Microsoft Sentinel pricing is per gigabyte the Log Analytics workspace ingests and Sentinel analyses, Defender for Cloud prices each plan per protected resource and hour or month, and Key Vault charges operations per 10,000 calls plus HSM-protected keys per key and month. Sentinel's data volume dominates almost every bill, because each ingested gigabyte pays for ingestion and analysis at once; the Defender plans scale with the number of servers and databases, and Key Vault stays small unless a Managed HSM pool runs around the clock.
Pricing dimensions
One trait is shared by all three services: almost none of it is a reservation or a savings plan. The only commitment form is the commitment tier of Sentinel and Log Analytics; everything else is consumption per day, per hour or per operation.
| Service and dimension | Unit | What drives it | Where it is optional |
|---|---|---|---|
| Sentinel, analytics data on the simplified pricing tier | GB per day, ingestion and analysis on one meter | connected data sources, tables kept on the analytics plan | workspaces created before July 2023 may keep the classic tier, where Log Analytics bills ingestion and Sentinel bills analysis separately |
| Sentinel, commitment tier | fixed daily charge per tier, overage at the tier's effective rate | the tier chosen (the API lists 50 GB to 50,000 GB per day) | optional; raise any time, lower only every 31 days |
| Sentinel, basic and auxiliary logs | GB | tables on the cheaper plans with limited querying | chosen per table |
| Sentinel data lake | GB ingested, GB processed, GB-month stored (billed at 6:1 compression), GB scanned by queries, compute hour for notebooks and graphs | tables kept only in the lake tier, long retention, KQL jobs | optional; replaces the earlier archive and search meters |
| Sentinel, retention | GB-month beyond 90 days at the Log Analytics retention price | retention per table | the first 90 days are included |
| Sentinel, free data sources | zero | Azure Activity, Office 365 audit, SecurityAlert and SecurityIncident from the Defender products | the raw logs of the same products stay paid |
| Defender for Servers Plan 1 and Plan 2 | node per hour | VMs and Arc-enabled servers in the subscription | per subscription and plan; Plan 2 brings an allowance of 500 MB of security data per node and day |
| Defender for Storage | storage account per hour, transactions per million, malware scanning per GB | number of accounts, transaction and upload volume | malware scanning can be switched off per account |
| Defender for SQL and databases | instance per hour, node per month, vCore per hour; Cosmos DB per 100 RU/s and hour; MySQL and PostgreSQL node per month | databases and servers, provisioned RU/s | enabled per database type |
| Defender for Containers | vCore of cluster nodes per hour, images scanned each | cluster size, registry scans | per subscription |
| Defender for App Service, Resource Manager, Key Vault | node per hour | instances in the App Service plan, subscriptions, vaults | per plan; foundational CSPM is free |
| Key Vault, operations | per 10,000 operations, advanced key types (RSA 3072 and 4096, ECC) at a higher rate | every successfully authenticated REST call | Standard and Premium cost the same here |
| Key Vault, HSM-protected keys | key per month, only keys active in the last 30 days, every version counts as a key; advanced types tiered at 250, 1,500 and 4,000 keys | number of key versions | Premium only |
| Key Vault, rotation and renewal | per scheduled rotation, per certificate renewal request | rotation policies, certificates from public CAs | optional |
| Managed HSM | pool per hour (Standard B1) | how long the pool exists, regardless of key count | a separate single-tenant service |
| Entra ID P1 and P2 | per user per month on an annual subscription (the pricing page shows 7 and 10 dollars) | licensed users | not Azure consumption; the boundary of this page, see identity and security services |
| Purchase options | commitment tiers for Sentinel and Log Analytics, no reservations | a steady daily volume | choosing between commitment types |
How it appears in your billing data
