workspace. Azure Sentinel offers a flexible and predictable pricing model. There are two ways to pay for the Azure Sentinel service: Capacity Reservations and Pay-As-You-Go.

What is the cheapest way to store data in Azure? ›

Consider Azure Blob Storage Block Blobs instead of storing binary image data in Azure SQL Database. Blob storage is cheaper than Azure SQL Database. If your design requires SQL, store a lookup table in SQL Database and retrieve the document when needed to serve it to the user in your application middle tier.

Is Azure Sentinel any good? ›

Microsoft Sentinel is the #1 ranked solution in SOAR tools, #2 ranked solution in top Security Information and Event Management (SIEM) tools, and #4 ranked solution in top Microsoft Security Suite tools. PeerSpot users give Microsoft Sentinel an average rating of 8.2 out of 10.

Is the Sentinel worth charging? ›

Once charged, the shots from the sniper are incredibly powerful. It can crack an enemy's armour no matter how strong it is, including Red armour. This means that a clean body shot with a charged Sentinel does up to 100 damage, no matter where you hit them.

How long does Sentinel charge last? ›

When timing the shots correctly, the Sentinel's rate of fire increases. Shield Cells charge up the Sentinel increasing its damage by 25% for 120 seconds, and each shot will shorten the charge by 15 seconds. Charging the Sentinel takes 5 seconds.

Is Microsoft Sentinel the same as Azure Sentinel? ›

Azure Sentinel, now known as Microsoft Sentinel, centralizes your threat collection, detection, response, and investigation efforts. It provides threat intelligence and intelligent security analytic capabilities that facilitate threat visibility, alert detection, threat response, and proactive hunting.

What are the requirements to use Sentinel? ›

Java Java 1.8 is required to launch Solution Designer and Sentinel Control Center. Browsers The Sentinel interface is optimized for viewing at 1280 x 1024 or higher resolution in the following supported browsers: Microsoft Edge. Google Chrome.

What is Sentinel licensing? ›

Sentinel RMS License Manager is an on-premises network service that enforces and manages licensing in multi-user environment.

What is the difference between Azure Sentinel and Azure defender? ›

Azure Defender is my gym membership or vitamins that help improve or boost my health, and Azure Sentinel is the regular and specialists tests and treatments from my doctor, that alert me to specific signs that need investigating across my whole body, including my blood tests.

How many times can you use Sentinel? ›

Sentinel Spectrum should be administered orally, once every month with dosing based on your dog's weight. For heartworm prevention, give once monthly for at least 6 months after exposure to mosquitoes. Sentinel Spectrum should be given once a month, every month of the year.

What happens if you miss a month of Sentinel? ›

If it has been less than two weeks since the missed dose, give your dog the dose immediately. If it has been over two weeks since the missed dose, contact your vet, who will likely advise you to resume normal dosing next month and have the dog tested for heartworm in six months.

Is Sentinel every 30 days? ›

Sentinel® and Sentinel Spectrum® are given once a month and the schedule should follow as close to every 30 days as possible in between doses. If your veterinarian has directed you to give this medication on a different dosing schedule, please contact them for further instructions if a dose was missed.

How do I get free sentinel? ›

How to Download Free Sentinel Satellite Data
  1. Create a User Account.
  2. Select Your Area of Interest.
  3. Download Sentinel Data.
Jan 2, 2023

Can I use Azure for free forever? ›

You can try that with Azure Web Apps. This has a free tier that you can use forever. The only catch is that the free tier isn't as powerful and doesn't have as many capabilities as paid tiers.

Why should I use Azure Sentinel? ›

Microsoft Sentinel aggregates data from all sources, including users, applications, servers and devices running on-premises or in any cloud, letting you reason over millions of records in a few seconds. It includes built-in connectors for easy onboarding of popular security solutions.

What are the 3 pricing models of Azure? ›

Azure Pricing Models

Microsoft offers three main ways to pay for Azure VMs and other cloud resources: pay as you go, reserved instances, and spot instances.

How do I reduce my Azure billing? ›

7 ways to optimize costs today
  1. Shut down unused resources. ...
  2. Right-size underused resources. ...
  3. Reserve instances for consistent workloads. ...
  4. Take advantage of the Azure Hybrid Benefit. ...
  5. Configure autoscaling. ...
  6. Set up budgets and allocate costs to teams and projects. ...
  7. Choose the right Azure compute service.

What are the main factors that affect Azure cost? ›

Azure has data centers across the globe. Usage costs differ according to the location offering particular Azure services, products and resources—these costs factor in demand, popularity and local infrastructure costs.

Which is cheaper Amazon or Azure? ›

In both cases, Azure is approximately 20% more expensive than AWS for the same instance type. Of course this is just one comparison out of hundreds of instance types, and you are encouraged to compare the specific instances that are most relevant for your use case.

Is Azure cheaper then AWS? ›

Pay less with Azure

AWS is up to 5 times more expensive than Azure for Windows Server and SQL Server.

Is Azure cheaper than Google? ›

Key takeaways:

Google Cloud is much cheaper than AWS and Azure for computing optimized cloud-based instances. On the other hand, it's more expensive than others when it comes to the instance types of accelerated computing.

Is Sentinel better than Splunk? ›

Microsoft Sentinel is generally rated as being easier to use, set up, and administrate. Splunk generally gets better ratings for quality of support and ease of doing business. Most people trust Microsoft's products more, including its Network Management, Incident Management, and Security Intelligence.

