SOLVED

Pricing for Office 365 audit log

%3CLINGO-SUB%20id%3D%22lingo-sub-3514405%22%20slang%3D%22en-US%22%3EPricing%20for%20Office%20365%20audit%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3514405%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EI%20am%20using%20the%20Sentinel%20to%20collect%20the%20office%20365%20audit%20log%20via%20the%20Office%20365%20data%20connector.%3C%2FP%3E%3CP%3EAccording%20to%20this%20document%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fbilling%3Ftabs%3Dcommitment-tier%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EPlan%20costs%20for%20Microsoft%20Sentinel%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FP%3E%3CP%3EOffice%20365%20Audit%20Logs%2C%20including%20all%20SharePoint%20activity%2C%20Exchange%20admin%20activity%2C%20and%20Teams%20are%20free%20data%20sources.%3C%2FP%3E%3CP%3EFrom%20the%20Microsoft%20cost%20calculator%2C%20the%20Sentinel%26nbsp%3Bcalculator%20mainly%20charges%26nbsp%3BAzure%20Monitor(data%20ingestion)%20and%20Sentinel(data%20analysis)%20costs.%20If%20I%20create%20a%26nbsp%3BLog%20Analytics%20Workspace%20and%20Sentinel%20only%20for%26nbsp%3BOffice%20365%20Audit%20Logs.%20It%20should%20be%20completely%20free%20for%20both%20parts%20(Azure%20Monitor%20and%20Sentinel)%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3514405%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3514691%22%20slang%3D%22en-US%22%3ERe%3A%20Pricing%20for%20Office%20365%20audit%20log%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3514691%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F792449%22%20target%3D%22_blank%22%3E%40CyrilChu%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EData%20in%20the%20OfficeActivity%20table%20is%20non%20billable%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Clive_Watson_0-1655368878657.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Clive_Watson_0-1655368878657.png%22%20style%3D%22width%3A%20370px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F380872i06E06EA36C754F36%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Clive_Watson_0-1655368878657.png%22%20alt%3D%22Clive_Watson_0-1655368878657.png%22%20%2F%3E%3C%2Fspan%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3ESo%20providing%20you%20dont%20enable%20a%20paid%20source%20or%20UEBA%2C%20or%20run%20a%20Playbook%2FNotebook%2C%20or%20archive%2Fstore%26nbsp%3B%20the%20data%20beyond%203months%20(default%20retention)%2C%20billing%20should%20be%20free.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

I am using the Sentinel to collect the office 365 audit log via the Office 365 data connector.

According to this document, Plan costs for Microsoft Sentinel | Microsoft Docs

Office 365 Audit Logs, including all SharePoint activity, Exchange admin activity, and Teams are free data sources.

From the Microsoft cost calculator, the Sentinel calculator mainly charges Azure Monitor(data ingestion) and Sentinel(data analysis) costs. If I create a Log Analytics Workspace and Sentinel only for Office 365 Audit Logs. It should be completely free for both parts (Azure Monitor and Sentinel)?

1 Reply
best response confirmed by CyrilChu (Occasional Contributor)
Solution

@CyrilChu 

 

Data in the OfficeActivity table is non billable

 

Clive_Watson_0-1655368878657.png

So providing you dont enable a paid source or UEBA, or run a Playbook/Notebook, or archive/store  the data beyond 3months (default retention), billing should be free.