Every export row carries a meter with MeterCategory, MeterSubCategory and MeterName; the Retail Prices API lists the same names as serviceName, productName and meterName. For the three services:
| Service | MeterCategory and ProductName | Typical MeterName values |
|---|---|---|
| Sentinel, simplified tier | Sentinel | Pay-as-you-go Analysis, 100 GB Commitment Tier Capacity Reservation, Analysis for the overage, Basic Logs Analysis, Auxiliary Logs Analysis, Free Benefit - M365 Defender Analysis |
| Sentinel, data lake and graph | Sentinel | Data lake ingestion Data Processed, Data processing Data Processed, Data lake storage Data Stored, Data lake query Data Analyzed, Advanced Data Insights, Graph |
| Sentinel, classic tier | Sentinel plus Log Analytics and Azure Monitor | Classic Analysis, Classic Auxiliary Logs Analysis; beside them Pay-as-you-go Data Ingestion under Log Analytics and n GB Commitment Tier under Azure Monitor |
| Defender for Cloud | Microsoft Defender for Cloud; the plan sits in ProductName, such as Microsoft Defender for Servers, Microsoft Defender for Storage, Microsoft Defender for SQL, Microsoft Defender for Containers | Standard P1 Node, Standard P2 Node, Standard P2 Node - MDATP Benefit, Standard Node, Standard Transactions, Malware Scanning Data Ingested, Standard Instance, Standard vCore, Standard vCore vCore Pack, Standard Images |
| Key Vault | Key Vault with ProductName Key Vault (Standard or Premium) or Key Vault HSM Pool | Operations, Advanced Key Operations, Premium HSM-protected RSA 2048-bit key, Premium HSM-protected Advanced Key (four tiers), Automated Key Rotation, Certificate Renewal Request, Secret Renewal, Standard B1 Instance |
Three things land on other meters. Ingestion through the Azure Monitor agent and retention beyond 90 days sit on Log Analytics, whose prices the page on Azure Monitor and Log Analytics holds. The data allowance of Defender for Servers Plan 2 never reaches the invoice because it costs nothing, but it does appear in the export as its own zero-cost rows, as does the Defender XDR benefit. Sentinel playbooks and connectors run as Logic Apps and Azure Functions with their own meters, and the storage accounts behind exports show up under Blob Storage.
In the FOCUS export, ServiceName groups resources by Microsoft's own mapping, x_SkuMeterCategory, x_SkuMeterSubcategory and SkuMeter carry the Azure meter names, and ChargeCategory is Usage for every meter named here, including the commitment tiers, which are billed as daily meters rather than purchases; PricingCategory stays Standard. How the export is set up and which columns the two formats carry is covered under Azure cost exports and FOCUS columns.
Levers
Configuration. The biggest lever is what reaches the analytics plan at all: high-volume, low-value tables belong on basic, auxiliary or the lake tier, and data collection rules filter before ingestion; the mechanics are in observability, logging and monitoring. In the Defender connectors, the free alert tables can be enabled without the paid raw logs. Defender plans are switched per subscription and bill every node, including those in development and test subscriptions; where they are not needed, switch them off, and the rule for that belongs in cost governance policies. In Key Vault every key version counts as a key: rotation policies with short intervals multiply HSM-protected keys, and a Standard vault is enough wherever software-protected keys suffice.
Purchase option. Once the workspace steadily ingests more than the lowest tier, a commitment tier lowers the effective price per GB; the tier can be raised at any time and lowered only every 31 days, so it belongs in the commitment strategy rather than in a spontaneous decision. For nodes with the MDATP benefit the API lists a separate, cheaper Plan 2 meter.
Architecture. One workspace per tenant pools the volume into one tier instead of keeping several workspaces below the threshold. The 500 MB allowance of Plan 2 applies to the sum of all nodes of a subscription in the workspace, so a few chatty servers are balanced by many quiet ones. Managed HSM pays off only where a single-tenant HSM is required; a pool costs per hour whether it holds ten keys or none, and empty test pools are a case for idle and orphaned resources.
