Independent SOC-cost research, read by security leaders pricing operations.Sponsor this site →
Independent cost reference. Not affiliated with any security vendor or MSSP.

Microsoft Sentinel Cost 2026: Pricing per GB and M365 Free Tier

Microsoft Sentinel pricing is anchored on Azure consumption ($4.30/GB list, US East) plus a Microsoft-shop discount: Azure Activity logs, Office 365 audit logs, and Defender alerts ingest free (though Entra ID sign-in logs do not). Here is the full TCO picture including commitment tiers, archive storage, and when Sentinel beats Splunk.

Quick Answer

Microsoft Sentinel pricing is $4.30/GB pay-as-you-go, or a commitment tier from $161.25/day for 50 GB/day down to $2.05/GB at 50 TB/day. Azure Activity logs, O365 audit logs, and Defender alerts ingest free (Entra ID sign-in logs are paid).

US East list prices, Azure Retail Prices API, checked 28 October 2026.

$15,695/yr

10 GB/day pay-as-you-go

$108,040/yr

100 GB/day commitment

$905,200/yr

1 TB/day commitment

Published daily rate x 365 days, analytics tier only, before any enterprise-agreement discount.

Microsoft Sentinel pricing calculator

Enter your billable daily volume to compare pay-as-you-go with the cheapest commitment tier, overage included.

Pay-as-you-go ($4.30/GB)

$156,950/yr

$12,900 per 30 days

Cheapest option: 100 GB/day commitment

$108,040/yr

$296/day fixed, even on days you ingest less

Our arithmetic on Microsoft's published US East list prices, 365 days a year. Excludes retention beyond 90 days, data lake meters, Logic Apps and enterprise-agreement discounts. Leave out free sources (Azure Activity, Office 365 audit logs, Defender alerts) before entering your volume.

Sentinel commitment tier pricing

CommitmentIndicative per-GB rateMonthly cost (at commit)Best fit
Pay-as-you-go$4.30/GBVariableUnder 37.5 GB/day (50 GB tier break-even), variable volume
50 GB/day~$3.23/GB~$4.8KSmallest published commitment
100 GB/day~$2.96/GB~$8.9KMid-market entry
200 GB/day~$2.74/GB~$16.4KMid-market mature
500 GB/day~$2.53/GB~$38KLarge mid-market / small enterprise
1 TB/day~$2.48/GB~$74KEnterprise
2 TB/day~$2.40/GB~$144KLarge enterprise

Per-GB rates derived from the daily capacity-reservation prices Microsoft publishes in the Azure Retail Prices API (US East), re-checked 28 October 2026: 50 GB/day $161.25, 100 GB/day $296, 200 GB/day $548, 500 GB/day $1,265, 1 TB/day $2,480, 2 TB/day $4,800. Monthly figures assume 30 days. Usage above a tier is billed at that tier's per-GB rate. Microsoft publishes further tiers up to 50 TB/day ($102,600/day, $2.05/GB). Subject to Microsoft enterprise agreement discounts and regional surcharges. Always verify with Azure cost management before committing.

M365 free-tier ingestion (the major Sentinel wedge)

A defined set of Microsoft-native sources is free to ingest into Sentinel (per Microsoft's published free-data-sources list). The free-ingest sources are:

  • Azure Activity logs (all customers, no licence required)
  • Office 365 audit logs (Exchange Online, SharePoint Online, OneDrive, Teams)
  • Microsoft Defender XDR security alerts (Defender for Endpoint, Identity, Office 365)
  • Microsoft Defender for Cloud and Defender for Cloud Apps security alerts
  • Microsoft Sentinel health logs

Not free, despite the common assumption: Microsoft Entra ID (Azure AD) sign-in and audit logs, and the raw advanced-hunting tables from Defender for Endpoint and Identity, are billed at the standard per-GB rate. Only the alerts from those products are free, not the underlying raw logs. Microsoft 365 E5 / A5 / F5 / G5 licences include a capped daily data grant (per user) that can offset some of the paid Entra ID and Defender volume.

For Microsoft-shop SOCs the free alert and Office 365 ingestion lowers the SIEM bill versus a comparable Splunk or Elastic deployment ingesting the same data at full per-GB rate. The saving is real but often overstated: the highest-volume Microsoft sources (Entra ID sign-in logs, raw endpoint telemetry) are paid, so free ingestion trims the bill rather than collapsing it. Combined with its native Azure integration, this is a structural reason Sentinel has won broad adoption in Microsoft-centric enterprises despite Splunk's deeper query language and longer market history.

When Sentinel is the right call

Sentinel wins when

  • Microsoft-shop estate (M365, Azure, Defender are bulk of telemetry)
  • Variable log volume and want pay-as-you-go without minimums
  • Azure-native infrastructure where Sentinel-Logic Apps-Notebooks integration replaces SOAR purchase
  • Strong Azure cost-management discipline and existing EA discount
  • Compliance archive needs (Sentinel archive tier is cost-efficient)

Look elsewhere when

  • AWS-shop or GCP-shop where Sentinel pulls cross-cloud data through brittle connectors
  • Splunk-skill team where Sentinel KQL retraining cost is significant
  • Heterogeneous non-Microsoft estate where free M365 ingest does not apply
  • High-query workloads where Splunk Workload Pricing fits better
  • Compliance regimes that require on-premises log control beyond Azure region residency

