What will Microsoft Sentinel
actually cost you?

The prices are exact — they come from Microsoft’s own retail price API and are refreshed into the site, with the fetch date shown on the page. The volumes are modelled: they are what a typical estate of your shape produces, not a measurement of yours. Expect the total to land within about a third of your real bill if your estate is a normal one, and further out if it is not. Every figure in the tool is editable, so if you already know what a source ingests, type it in and that part stops being an estimate.

Microsoft’s calculator asks how many gigabytes a day you will ingest and prices that. This one works out the gigabytes for you, which is the part nobody can answer at the start of a project. It also models the free meters, the E5 and Defender for Servers data grants, and tier placement — all of which move the real bill and none of which appear if you simply multiply a volume by a rate.

A commitment tier reserves a daily ingestion capacity at a discount of up to roughly half the pay-as-you-go rate, from 50 GB a day upwards. You pay for the tier whether you fill it or not, and anything above it bills at the same discounted rate — so the break-even is lower than most people assume, and the risk of over-committing is smaller than it looks. The calculator tests every tier against your volume and shows the one that wins.

Not free, but subsidised. Microsoft 365 E5, A5, F5 and E5 Security entitle you to 5 MB per user per day of free ingestion across a defined set of security tables. At 2,000 people that is 10 GB a day, which is frequently the difference between two commitment tiers. Separately, Microsoft 365 audit logs, Azure Activity, Entra ID Protection alerts and Defender for Cloud alerts are free to ingest for everybody — a surprising number of estates leave them switched off.

Analytics is the detection surface: full KQL, scheduled analytics rules, UEBA, workbooks and incidents. The data lake is cheap long-horizon storage you query on demand, charged per gigabyte scanned. In UK South a gigabyte costs roughly ninety times more in analytics than in the lake, so moving DNS, firewall and flow logs out of analytics is usually the single largest saving available. It is a judgement rather than a switch, though: you cannot write a scheduled detection rule against a table in the lake.

Because retention is a standing charge on a growing pile, not a charge on the daily flow. A source ingesting 50 GB a day and kept for seven years is holding roughly 123,000 GB beyond the included 90 days, and all of it bills every month. The calculator prices that at interactive retention — data you can query immediately. If you do not need it immediately queryable, moving the table into the data lake prices its storage on a far cheaper meter, and the tool models that when you change the tier.

No. Everything on this page is the Azure bill you pay Microsoft, at list price, and nothing else. What a managed SOC costs on top is a separate conversation and depends on your estate and what you want covered. We publish no rates here because a figure without the estate behind it is a number somebody screenshots into a budget and holds us to.

No. The whole tool runs in your browser and nothing you type is sent to us or stored anywhere — there is no endpoint behind it. We receive what you entered on the unlock form, and that is all. If you want somebody to look at an estimate, use the copy-link or CSV buttons and send it over yourself.