Microsoft Sentinel pricing in 2026: PAYG, commitment tiers, and real costs
Independent Sentinel pricing reference. Pay-as-you-go and commitment tier rates, free Microsoft 365 data sources, Basic Logs, archive, and data lake pricing, and head-to-head comparisons against Splunk Cloud at every common volume. Rates re-verified against the Azure retail price list, June 2026.
Commitment tier pricing in full
Microsoft publishes commitment tiers from 100 GB per day up to 50,000 GB per day, plus a promotional 50 GB per day tier in public preview (sign-up window runs to 31 December 2026, with pricing locked until 31 March 2027). The savings compound: every step up reduces the effective per-GB rate. The break-even from PAYG is roughly 38 GB per day for the 50 GB commit and 69 GB per day for the 100 GB commit. All rates East US; workspaces created since July 2023 use the simplified single-meter pricing shown here rather than separate Log Analytics and Sentinel charges.
| Commitment tier | Daily cost | Effective rate | Saving vs PAYG |
|---|---|---|---|
| Pay-as-you-go | - | $4.30/GB | 0% |
| 50 GB/day (promo) | $161.25/day | $3.23/GB | 25% |
| 100 GB/day | $296/day | $2.96/GB | 31% |
| 200 GB/day | $548/day | $2.74/GB | 36% |
| 300 GB/day | $800/day | $2.67/GB | 38% |
| 400 GB/day | $1,037/day | $2.59/GB | 40% |
| 500 GB/day | $1,265/day | $2.53/GB | 41% |
| 1,000 GB/day | $2,480/day | $2.48/GB | 42% |
| 5,000 GB/day | $11,550/day | $2.31/GB | 46% |
| 50,000 GB/day | $102,600/day | $2.05/GB | 52% |
The free data sources that change the maths
Sentinel ingests certain Microsoft data sources free, regardless of commitment tier. For Microsoft 365 organisations on E5 licensing, free ingest can account for 30-50 percent of total log volume.
Third-party log sources (firewalls, SaaS apps, custom apps) always count towards paid ingest. Custom transform rules at the data collection rule (DCR) layer let you drop unwanted fields before billing.
Sentinel cost scenarios
| Scenario | Profile | Licence | Total TCO | Notes |
|---|---|---|---|---|
| Startup | 5 GB/day, PAYG, 90-day retention | $7.8K/yr | $20K-$33K | Free 31-day trial covers initial deployment |
| Mid-market | 50 GB/day, 50 GB commit (promo), 365-day retention | $59K/yr | $200K-$300K | Promotional 50 GB tier beats PAYG from ~38 GB/day |
| Enterprise | 200 GB/day, 200 GB commit, 365-day retention | $200K/yr | $640K-$960K | Commitment tier locks 36 percent savings |
| Microsoft-first enterprise | 500 GB/day inclusive of free M365 logs | ~$115K/yr effective | $390K-$550K | Free M365 data drives effective rate well below PAYG |
| Large enterprise | 1 TB/day, 1,000 GB commit, 365-day retention | $905K/yr | $2.4M-$3.2M | Microsoft Copilot for Security adds 15-25 percent |
Sentinel cost optimisation
Use Basic Logs for high-volume sources
Network firewall logs, NetFlow, and IIS logs ingest at $1.00 per GB instead of $4.30. Detection rules cannot fire from Basic Logs, so keep primary security telemetry in standard tier.
Apply DCR transformations early
Data Collection Rule transforms strip unused fields before they hit the billing meter. Cutting 20-30 percent of bytes per record is normal.
Right-size your commitment tier
Move up tiers as volume grows. Move down at term renewal if it dropped. Microsoft true-ups quarterly, not catastrophically.
Archive after 90 days
Sentinel archive tier costs $0.02 per GB per month. For 365-day retention with 90-day hot, archive saves 80-90 percent on long-tail storage.
Watch UEBA and Notebooks add-ons
Microsoft Sentinel UEBA and the Notebooks integration pull from the same workspace data and have their own consumption metrics.
Microsoft Copilot for Security
SCU-based pricing. Powerful, but easy to overspend on. Cap SCUs at the workspace level and review monthly.