What is the AWS equivalent of Azure Sentinel? ›

Amazon CloudWatch is a native AWS monitoring tool for AWS programs. It provides data collection and resource monitoring capabilities. Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise.

What are the 4 primary capabilities of Microsoft Sentinel? ›

With Microsoft Sentinel, you get a single solution for attack detection, threat visibility, proactive hunting, and threat response.

How many cells does it take to charge a Sentinel? ›

Sentinel requires 2 cells instead of one to charge if you have gold body shield. skate.

Does the Sentinel have bullet drop? ›

Sentinel attachments

Given the Sentinel has a fast projectile speed, you don't really need to consider bullet drop as much as other snipers. Banging on a 4x-8x ⁠— or if you're lucky, a 4x-10x Digital Threat ⁠— is the best thing you could do.

Does the Sentinel have a hop up? ›

Deadeye's Tempo is an Epic rarity (purple) weapon Hop-Up that is only compatible with the Bocek Bow and Sentinel Sniper Rifle.

Can you charge Sentinel in arenas? ›

The two firearms are disabled in all modes, so you can't use the Rampage or Sentinel in Trios, Duos, Ranked, or Arenas.

Is the Longbow or Sentinel better? ›

The Sentinel does 65 dmg per shot compared to 55 for the Longbow. For normal legends it only makes a difference with blue shields as you can down them with 3 shots instead of 4. But most meta legends are either low profile or fortified and for thise the differences are bigger.

How much damage does a charged Sentinel headshot do? ›

During this charged state, you get a 25% damage boost for a certain amount of time (or a maximum of 8 shots, with each shot cutting off 15 seconds of charged time).

How many Azure Sentinel workspaces do I need? ›

You can include up to 20 workspaces in a single query. For good performance though, we recommend keeping it under 5. You must deploy Microsoft Sentinel on every workspace referenced in the query.

Is Azure Sentinel a XDR? ›

To reiterate, Microsoft Defender provides XDR capabilities for end-user environments. On the other hand, Sentinel provides XDR capabilities for infrastructure and cloud platforms.

Is Sentinel a SaaS or PAAS? ›

Sentinel offers a wide variety of cloud-based business applications available as Software as a Service (SaaS) solutions. They are designed to help your organization achieve business goals through innovation.

Can you use Sentinel multiple times? ›

If you take the Attack action on your turn, you can make one additional attack as a bonus action. This attack can benefit from your Sneak Attack even if you have already used it this turn, but you can't use your Sneak Attack against the same target more than once in a turn.

Does a sentinel terminate a program? ›

A sentinel value is a special value used to terminate a loop when reading data. In the following program, test scores are provided (via user input). Once the sentinel value of -1 is input, the loop terminates.

What should you create first in Microsoft Sentinel? ›

The first step is to initialize a QueryProvider and tell it we want to use the Microsoft Sentinel Query provider. Note: MSTICPy contains several QueryProviders for other data sources as well. Once set up we can tell the `QueryProvider` to `connect` which will kick off the authentication process.

How expensive is Azure Sentinel? ›

Commitment Tiers
PriceTierMicrosoft Sentinel Price
Pay-As-You-Go$2.46 per GB-ingested$2.76 per GB
$5.22 per day100 GB per day$123 per day
$5.22 per day200 GB per day$221.40 per day
$5.22 per day300 GB per day$319.80 per day
5 more rows

What license do you need for Microsoft Sentinel? ›

Before deploying Microsoft Sentinel, make sure that your Azure tenant has the following requirements: An Azure Active Directory license and tenant, or an individual account with a valid payment method, are required to access Azure and deploy resources.

What database does Azure Sentinel use? ›

Azure Sentinel uses Azure Monitor which is built on a proven and scalable log analytics database that ingests more than 10 petabytes every day and provides a very fast query engine that can sort through millions of records in seconds.

Is Azure synapse expensive? ›

Synapse goes by particular pricing, and it is expensive. Both Azure Synapse Analytics and Snowflake are pretty expensive.

Which Azure Database is cheapest? ›

The price is 24 USD per month and 0.032 USD per hour. By the other hand, the cheapest option for an Azure SQL databases is 5 USD per month.
...
Prices.
SQL Server on Azure VMAzure SQL Database
16 Cores, 95 USD per month, Web Edition.250 GB Database, 50 DTUs, 75 USD per month.
3 more rows
Feb 22, 2016

Is Sentinel hub free? ›

Sentinel Hub services are providing long-term analysis in an efficient way. We keep EO Browser, our showcase of Sentinel Hub functionality free to use, to make these features available to just about anyone.

Top Articles
Latest Posts
Article information

Author: Prof. Nancy Dach

Last Updated:

Views: 6193

Rating: 4.7 / 5 (77 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Prof. Nancy Dach

Birthday: 1993-08-23

Address: 569 Waelchi Ports, South Blainebury, LA 11589

Phone: +9958996486049

Job: Sales Manager

Hobby: Web surfing, Scuba diving, Mountaineering, Writing, Sailing, Dance, Blacksmithing

Introduction: My name is Prof. Nancy Dach, I am a lively, joyous, courageous, lovely, tender, charming, open person who loves writing and wants to share my knowledge and understanding with you.