Fazlur Rahman
Quick Answer
Microsoft Sentinel pricing in 2026 runs on two models: pay-as-you-go at roughly $2.46 per GB ingested, or commitment tiers that lock in daily volume for as little as $1.10 per GB. Commitment tiers start at 100 GB/day (with a 50 GB/day promotional preview available to March 2027) and scale to 50,000 GB/day, saving up to 52 percent versus pay-as-you-go (cipherssecurity.com, July 2026).
The break-even point between PAYG and commitment tiers is roughly 50 GB/day. Above that, commitment tiers almost always win.
Last verified: Sep 15, 2026.
At a glance
- PAYG ~$2.46 per GB (US lower-cost regions, up to $5.13 in Switzerland)
- 50 GB/day commitment (preview) promotional to March 31, 2027
- 100 GB/day commitment $123 per day ($3,690/mo) — $1.23 per GB
- 500 GB/day commitment $585 per day ($17,550/mo) — $1.17 per GB
- 1 TB/day commitment $1,150 per day ($34,500/mo) — $1.15 per GB
- 5 TB/day commitment $5,500 per day ($165,000/mo) — $1.10 per GB
- Defender XDR raw data $0 (free benefit)
Pay-as-you-go versus commitment tiers
Microsoft Sentinel offers two billing models for the analytics tier. Pay-as-you-go is the default; customers pay for every GB ingested at the regional per-GB rate with no commitment and no minimum. Commitment tiers (formerly Capacity Reservations) let customers reserve a fixed daily ingestion volume at a discounted flat rate. Tiers start at 100 GB/day and scale to 50,000 GB/day. Customers pay the tier price every day whether they fill it or not, but the effective per-GB cost drops sharply, and Microsoft advertises savings of up to 52 percent versus pay-as-you-go at larger tiers (Microsoft Sentinel pricing page, 2026).
| Tier or model | What it covers | Effective rate | Best fit |
|---|---|---|---|
| PAYG (Analytics) | Per-GB ingest and analysis | $2.46 per GB | Below 50 GB/day or unpredictable volume |
| 50 GB/day commitment (preview) | Reserved daily capacity | ~$1.30 per GB | Small SOCs between PAYG and 100 GB |
| 100 GB/day commitment | Reserved daily capacity | $1.23 per GB | Mid-market, steady 100 GB/day |
| 500 GB/day commitment | Reserved daily capacity | $1.17 per GB | Large enterprise SOC |
| 1 TB/day commitment | Reserved daily capacity | $1.15 per GB | High-volume enterprise |
| 5 TB/day commitment | Reserved daily capacity | $1.10 per GB | MSSP or very large estate |
| Auxiliary / data lake logs | Low-value high-volume logs | $0.50 per GB | Firewall, proxy, NetFlow noise |
| Defender XDR raw data | Defender alert and raw data | $0 (free) | Any Defender XDR customer |
The math is simple. PAYG at $2.46 per GB means 100 GB/day costs roughly $7,380 per month (100 × 30 × $2.46). The 100 GB/day commitment tier at $123 per day costs about $3,690 per month, about half. The break-even is low: if a customer reliably ingests more than 50 GB/day, a commitment tier almost always wins (cipherssecurity.com, July 2026).
Worked examples at common scales
The realistic mid-market planning line is $3,900 to $4,300 per month at 100 GB/day all-in. The table below shows what the listed commitment tier price translates to per month and per year for ingestion alone, plus the typical all-in monthly figure (cipherssecurity.com, July 2026).
| Daily volume | Daily rate | Monthly ingestion | Annual ingestion | All-in monthly |
|---|---|---|---|---|
| 50 GB/day (preview) | ~$65 per day | ~$1,950 per month | ~$23,400 per year | $2,100 to $2,500 per month |
| 100 GB/day | $123 per day | $3,690 per month | $44,280 per year | $3,900 to $4,300 per month |
| 500 GB/day | $585 per day | $17,550 per month | $210,600 per year | $18,500 to $20,000 per month |
| 1 TB/day | $1,150 per day | $34,500 per month | $414,000 per year | $36,000 to $40,000 per month |
| 5 TB/day | $5,500 per day | $165,000 per month | $1,980,000 per year | $170,000 to $185,000 per month |
The 50 GB/day promotional tier is the cheapest entry point for small SOCs that sit between PAYG and the 100 GB/day tier. The promotional price locks in until March 31, 2027 for customers who sign up between October 1, 2025 and December 31, 2026 (Microsoft Sentinel pricing page, 2026).
Commitment tier rules and downgrade cadence
Customers can raise a commitment tier at any time but can only lower it every 31 days. The safe play is to start one tier below the steady-state volume and bump up as more sources are onboarded. The minimum commitment period before opting out or reducing capacity reservation is 31 days. Lowering the commitment tier is intentionally constrained to prevent commitment gaming (Microsoft Learn, 2026).
Commitment tier changes happen at the start of the next UTC day after the request. Switching from simplified to classic pricing tiers requires meeting eligibility conditions; most new workspaces enabled from July 2023 onwards are automatically set to the simplified pricing experience as the default. Classic tier workspaces can revert by setting the Microsoft.OperationsManagement/solutions SKU name to capacityreservation with a single capacityReservationLevel for both the Log Analytics and Sentinel resources (Microsoft Learn, 2026).
Free data and cost optimization tactics
The Defender XDR raw data free benefit is the single largest cost optimization lever. Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps all write alert and raw data directly into the Microsoft Sentinel workspace at no additional charge. Routing Defender sources through Sentinel rather than a third-party SIEM recovers a meaningful share of the ingestion budget that would otherwise be billed at the per-GB rate (Microsoft Sentinel pricing page, 2026).
Auxiliary logs route low-value high-volume sources (firewall, proxy, NetFlow) to the cheap data lake tier at $0.50 per GB. A reasonable cost optimization splits sources across tiers: Defender XDR raw data and Office 365 audit logs to the free benefit; high-value security events to the analytics tier; firewall and DNS logs to the data lake tier. Routing discipline is the most controllable variable in the monthly Sentinel bill (cipherssecurity.com, July 2026).