Where it goes wrong
- Two line items for one gigabyte. On the classic tier, ingestion sits under
Log Analyticsand analysis underSentinel; whoever looks at one of them underestimates the price per GB by about half. The pricing tier is shown in the Sentinel settings. - A commitment tier above the volume. The daily charge accrues regardless of the actual volume, and the tier can be lowered only every 31 days. Read the daily volume of the past weeks from the export before choosing.
- Raw logs instead of alerts. Alerts from Defender XDR, Defender for Endpoint or Entra ID Protection are free, their raw logs are not. Check which data types the connector has enabled.
- Defender nodes in every subscription. A plan covers all resources of the subscription, including test servers that run for hours. Group by
ProductNameand subscription. - Transactions and malware scans in Defender for Storage. Both grow with upload volume, not with the number of accounts; set the scanning cap.
- Key versions in Key Vault Premium. Every version of an HSM-protected key used in the last 30 days costs the monthly price, not a prorated share. Check rotation intervals and old versions.
- A forgotten HSM pool. Managed HSM bills the hour, not the key; a pool from a proof of concept keeps running.
- Entra ID expected on the Azure bill. P1 and P2 are user licences and never appear in the Azure cost export.
Example
Germany West Central, EUR list prices from the Azure Retail Prices API, read on 2026-10-21. Sentinel on the simplified tier charges EUR 4.919 per GB (Pay-as-you-go Analysis), plain Log Analytics ingestion without Sentinel EUR 2.6311 per GB (Analytics Logs Data Ingestion); Sentinel therefore adds EUR 2.2879 to the gigabyte, close to doubling it. The 100 GB per day tier costs EUR 336.8884 per day on Sentinel, which by Microsoft's own method is EUR 3.3689 per GB, and EUR 222.4921 per day or EUR 2.2249 per GB on Azure Monitor without Sentinel. Sentinel analyses basic logs for EUR 1.012 per GB, and the data lake ingests for EUR 0.0572 per GB, stores for EUR 0.0211 per GB-month and queries for EUR 0.0057 per GB scanned. Defender for Servers costs EUR 0.0059 (Plan 1) and EUR 0.0176 (Plan 2) per node-hour, Defender for Storage EUR 0.0118 per account-hour plus EUR 0.1313 per million transactions and EUR 0.132 per GB scanned, Defender for SQL EUR 0.0177 per instance-hour, Defender for Containers EUR 0.0083 per vCore-hour plus EUR 0.2552 per image, Defender for App Service EUR 0.0176 per node-hour. Key Vault charges EUR 0.0264 per 10,000 operations and EUR 0.132 per 10,000 operations with advanced key types, EUR 0.88 per HSM-protected RSA 2048 key and month, advanced HSM keys tiered at EUR 4.3999 for the first 250, EUR 2.1999 up to 1,500, EUR 0.792 up to 4,000 and EUR 0.352 beyond, EUR 0.88 per automated rotation and EUR 2.6399 per certificate renewal; a Managed HSM Standard B1 pool costs EUR 2.8159 per hour. The figures show that Sentinel's data volume carries the bill and that a single HSM pool costs more than thousands of vault operations.
Sources
Read on 2026-10-21. Microsoft Learn: Plan costs and understand pricing and billing, Microsoft Sentinel, Use the data ingestion benefit in Microsoft Defender for Cloud, Microsoft Defender for Cloud overview, Azure Key Vault overview, Azure Key Vault Managed HSM overview, Azure Key Vault pricing (tiers and billing rules), Microsoft Entra pricing, Understand usage details fields, FOCUS cost and usage details file schema, Update reports to use FOCUS columns. Prices: Azure Retail Prices API, EUR, Germany West Central, for Sentinel, Microsoft Defender for Cloud, Key Vault, Log Analytics and the Azure Monitor commitment tiers; the API documents its filters at Azure Retail Prices REST API.