Microsoft Sentinel – Optimise costs

Last Updated: 20/01/2025

Microsoft Sentinel has certainly created waves in the market as being a formidable SIEM solution. However as with any cloud service, costs can ramp up quickly. But, just like all cloud services there are ways to optimise costs. Microsoft recently added in a new way of further optimising the costs of Microsoft Sentinel with Pre-Payment Plans, so let’s explore what this looks like and how to take advantage of it!

The below runs through the different pricing options for the ingestion costs. Please note that this will focus on the ingestion costs and not the retention, archive, search & restoration costs. 

PAYG (Pay-As-You-Go)

This is the default pricing tier of Microsoft Sentinel. With PAYG (Pay-As-You-Go) pricing, you are billed per GB (gigabyte) of data ingested into Microsoft Sentinel. The price per GB can be found here. As an example, today’s pricing for Microsoft Sentinel in the UK South Datacentre in GBP is: £4.28 per GB.

This pricing model is easy enough to understand, however it can appear quite expensive, especially in bigger environments ingesting larger amounts of data.

Commitment Tiers

Commitment Tiers allows you to commit to an amount of GB per Day, starting at 100GB per day. They offer a discount based on how much you commit to, making it an attractive offer when you get close to the bandings. Unlike most license agreements, commitment tiers lock you in for 31 days, meaning you can opt out of a commitment tier any time after the first 31 days of commitment.

As an example, if you commit to 100GB per day, with todays Microsoft Sentinel pricing in the UK South, it will cost £294.13 per day. Equating to £2.95 per GB which is a 31% saving over the PAYG model.

To commit to a commitment tier, we can do this from the Microsoft Sentinel instance itself (which means, it is done on an instance-by-instance basis for those of you that have multiple instances). You can find these options by navigating to your Microsoft Sentinel Instance, then navigating to Settings > Pricing.

Note: After clicking ‘apply’, the commitment for 31 days applies.

This is an easy way to optimise costs if you are consuming a reasonable amount. However, for smaller businesses you may not be near the 100GB mark just yet.

Pre-Purchase Plan

Pre-Purchase Plans are new, released around September 2024. A pre-purchase plan allows you to buy Commit Units or CUs at a discount. The CUs cover the ingestion costs of Microsoft Sentinel over a 1-year period. The advantage of using this is purely cost savings.

Each unit equates to 1 USD, and you effectively buy these units for a year at a discount. The more units you purchase, the greater the discount.

These CU’s can also be used in conjunction with the Commitment Tiers, resulting in higher cost savings.

Implementing Pre-Purchase Plans is straightforward and does not require any changes to the Microsoft Sentinel tenants themselves. You can purchase CU’s via the Azure Portal by navigating to ‘Reservations’, then selecting the ‘Microsoft Sentinel Pre-Purchase Plan’.

Once you have selected the Pre-Purchase Plan, you can scope it to the Microsoft Sentinel Instance or by resource group, subscription or management group. This allows you to apply a single Pre-Purchasing Plan across multiple instances of Microsoft Sentinel.

Note: Purchasing a Pre-Purchase Plan will bill the subscriptions upfront for the reserved capacity. Additionally, the Pre-Purchase Plan will be configured to renew automatically by default.

Summary

One of the key things to consider is, not everyone will be at the stage of using a Commitment Tier. 100GB is a quite a bit of data for smaller organisations, however this does not mean that Pre-Purchase Plans can’t be used. In fact, seeing as pre-purchase plans are a year commitment (starting at $4,600 or £3,657) this can apply to almost all businesses ingesting low amounts of data.

I would suggest to anyone using Microsoft Sentinel for the foreseeable future investigate the Pre-Purchase Plan immediately, as this can help optimise costs. And whilst 8% (starting) does not sound much, it all adds up over time!

Thank you for taking the time to read this and I hope you have found this information useful. If you haven’t already, please check out my blog on getting started with using Microsoft Sentinel with Microsoft365.