Sentinel cost control: tiers, commitment and filtering

TL;DR

Sentinel cost control comes down to four levers: what you ingest, which tier it lands in, how long you keep it, and how you pay for the analytics tier. Measure billable ingestion by table first. Filter at the source or in a data collection rule (DCR). Move secondary, high-volume data to the data lake tier only after checking which detections depend on it. Learn says a commitment tier locks you in for 31 days: you can raise it at any time, but lowering it or returning to pay-as-you-go must wait until the period finishes. Learn also says pre-purchase plans are final.

Source and what to verify

Checked on 2026-10-16 against Microsoft Learn and the Sentinel pricing page:

Confirm in your tenant before acting:

Changing the commitment tier. Learn documents Settings > Pricing for the Azure portal experience only, and the pages above give no Defender portal route for it.
Whether Table insights is generally available or in preview. The pages above do not say.
Current per-GB prices. They are not stated in the Learn pages above, so check the pricing page.
The default analytics retention on your tables (see the retention step).

What it is

Sentinel bills on what you ingest and keep. Learn describes two data tiers: Analytics and Data Lake. The analytics tier is billed either pay-as-you-go (the default) or by commitment tier. Commitment tiers start at 100 GB per day, and usage above the commitment is billed at the effective rate of the tier you picked.

The levers, in the order most teams should pull them:

Ingestion volume. Drop what you will never query or alert on.
Tier. Learn’s guidance is to keep primary security data in the analytics tier and put secondary, high-volume data (firewall, proxy, NetFlow logs) in the data lake tier.
Pricing model. Commitment tier, then optionally a pre-purchase plan.

One timing point shapes the runbook. Learn says that after 31 March 2027 Sentinel is available only in the Microsoft Defender portal, and Azure portal users are redirected. Learn also says that for workspaces connected to Defender, tiering and retention must be managed from the table management experience in the Defender portal. Build your process around the Defender portal. Read the retirement wording on Learn and check where your own workspaces stand.

Who is affected

Anyone who owns a Sentinel bill, or the ingestion decisions behind it.
Teams running firewall, proxy or NetFlow logs into the analytics tier.
Anyone planning to buy a pre-purchase plan or commitment tier. Both carry lock-in.

Why it matters

Commitment tiers are sticky. Learn says you can raise a tier at any time, which restarts the 31-day commitment period. Moving back to pay-as-you-go or to a lower tier must wait until that period finishes. Billing is daily.
Tiering changes detections. Learn says moving a table from Analytics to Data Lake stops features that rely on analytics data, including alerting, advanced hunting, analytics rules and custom detection rules.
Billing meters change. Learn says that once a workspace is onboarded to the data lake, usage is billed through the data lake meters (ingestion, processing, storage, query, advanced insights) rather than the old long-term retention, search or auxiliary logs ingestion meters. Storage is billed at a 6:1 compression rate.
Not everything is billable. Learn lists some free sources, including AzureActivity, SentinelHealth, OfficeActivity (SharePoint, Exchange, Teams) and Defender alerts (SecurityAlert, SecurityIncident). It also says raw logs for some Defender XDR and Entra ID data types are paid. Do not assume a Microsoft first-party source is free.
Pre-purchase plans are final. Learn says purchases are final, with no cancellations or exchanges, and a plan cannot be split or merged.

Decide before you change anything

Question	What the sources support
Is ingestion steady at 100 GB/day or more?	A commitment tier is worth pricing. The pricing page gives 100 GB to 50,000 GB per day, and says a 50 GB tier is in public preview.
Is volume below that or unpredictable?	Stay on pay-as-you-go, the default.
Is the data primary security data used by detections?	Keep it in the analytics tier.
Is it high-volume secondary data (firewall, proxy, NetFlow)?	Candidate for the data lake tier, after a dependency check.
Are you considering a pre-purchase plan alongside a commitment tier?	Learn says pre-purchase plans work alongside commitment tiers, but cover analytics tier costs only.
Is ingestion near 100 GB/day and heavy?	Learn says dedicated clusters can be considered at that volume. They have limits (below).

