SOLVED

Azure Sentinel minimum bill

%3CLINGO-SUB%20id%3D%22lingo-sub-1358227%22%20slang%3D%22en-US%22%3EAzure%20Sentinel%20minimum%20bill%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1358227%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20minimum%20bill%20for%20Azure%20Sentinel%3F%26nbsp%3B%20If%20I%20ingest%20something%20like%20500MB%2Fday%20do%20I%20pay%20the%20%242.00%2FGig%20rate%20for%20East%20US%20or%20is%20it%20prorated%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1358385%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20minimum%20bill%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1358385%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20pay%20per%20GB%2Fday%2C%20so%20if%20you%20send%20500MB%20(0.5GB)%20you%20pay%20for%20that%20at%20whatever%20%24%20rate%20your%20workspace%20region%20is%20in%20(EAST%20US%2C%20West%20Europe%20etc...).%26nbsp%3B%20If%20you%20stop%20sending%20after%20500MB%2C%20then%20that's%20all%20you%20pay%20that%20day.%26nbsp%3B%20Free%20data%20sources%2C%20wouldn't%20be%20part%20of%20the%20500MB%20you%20ingest.%26nbsp%3B%20You%20can%20send%20it%20all%20at%20once%20(500MB)%20or%20throughout%20the%20day%2C%20the%20price%20is%20the%20same%2C%20as%20only%20500MB%20of%20billable%20data%20has%20been%20sent.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fen-gb%2Fpricing%2Fdetails%2Fazure-sentinel%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fen-gb%2Fpricing%2Fdetails%2Fazure-sentinel%2F%3C%2FA%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%3CSTRONG%3E%22With%20pay-as-you-go%20pricing%2C%20you%20are%20billed%20per%20gigabyte%20(GB)%20for%20the%20volume%20of%20data%20ingested%20for%20analysis%20in%20Azure%20Sentinel%20and%20stored%20in%20the%20Azure%20Monitor%20Log%20Analytics%20workspace.%26nbsp%3B%22%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1359796%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20minimum%20bill%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1359796%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BThanks.%26nbsp%3B%20That%20is%20what%20I%20thought%20but%20it%20is%20never%20expressly%20spelled%20out%20anywhere.%26nbsp%3B%20Didn't%20know%20if%20it%20was%20billed%20in%201G%20increments%20or%20not.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1359835%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20minimum%20bill%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1359835%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGreat%20question%2C%20the%20underlying%20data%20as%20stored%20in%20the%20Usage%20table%20and%20the%20individual%20tables%20(Perf%2C%20Events%2C%20Syslog%20etc...)%2C%20store%20the%20information%20in%20Bytes.%26nbsp%3B%20So%20I%20suspect%20we%20do%20it%20at%20that%20level%2C%20I'll%20try%20and%20find%20out.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMy%20suspicion%2C%26nbsp%3B%20example%20using%20a%20fake%20rate%20of%20%241%20per%20GB%2C%20and%20you%20send%200.5Gb%20then%20you'll%20be%20billed%20%240.50.%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1385356%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20minimum%20bill%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1385356%22%20slang%3D%22en-US%22%3EHi%2C%20We%20do%20bill%20on%20the%20actual%20bytes%20ingested%2C%20%22GB%20per%20day%22%20is%20just%20easier%20to%20understand.%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1386085%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20minimum%20bill%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1386085%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BThanks%20for%20the%20confirmation%3C%2FP%3E%3C%2FLINGO-BODY%3E
Valued Contributor

Is there a minimum bill for Azure Sentinel?  If I ingest something like 500MB/day do I pay the $2.00/Gig rate for East US or is it prorated? 

5 Replies
best response confirmed by Gary Bushey (Valued Contributor)
Solution

Hi @Gary Bushey 

 

You pay per GB/day, so if you send 500MB (0.5GB) you pay for that at whatever $ rate your workspace region is in (EAST US, West Europe etc...).  If you stop sending after 500MB, then that's all you pay that day.  Free data sources, wouldn't be part of the 500MB you ingest.  You can send it all at once (500MB) or throughout the day, the price is the same, as only 500MB of billable data has been sent.

 

https://azure.microsoft.com/en-gb/pricing/details/azure-sentinel/

"With pay-as-you-go pricing, you are billed per gigabyte (GB) for the volume of data ingested for analysis in Azure Sentinel and stored in the Azure Monitor Log Analytics workspace. "

  

@CliveWatson Thanks.  That is what I thought but it is never expressly spelled out anywhere.  Didn't know if it was billed in 1G increments or not.

@Gary Bushey 

 

Great question, the underlying data as stored in the Usage table and the individual tables (Perf, Events, Syslog etc...), store the information in Bytes.  So I suspect we do it at that level, I'll try and find out.

 

My suspicion,  example using a fake rate of $1 per GB, and you send 0.5Gb then you'll be billed $0.50.   

Hi, We do bill on the actual bytes ingested, "GB per day" is just easier to understand.

Thanks

@CliveWatson Thanks for the confirmation