The pitch vs. the reality
Microsoft Sentinel is positioned as the cost-effective SIEM. Cloud-native. No hardware. Pay only for what you ingest. It sounds good in the sales meeting.
Then the first invoice arrives.
Where the money goes
Sentinel charges per GB of data ingested into the Log Analytics workspace. As of this writing, pay-as-you-go is roughly $2.46/GB. That sounds manageable until you calculate how many gigabytes your environment actually generates.
A 500-endpoint environment with standard Windows event logging, Azure AD sign-in logs, and one or two security products forwarding telemetry can easily generate 50-100 GB per day. That’s $3,700 to $7,400 per month before you’ve written a single detection rule.
The commitment tier trap
Microsoft offers commitment tiers — prepay for a daily ingestion level and get a discount. The problem: if you underestimate your volume, the overage is billed at the full pay-as-you-go rate. If you overestimate, you’re paying for capacity you don’t use.
Getting the commitment tier right requires accurate log volume forecasting, which most organizations don’t have when they first deploy Sentinel.
What actually controls your bill
Three decisions drive most of the cost:
- Which data connectors you enable — Every connector adds log volume. The Azure AD connector alone can generate significant daily ingestion in a large tenant.
- Retention period — Default is 90 days. Beyond that, you’re paying for long-term retention storage.
- Detection rule frequency — Analytics rules that run every 5 minutes query more data than rules that run hourly.
The Charting Cyber recommendation
Before committing to Sentinel, do a 30-day log volume assessment. Enable the connectors you plan to use and measure actual daily ingestion. Then price out the appropriate commitment tier.
If your projected monthly cost exceeds your budget, consider a hybrid approach: Sentinel for cloud-native logs (Azure AD, O365, Defender) and a more cost-effective platform for high-volume sources like firewall and endpoint telemetry.
We help organizations run this assessment. It takes two weeks and saves months of budget surprises.