Runbook

Baseline billable ingestion by table
Learn gives a query on the Usage table, filtered to billable data and summarised by data type. Run it in the Log Analytics workspace behind Sentinel:
KQL
```
Usage
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000. by bin(StartTime, 1d), DataType
```
Learn also points to the Workspace Usage Report workbook, which breaks ingestion down by table. Rank tables by daily GB and work from the top. Add a time range appropriate to your review period.
Filter at the source and in the DCR
For the Windows Security Events connector, Learn says DCRs filter at the source on the Azure Monitor Agent. You choose predefined sets (All events, Minimal, Common) or custom event filters, and only the selected events are ingested. The Learn pages listed above do not give the connector’s setup steps or custom filter syntax, so follow the current connector page before you change a production DCR.
For ingestion-time transformations, Learn gives two sample KQL expressions. The first keeps only matching rows. Records that do not match are not sent to the destination:
KQL
```
source | where severity == "Critical"
```
The second removes a column you do not need:
KQL
```
source | project-away RawData
```
These are Learn’s samples. The column names must match your own table schema. Test against a pilot DCR first.
Learn adds two cost notes. With Sentinel enabled on the workspace, there is no charge for transformations on Analytics tables, however much they filter. Without Sentinel, dropping more than 50% of incoming data incurs a processing charge. For Auxiliary tables, data processing is charged on all incoming data.
Two limits to remember. A workspace transformation DCR covers sources that do not use a DCR, there can be only one per workspace, and Learn says it is ignored for data sent by the Azure Monitor Agent. Multi-stage transformations, which can filter syslog by facility on the client (for example keeping only auth and authpriv), are in public preview.
Choose the tier for each noisy table
In the Defender portal, go to Microsoft Sentinel > Configuration > Tables, select the table and choose Manage table.
Before you move anything to Data Lake:
- List every analytics rule, custom detection rule and hunting query that reads the table. Learn says these stop working after the move.
- Learn also says some tables cannot change tier.
- Basic Logs tables can be viewed in the Defender portal, but Learn says they are currently managed only from the Log Analytics workspace. To manage one in the Defender portal, change its table plan from Basic Logs to Analytics.
Permissions: Learn lists Microsoft Sentinel Contributor plus Log Analytics Contributor at workspace scope. With unified RBAC, you need Data (manage) under Data operations.
Set retention deliberately

On the same Manage table page, set retention per table. Learn gives these ranges: analytics retention from 30 days to two years, total retention up to 12 years, and data lake tier retention from 30 days to 12 years.
Microsoft’s own pages differ on the analytics default. The log retention tiers page says 90 days of interactive retention by default, extensible to two years. The data tiers overview says analytics retention defaults to 30 days for Sentinel and Defender XDR in the Defender portal. Check the value shown on your own tables rather than assuming either.
Two cost notes from Learn. Sentinel solution tables can be extended to 90 days for free. Extending Defender XDR table retention to 31–90 days in the analytics tier incurs Sentinel ingestion charges but no storage charge.
Choose the pricing model
Microsoft’s published pages give no Defender portal route for changing the commitment tier, so this step cannot be completed from the Defender portal on that evidence. Learn documents only Settings > Pricing in the Azure portal experience for viewing and changing the pricing tier, and says you need Contributor or Owner on the workspace. Learn also says Azure portal users are redirected after 31 March 2027, so do not treat the Azure portal path as a long-term process.
Fallback:
- If your workspace offers Settings > Pricing in the Azure portal experience, make the change there and record the date and approver.
- If you are working only in the Defender portal and the Azure portal path is not available to you, leave the pricing model as it is. Microsoft has not said where the change moves to, so check your tenant’s Message Center for any announcement before you try again.
- Do not guess at a menu path. The commitment tier carries a 31-day lock, so a wrong change is expensive to undo.
Before you commit, read the 31-day rule above. Raising the tier restarts the period. Lowering waits for it to finish.
If you consider a dedicated cluster, Learn gives these limits: two clusters per region per subscription, and a workspace can be linked to a cluster only twice in 30 days.
A pre-purchase plan is a separate decision. Learn says it is bought as commit units (SCUs) on a one-year term, auto-renews by default, covers analytics tier costs only, and does not cover data lake costs. Eligible usage is the Sentinel service entries on the invoice. Azure Monitor tiers, retention, restore and search costs are excluded. Purchase is in the Azure portal under Reservations > Purchase reservations > Microsoft Sentinel Pre-Purchase Plan, and for a subscription needs Owner or Reservation Purchaser. Learn says only scope and ownership can be changed after purchase.
Set up monitoring and alerts
- Table insights (Defender portal, Tables page) shows top tables by daily ingestion, ingestion fluctuations, last data received and estimated daily cost. Learn says the cost estimate uses list price and ignores commitment-tier discounts, reservations and private pricing. Learn also says it is a visualisation surface for investigation, not a billing-grade or alerting surface.
- Fluctuation defaults are a 10 percent change and 1 MB absolute change, and Learn says tables below 1 MB per day are not evaluated.
- Alerting needs a scheduled analytics rule on SentinelHealth or Usage, per Learn.
- Budgets: Cost Management budgets and alerts can be created for Azure subscriptions and resource groups. Learn also mentions a community playbook, Send-IngestionCostAlert, that alerts on ingestion volume.
- Data lake usage: in the Defender portal, Sentinel Cost management (preview) covers data lake usage. Viewing needs Security Reader. Setting limits and alerts needs Billing Administrator or Security Administrator. Learn says enforcement can take up to four hours to apply.

