Tools / Security & monitoring

Sentinel Cost Estimator

Model your Microsoft Sentinel bill table by table: Analytics, Basic and Auxiliary plans, the cheapest commitment tier for your volume, and what retention adds.

✓ runs 100% in your browser — no data leaves this page

Table	GB / day	Plan	Total retention (months)

Rates (editable — list prices change and are regional)

Analytics / GB Basic / GB Auxiliary / GB Long-term retention / GB / month

Sentinel is enabled on this workspace (90 days of Analytics retention included instead of 31)

Defaults are ballpark West Europe list prices in EUR, and the commitment-tier discounts below are the approximate published values. Replace them with the numbers from the Azure pricing page for your region and currency — the tier that wins, and the volume where it starts winning, is what transfers.

103

Analytics GB/day

Basic + Auxiliary GB/day

free GB/day

11,177

estimated / month

1,927

saved by committing

✓

Commit to the 100 GB/day tierAt 103 GB/day this saves about 1,927 per month versus pay-as-you-go. Overage above the commitment bills at the same discounted rate, so there's no penalty for a busy day.

W3CIISLog: only 30 days are included on the Basic planRetention past 30 days on Basic and Auxiliary is charged at the same long-term rate as Analytics data, so a cheap ingestion plan with long retention isn't automatically cheap overall. This table is set to 3 months.

Retention adds 58 per monthThis is the steady-state cost of holding data past the included period. If it's compliance-driven rather than investigation-driven, the Sentinel data lake tier is the cheaper home for it — it bills storage at a 6:1 compression ratio and charges per GB scanned instead.

Check your Defender for Servers data grantDefender for Servers Plan 2 includes 500 MB per server per day across a documented set of security tables including SecurityEvent. On a few hundred servers that allowance is a meaningful slice of this estimate, and it isn't modelled here.

Billed volume is smaller than what your devices sendAzure bills the stored column data, not the raw JSON on the wire — Microsoft puts the billed size around 25% below the incoming event size on average, and up to 50% less for small events. If you sized these numbers from a collector's throughput, they're high.

Analytics ingestion	10,918.23 (at the 100 GB/day commitment tier)
Basic ingestion	200.75
Long-term retention	57.64
Total per month	11,176.62
Total per year	134,119.44

Analytics ingestion at every tier

Commitment tiers cover the Analytics plan only — Basic and Auxiliary are always flat per-GB. A tier bills its committed volume whether you use it or not; anything above bills at the same discounted rate.

Tier	Discount	Effective / GB	Per month
Pay-as-you-go	—	4.1	12,844.97
100 GB/day	15%	3.485	10,918.23 ← cheapest
200 GB/day	20%	3.28	19,953.36
300 GB/day	22%	3.198	29,181.78
400 GB/day	23%	3.157	38,410.21
500 GB/day	25%	3.075	46,765.68
1000 GB/day	26%	3.034	92,284.27
2000 GB/day	28%	2.952	179,580.20
5000 GB/day	30%	2.87	436,479.65

Tiers continue above 5000 GB/day (to 50,000), and the Sentinel data lake tier is billed on a separate set of meters entirely — neither is modelled here.

Frequently asked

Are the prices accurate?

They're editable estimates — ballpark West Europe list prices in EUR, and the commitment-tier discounts are the approximate published values. Replace them with the figures from the Azure pricing page for your region and currency. What transfers regardless of the exact rates is the shape: which tier wins, where it starts winning, and which tables dominate the bill.

Which data is free?

Microsoft documents AzureActivity, Office 365 audit activity (SharePoint, Exchange admin, Teams), SentinelHealth and security alerts from the Defender products and Entra ID Protection as free. The raw hunting tables behind those alerts — Defender device events, SigninLogs, non-interactive sign-ins — are all paid, and are usually where the surprise sits.

Why doesn't a commitment tier always save money?

A tier bills its committed volume every day whether you fill it or not, and you can only lower it every 31 days. Below roughly 100 GB/day of Analytics data, pay-as-you-go wins outright — commitment tiers don't start below that.

Does it model the Sentinel data lake?

No. The data lake tier bills on its own meters — ingestion, processing, storage at a 6:1 compression ratio, per-GB query and compute hours — and modelling it honestly needs your query patterns, not just your volumes. This tool covers the Analytics, Basic and Auxiliary plans plus long-term retention.