Blog Post

Core Infrastructure and Security Blog

4 MIN READ

Splitting single-tenant Microsoft Defender XDR Sentinel logs in multiple company scenarios

hspinto

Microsoft

Jan 30, 2026

Introduction Let’s consider a scenario in which a parent holding company – Contoso Group – owns two different companies – Contoso Beverages and Contoso Food – and uses a single, shared, multi-d...

Published Jan 30, 2026

Version 1.0

Microsoft

Joined November 10, 2019

View Profile

Core Infrastructure and Security Blog

Follow this blog board to get notified when there's new activity

paciorkowiec20

Copper Contributor

Feb 10, 2026

Hello,

I have a question, if we will make transformation that will filter out 2/3 of log stream (I assume that every company is generating 33% of logs), then we will pay due to "transformations that filter more than 50% of the ingestion" is paid. Aren't we ?

Also, are Data lake transformations incur costs?

hspinto
Microsoft
Feb 11, 2026
Hello, paciorkowiec20.

Thanks for the question. Workspace transformations in Sentinel are not limited to 50%.

"If Microsoft Sentinel is enabled for the Log Analytics workspace, there's no cost for transformation to Analytics tables regardless of how much data the transformation filters."

See Custom data ingestion and transformation in Microsoft Sentinel | Microsoft Learn and Transformations Azure Monitor - Azure Monitor | Microsoft Learn

Regarding Data Lake transformations, I believe you can't apply transformations to Data Lake tables, but I'll let JoaoFRibeiro confirm.