Microsoft Sentinel Pricing | Microsoft Security (original) (raw)

• Commitment tiers allow you to reserve a set amount of daily data ingestion capacity for Microsoft Sentinel for a fixed, predictable daily fee. You can upgrade your requested commitment at any time. Your new commitment tier will be effective at the start of the next UTC day. However, the minimum commitment period before you can opt out or reduce your capacity reservation is 31 days.
• Commitment tiers are applicable at a workspace level and cannot be grouped across workspaces or subscriptions.
• The analytics tier is ideal for ingesting high-value security data like identity logs, threat intelligence, and endpoint alerts to power real-time detections and investigations. The data lake tier is ideal for high-volume logs like network, firewall, and proxy logs that need long-term retention for forensics and historical analysis.3,4
• Any Azure services that you use in addition to Microsoft Sentinel, such as Azure Log Analytics, Azure Logic Apps, Azure Machine Learning, and solutions, are charged according to their applicable pricing.
• Customers who do not use the data lake should check the Azure Monitor pricing page for legacy Search Jobs, Search Queries, and Log Data Restore details. Learn more.
• MCP server is an out-of-the-box interface that exposes Sentinel platform capabilities to AI agents. MCPs are similar to APIs, but designed specifically for AI agents. MCP tools invoke underlying Sentinel platform services such as data lake queries or graph operations, which are billed based on their respective meters. In addition, the entity analyzer MCP tool may consume Security Compute Units (SCUs) when AI reasoning is required (learn more). Customers are charged only for the underlying platform services and compute they actually use.
• On October 1, 2025, Microsoft announced the public preview of a 50 GB commitment tier for Microsoft Sentinel. Customers can sign up for the 50 GB commitment tier from October 1, 2025, through December 31, 2026. Customers purchasing the 50 GB commitment tier during this timeframe will retain the promotional price until March 31, 2027. Promotional pricing varies by region and is available to all Microsoft Sentinel customers throughout the promotion.2