We are excited to announce the new simplified pricing tiers for Microsoft Sentinel. Previously, there were separate prices for Log Analytics and Microsoft Sentinel. Now there is a single combined price for both components which simplifies budgeting, billing, and cost management.
Simplified pricing is rolling out for all regions throughout July. All new Microsoft Sentinel workspaces will automatically be on simplified pricing. All your existing Microsoft Sentinel workspaces will remain unchanged until you decide to move to the simplified price within the portal. You can see the current pricing tier for Log Analytics and Microsoft Sentinel in the portal with the option to switch to the new simplified price.
Based on your specific needs and budget, you have the flexibility to choose the most optimal simplified pricing tier that is best for your workspace. While the pricing will be consistent across models for most customers, a small subset of larger customers may see a difference without a discussion directly with Microsoft. In these cases, Microsoft account teams will be reaching out proactively in July. If you would like to learn more, please reach out to your account teams before switching to simplified price.
We are extending the Microsoft Defender for Server P2 (DfS P2) benefit to the new combined pricing which previously applied to the Log Analytics price, effectively increasing the benefit. Today, DfS P2 customers receive 500MB per VM per day free data benefit for specific security data tables in Log Analytics. With the new simplified pricing the benefit applies to the entire Microsoft Sentinel bill.
We are also moving to a single free trial offer starting July 5th, 2023, for new and existing workspaces that enable Microsoft Sentinel. With this 31-day trial, customers can freely ingest up to 10 GB per day of Microsoft Sentinel and Log Analytics. The other trial with uncapped Microsoft Sentinel ingest will be discontinued. To learn more, see here.
Microsoft Sentinel Pricing Page and Azure Calculator
The pricing page, and the Azure calculator will now only have the simplified pricing to reduce complexity in estimating costs and simplify the overall pricing experience.
For existing customers, we will prefix classic to theseparate pricing tiers (e.g., Classic 100GB/Day Commitment Tier) to help differentiate the prior pricing tiers from the new one.For more information, see Understand your Microsoft Sentinel bill.
Will the total effective cost of Microsoft Sentinel change with the simplified pricing tiers?
No. The cost of each simplified tier is simply the sum of the Azure Monitor Log Analytics and classic Microsoft Sentinel tiers in that region.
How does the simplified pricing tiers impact Microsoft Sentinel pricing for additional capabilities?
All additional capabilities such as Retention, Archive, Search, Microsoft Sentinel solution for SAP applications, Logic Apps, etc. will have no impact and continue as-is.
Can I roll back to the classic Microsoft Sentinel pricing tiers after switching to the new simplified pricing tiers through the portal?
No. This option may be available through ARM calls or with customer support’s assistance.
When moving to simplified pricing, what would happen in the scenario where I currently have mismatched Log Analytics and Microsoft Sentinel tiers (e.g. 500GB commitment tier in Log Analytics and 400GB commitment tier in Microsoft Sentinel)?
If you choose to switch the workspace to simplified pricing, you will need to choose between the 400GB and 500GB simplified tiers depending on your workspace's usage and estimated costs.
We at Microsoft are committed to delivering innovation that helps you secure your organization while achieving business goals with the best-in-class technology and advanced threat protection. To learn more about Microsoft Sentinel see: