Skip navigation

Azure Sentinel pricing

Put cloud-native SIEM and intelligent security analytics to work to help protect your enterprise

Microsoft Sentinel provides intelligent security analytics across your enterprise. The data for this analysis is stored in an Azure Monitor Log Analytics workspace. Microsoft Sentinel is billed based on the volume of data ingested for analysis in Microsoft Sentinel and stored in the Azure Monitor Log Analytics workspace. Microsoft Sentinel offers a flexible and predictable pricing model. There are two ways to pay for the Microsoft Sentinel service: Capacity Reservations and Pay-As-You-Go.

Explore pricing options

Apply filters to customise pricing options to your needs.

Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, and the currency exchange rate. Prices are calculated based on US dollars and converted using Thomson Reuters benchmark rates refreshed on the first day of each calendar month. Sign in to the Azure pricing calculator to see pricing based on your current program/offer with Microsoft. Contact an Azure sales specialist for more information on pricing or to request a price quote. See frequently asked questions about Azure pricing.

Commitment tiers

With Commitment tiers you are billed a fixed fee based on the selected tier, enabling a predictable total cost for Microsoft Sentinel. Commitment tier provides you a discount on the cost based on your selected commitment tier compared to Pay-As-You-Go pricing. You have the flexibility to opt out of the capacity tier any time after the first 31 days of commitment. Prices shown below are related to the analytics enabled by Microsoft Sentinel and do not include the related data ingestion charges for Log Analytics. Please refer to the Azure Monitor Log Analytics pricing for the related data ingestion charges.

Price Tier Price Effective per-GB price1 Savings on pay-as-you-go
100 GB per day $- per day $- per GB $-
200 GB per day $- per day $- per GB $-
300 GB per day $- per day $- per GB $-
400 GB per day $- per day $- per GB $-
500 GB per day $- per day $- per GB $-
1,000 GB per day $- per day $- per GB $-
2,000 GB per day $- per day $- per GB $-
5,000 GB per day $- per day $- per GB $-

1Data ingested into Microsoft Sentinel exceeding the selected daily commitment tier is charged at the effective tier prices listed above.

Pay-as-you-go

With Pay-As-You-Go pricing, you are billed per gigabyte (GB) for the volume of data ingested for analysis in Microsoft Sentinel and stored in the Azure Monitor Log Analytics workspace. Data volume is measured by the volume of data that will be stored in GB (10^9 bytes). Prices shown below are related to the security analytics enabled by Microsoft Sentinel. Prices shown below are related to the analytics enabled by Microsoft Sentinel and do not include the related data ingestion charges for Log Analytics. Please refer to the Azure Monitor Log Analytics pricing for the related data ingestion charges.

Charges for Microsoft Sentinel will go into effect on November 1, 2019.

Feature Price
Microsoft Sentinel $- per GB ingested

Free trial

Try Microsoft Sentinel free for the first 31 days. Microsoft Sentinel can be enabled at no additional cost on an Azure Monitor Log Analytics workspace, subject to the limits stated below.

  • New workspaces can ingest up to 10 GB/day of log data for the first 31-days at no cost. Both Log Analytics data ingestion and Azure Sentinel charges are waived during the 31-day trial period.
  • Existing workspaces can enable Microsoft Sentinel at no additional cost. Only the Microsoft Sentinel charges are waived during the 31-day trial period.

Usage beyond these limits will be charged per pricing listed on this page. Charges related to additional capabilities for automation and bring your own machine learning are still applicable during the free trial.

Data Retention

Once Microsoft Sentinel is enabled on your Azure Monitor Log Analytics workspace, every GB of data ingested into the workspace can be retained at no charge for the first 90 days. Retention beyond 90 days will be charged per the standard Azure Monitor Log Analytics retention prices.

Azure Monitor Log Analytics

Microsoft Sentinel is built on the proven foundation of Azure Monitor Log Analytics platform and enables an extensive query language to analyze, interact with, and derive insights from huge volumes of operational data in seconds. Microsoft Sentinel is billed based on the volume of data ingested for analysis in Microsoft Sentinel and stored in Azure Monitor Log Analytics workspace. Please refer to the Azure Monitor Log Analytics pricing for the related data ingestion charges.

Automation and Bring your own Machine Learning

Microsoft Sentinel integrates with many other Azure services providing enhanced capabilities for Security Information and Event Management (SIEM) and Security Orchestration and Automation and Response (SOAR). Some of these services may have additional charges:

Azure pricing and purchasing options

Connect with us directly

Get a walkthrough of Azure pricing. Understand pricing for your cloud solution, learn about cost optimisation and request a custom proposal.

Talk to a sales specialist

See ways to purchase

Purchase Azure services through the Azure website, a Microsoft representative or an Azure partner.

Explore your options

Additional resources

Azure Sentinel details

Learn more about Azure Sentinel features and capabilities.

Pricing calculator

Estimate your expected monthly costs for using any combination of Azure products.

SLA

Review the service-level agreement for this product.

Documentation

Review technical tutorials, videos and more Azure Sentinel resources.

  • New and existing Microsoft Sentinel customers can import AWS CloudTrail logs for free until June 30, 2020. Applicable data is ingested using the AWS CloudTrail data connector in Microsoft Sentinel.
  • Commitment tiers allow you to reserve a fixed amount of daily data ingestion capacity for Azure Monitor and Microsoft Sentinel for a fixed, predictable daily fee. You can upgrade your requested commitment at any time. However, the minimum commitment period before you can opt out or reduce your capacity reservation is 31 days.

    • Adding more capacity to your commitment tier – You can upgrade your requested commitment at any time. Your new commitment tier will be effective at the start of the next UTC day.
    • Reducing your selected commitment tier – You can reduce your commitment tier or opt out entirely from the commitment tier model after the first 31 days. This 31-day clock resets every time you make any change (increase or decrease) to your selected commitment tier. Your new commitment tier or business model choice will be effective at the start of the next UTC day.
  • You can opt in to a commitment tier at any time. Once you opt in, you will continue to be in your selected commitment tier unless you decide to opt out to a different pricing model or upgrade or downgrade your commitment tier.
  • Commitment tiers are applicable at a workspace level and cannot be grouped across workspaces or subscriptions.
  • Azure Activity Logs, Office 365 Audit Logs (all SharePoint activity and Exchange admin activity) and alerts from Microsoft Defender products (Azure Defender, Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint), Azure Security Center and Microsoft Cloud App Security can be ingested at no additional cost into both Microsoft Sentinel and Azure Monitor Log Analytics.

    Please Note: Azure Active Directory (AAD) audit data is not free and is billed for ingestion into both Microsoft Sentinel and Azure Monitor Log Analytics.

  • Any Azure services that you use in addition to Microsoft Sentinel are charged per their applicable pricing. For example – Log Analytics, Logic Apps, Machine Learning, etc.
  • There are no additional charges for Microsoft Sentinel features that are in preview (indicated by a “Preview” tag) beyond associated data ingestion and retention costs. Pricing for features that are in preview will be announced in the future and a notice will be provided prior to the end of the preview. Should you choose to continue using preview features after the notice period, you will be billed at the applicable rates.

Talk to a sales specialist for a walk-through of Azure pricing. Understand pricing for your cloud solution.

Get free cloud services and $200 in credit to explore Azure for 30 days.

Added to estimate. Press 'v' to view on calculator