Related cost references

SIEM Cost Comparison

All vendors

Splunk Cost

Ingest vs workload pricing

IBM QRadar Cost

EPS pricing

SOC Cost Calculator

Full TCO model

Frequently Asked Questions

How much does Microsoft Sentinel cost?
Microsoft Sentinel uses Azure consumption pricing at $4.30 per GB ingested (US East simplified-tier list price). Volume commitment tiers discount this rate: the 50 GB/day tier is $161.25 a day (about $3.23/GB), 100 GB/day works out around $2.96/GB, 200 GB/day around $2.74/GB, 1 TB/day around $2.48/GB. Several Microsoft-native sources are free to ingest: Azure Activity logs, Office 365 audit logs (Exchange, SharePoint, Teams), and the security alerts from Microsoft Defender XDR. Note the common budgeting trap: Microsoft Entra ID (Azure AD) sign-in and audit logs and the raw advanced-hunting tables from Defender for Endpoint and Identity are billed at the standard rate; only the alerts are free. The free alert and Office 365 ingestion is still a differentiator versus Splunk, where the same data would carry full ingest cost.
What logs are free to ingest in Microsoft Sentinel?
The free-ingest sources are Azure Activity logs, Office 365 audit logs (Exchange, SharePoint, Teams), and the security alerts from Microsoft Defender XDR, Defender for Cloud, and Defender for Cloud Apps. The caveat that trips up budgets: Microsoft Entra ID (Azure AD) sign-in and audit logs, and the raw advanced-hunting tables from Defender for Endpoint and Identity, are paid at the standard rate. Only the Defender alerts are free, not the underlying raw logs. M365 E5 / A5 / F5 / G5 licences add a capped daily data grant (per user) that can offset some of the paid Entra ID and Defender telemetry. For a Microsoft-shop SOC the free alert and Office 365 ingestion still cuts the bill versus a third-party SIEM, but the saving is often overstated because the highest-volume Microsoft sources (Entra ID sign-in logs, raw endpoint telemetry) are paid. Non-Microsoft logs (network appliances, third-party SaaS, on-prem servers) are at the standard $4.30/GB rate.
What are the Microsoft Sentinel commitment tiers?
Microsoft publishes commitment tiers for predictable volumes running from 50 GB/day up to 50 TB/day: 50, 100, 200, 300, 400, 500, 1,000, 2,000, 5,000, 10,000, 25,000 and 50,000 GB/day. Each tier discounts the per-GB rate progressively, from $3.23/GB at the 50 GB/day tier down to $2.05/GB at 50 TB/day. You pay the tier's daily price even on days you ingest less, and usage above the committed volume is billed at that tier's effective per-GB rate, not at pay-as-you-go. You can raise a tier at any time but lower it only once every 31 days. On list prices the 50 GB/day tier costs less than pay-as-you-go from 37.5 GB/day upward ($161.25 / $4.30).
Does Microsoft Sentinel include long-term storage?
Analytics-tier data is retained free for the first 90 days. Keeping it in the analytics tier longer costs $0.10/GB/month. For long retention (PCI DSS 12 months, HIPAA documentation for 6 years) the cheaper path is the Microsoft Sentinel data lake: storage is $0.026/GB/month, billed on a flat 6:1 compression ratio (600 GB of raw data bills as 100 GB), and queries cost $0.005 per GB scanned. Tables sent to the data lake only also pay $0.05/GB ingestion and $0.10/GB data processing. Once a workspace is onboarded to the data lake, these meters replace the older long-term retention (archive, $0.02/GB/month), search and auxiliary-logs meters. All prices are US East list from the Azure Retail Prices API, checked 28 October 2026.
Is Microsoft Sentinel leaving the Azure portal?
Yes. Microsoft says that after 31 March 2027 Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. The billing meters above do not change with the portal; the move affects where analysts work, so budget the migration effort for workbooks, automation and access roles rather than a licence change.
When does Microsoft Sentinel beat Splunk on total cost?
Sentinel beats Splunk on TCO in three patterns. (1) Microsoft-shop estates where M365 + Azure + Defender logs are the bulk of telemetry; free ingestion of those logs collapses the cost base. (2) SOCs that want consumption-billing predictability and have variable log volumes (Sentinel's pay-as-you-go has no minimum commitment, unlike Splunk Cloud). (3) Azure-native infrastructure where the Sentinel-Logic Apps-Sentinel Notebooks integration replaces a separate SOAR purchase. Sentinel loses to Splunk on non-Microsoft heterogeneous estates with high-query workloads where Workload Pricing fits.

Microsoft Sentinel rates re-checked against the Azure Retail Prices API (prices.azure.com, US East, simplified pricing tier) on 28 October 2026: Pay-as-you-go Analysis $4.30/GB; 50 GB/day $161.25/day; 100 GB/day $296/day; 200 GB/day $548/day; 500 GB/day $1,265/day; 1 TB/day $2,480/day; 2 TB/day $4,800/day. Per-GB, monthly and annual figures are our arithmetic on those daily rates. Data lake meters from the same feed: ingestion $0.05/GB, data processing $0.10/GB, storage $0.026/GB/month, query $0.005/GB. Interactive retention beyond the included 90 days is $0.10/GB/month and the older archive meter $0.02/GB/month (Log Analytics and Azure Monitor). Overage and tier-change rules, the 6:1 data lake compression and the 31 March 2027 Azure portal date are from Microsoft Learn's Sentinel billing article. No per-customer EA-discounted pricing cited. SecurityOperationsCost.com has no commercial relationship with Microsoft.

Updated 2026-10-28