SOLVED

Sentinel Licensing Requirements

%3CLINGO-SUB%20id%3D%22lingo-sub-1519743%22%20slang%3D%22en-US%22%3ESentinel%20Licensing%20Requirements%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1519743%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20looking%20to%20find%20out%20what%20the%20minimal%20requirements%20are%20with%20respect%20to%20M365%20for%20clients%20to%20be%20able%20to%20run%20Sentinel%20in%20their%20Azure%20Tenant.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1519864%22%20slang%3D%22en-US%22%3ERe%3A%20Sentinel%20Licensing%20Requirements%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1519864%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F450308%22%20target%3D%22_blank%22%3E%40Gtiminski%3C%2FA%3E%26nbsp%3BThere's%20really%20no%20licensing%20for%20Azure%20Sentinel%20itself.%20Instead%2C%20make%20sure%20your%20licensing%20for%20the%20services%20that%20contain%20the%20data%20you%20want%20connect%20to%20Azure%20Sentinel%20is%20licensed%20appropriately.%20For%20example%2C%26nbsp%3Bto%20export%20sign-in%20data%20from%20Azure%20AD%2C%20you%20need%20an%20Azure%20AD%20P1%20or%20P2%20license.%20So%2C%20at%20minimum%2C%20you%20would%20want%26nbsp%3BMicrosoft%20365%20E3%20which%20includes%20P1.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2053267%22%20slang%3D%22en-US%22%3ERe%3A%20Sentinel%20Licensing%20Requirements%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2053267%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3Banswered%20it%20but%20it's%20good%20to%20call%20out%20the%20%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fpricing%2Fdetails%2Fazure-sentinel%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eusage%20based%20pricing%20for%20Azure%20Sentinel%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

I am looking to find out what the minimal requirements are with respect to M365 for clients to be able to run Sentinel in their Azure Tenant.

2 Replies
Best Response confirmed by eliaspinto (Microsoft)
Solution

@Gtiminski There's really no licensing for Azure Sentinel itself. Instead, make sure your licensing for the services that contain the data you want connect to Azure Sentinel is licensed appropriately. For example, to export sign-in data from Azure AD, you need an Azure AD P1 or P2 license. So, at minimum, you would want Microsoft 365 E3 which includes P1.

@rodtrent answered it but it's good to call out the usage based pricing for Azure Sentinel