Saving on Sentinel

Microsoft Sentinel costs can rapidly become expensive. Organizations have a few potential opportunities to save, if they plan carefully, and have licensed the rest of Microsoft’s security stack.

Commitment Tiers Can Save When Costs Are Clear

Costs can become very expensive if large volumes of event data are ingested into Sentinel. Commitment tiers, which obligate an organization to purchase a 31-day period of predefined large volume consumption in exchange for a service discount, are available for both Microsoft Sentinel and Log Analytics in large daily increments of up to 5TB. Organizations should not purchase capacity reservations for either service until they have assessed their low-water mark of data ingestion into both services to avoid wasting money on unused capacity. 

Free Ingestion for Some Microsoft Services

A small set of Microsoft event sources can be ingested for free into both Log Analytics and Microsoft Sentinel, including Azure Activity Logs, Office 365 Audit Logs, Microsoft Defender XDR services, Microsoft Defender for Cloud services, and Microsoft Sentinel Health.