For an example of getting SailPoint ISC logs into Sentinel, see the SailPoint ISC to Sentinel collector post.

Checks

You have a ranked list of billable tables by daily GB, from the Usage query or the Workspace Usage Report workbook.
Every table moved to Data Lake has a recorded list of dependent rules and queries, and those have been reviewed.
DCR changes were piloted, and the filtered events are ones you have agreed you do not need.
Retention on each tier-changed table matches what you intended, and you have checked the default on your own tables.
The commitment tier decision records the 31-day lock and who approved it.
A scheduled analytics rule, budget or both will tell you when ingestion spikes, and someone owns the alert.
Pre-purchase plan scope, owner and auto-renew setting are recorded, if you bought one.
Your Message Center and Learn checks cover the Azure portal to Defender portal move for Sentinel.

Rollback

Commitment tier: raise at any time. Lowering, or returning to pay-as-you-go, must wait until the 31-day period ends.
Retention: Learn says shortening a table’s total retention is reversible for 30 days, because Microsoft waits 30 days before removing the data. Revert within that window to avoid data loss.
Table tier: Learn says tier changes can be made at any time, but moving off the analytics tier stops features that rely on analytics data. Before you move a table back, check in your tenant what happens to the data ingested while it sat in the other tier.
DCR filtering: Learn says non-matching records are not sent to the destination.
Pre-purchase plan: no rollback. Purchases are final.

Common pitfalls

Raising a commitment tier “to see”. It restarts the 31-day period.
Moving a table to the data lake tier and breaking detections. Check analytics rules, hunting and custom detection rules first.
Trusting Table insights for billing. Its estimate uses list price and ignores commitment discounts.
Expecting a pre-purchase plan to cover the data lake. Learn says it does not.
Filtering the wrong data. A where or project-away that suits Learn’s sample may drop fields your detections use.
Assuming a workspace transformation DCR catches Azure Monitor Agent data. Learn says it is ignored for that data.
Managing tiers in the Azure portal after the move. For workspaces connected to Defender, Learn says tiering and retention must be managed in the Defender portal.
Quoting prices from memory. Use the pricing page.

Sentinel cost control: tiers, commitment and filtering

What it is

Who is affected

Why it matters

Decide before you change anything

Runbook

Baseline billable ingestion by table

Filter at the source and in the DCR

Choose the tier for each noisy table

Set retention deliberately

Choose the pricing model

Set up monitoring and alerts

Checks

Rollback

Common pitfalls