Microsoft Sentinel
Azure reservation and savings plan coverage brief for Microsoft Sentinel
Data sourced: March 2026. Verify current figures at the Azure Pricing Calculator.
Coverage summary
Microsoft Sentinel offers two layered cost-reduction instruments for analytics-tier ingestion, neither of which is a standard Azure Reservation or Compute Savings Plan. The primary instrument is Commitment Tiers — a daily GB/day ingestion capacity commitment (100 GB/day through 50,000 GB/day) that can save up to ~52% vs. pay-as-you-go and applies to the unified simplified pricing tier covering both Sentinel analysis and Log Analytics ingestion. On top of Commitment Tiers, a Pre-Purchase Plan (Sentinel Commit Units / SCUs) can be purchased through the Azure Reservations portal at a 1-year term, providing an additional ~22–44% discount on Sentinel analytics-tier costs; the two instruments stack for combined savings exceeding 50%. Azure Hybrid Benefit does not apply to Microsoft Sentinel.
What is covered: Analytics-tier data ingestion and analysis costs billed under the Sentinel service name. Commitment Tiers cover the daily ingestion capacity reservation. The SCU Pre-Purchase Plan covers all Sentinel analytics-tier line items (pay-as-you-go and commitment tier overages alike).
What is not covered: Data retention beyond 90 days (charged at Log Analytics retention rates or via the Microsoft Sentinel data lake storage meter); data lake ingestion, data lake processing, data lake query, and advanced data insights charges; Azure Monitor / Log Analytics tiers charged separately under classic pricing; Logic Apps/playbook runs; Azure Functions used by data connectors; Notebooks (ML compute); BYOML; Azure Sentinel data lake billable capabilities. The SCU Pre-Purchase Plan cannot be cancelled or exchanged after purchase — all purchases are final.
Azure Hybrid Benefit
Not applicable for this service. Microsoft Sentinel is a cloud-native SaaS security analytics service with no on-premises license (Windows Server or SQL Server) that qualifies for Azure Hybrid Benefit. The Microsoft Defender for Servers P2 benefit does provide a 500 MB/day free ingestion grant per protected VM into Sentinel under the simplified pricing tier, which is separate from Azure Hybrid Benefit.
SKU / tier coverage
Pay-as-you-go (Analytics tier)
❌ No
❌ No
—
—
Baseline; no commitment instrument needed
Commitment Tier — 100 GB/day
✅ Yes (Commitment Tier)
❌ No
~27%
N/A (daily, no term lock)
Simplified pricing: Sentinel + Log Analytics bundled
Commitment Tier — 200 GB/day
✅ Yes (Commitment Tier)
❌ No
~39%
N/A
39% savings vs. PAYG cited by Microsoft docs
Commitment Tier — 300 GB/day
✅ Yes (Commitment Tier)
❌ No
~40–44%
N/A
Discount increases with tier size
Commitment Tier — 500 GB/day
✅ Yes (Commitment Tier)
❌ No
~44–48%
N/A
Verify current rate at pricing page
Commitment Tier — 1,000 GB/day
✅ Yes (Commitment Tier)
❌ No
~48–50%
N/A
Verify current rate at pricing page
Commitment Tier — 2,000 GB/day
✅ Yes (Commitment Tier)
❌ No
~50–52%
N/A
Near max savings ceiling
Commitment Tier — 5,000 GB/day
✅ Yes (Commitment Tier)
❌ No
~52%
N/A
Near max savings ceiling
Commitment Tier — 10,000–50,000 GB/day
✅ Yes (Commitment Tier)
❌ No
up to ~52%
N/A
High-volume enterprise tiers
SCU Pre-Purchase Plan (small tier)
✅ Yes (prepaid)
❌ No
~22%
N/A (1-yr only)
Stacks on top of Commitment Tier
SCU Pre-Purchase Plan (5,000 CU tier)
✅ Yes (prepaid)
❌ No
~44%
N/A (1-yr only)
Highest SCU discount; cannot cancel/exchange
Data lake tier
❌ No
❌ No
—
—
Charged separately; not eligible for Commitment Tiers or SCUs
Basic Logs / Auxiliary Logs
❌ No
❌ No
—
—
Separate Log Analytics meters; not eligible for Commitment Tiers
Data retention (>90 days)
❌ No
❌ No
—
—
Billed at Log Analytics or data lake rates
Logic Apps / Azure Functions
❌ No
❌ No
—
—
Integration services billed independently
Commitment Tier mechanics: Unlike a traditional Azure Reservation, Commitment Tiers are a daily rate card commitment — not a fixed-term reservation. You can increase the tier at any time (restarting a 31-day commitment period); you must wait 31 days to lower the tier or return to pay-as-you-go. Overage above the committed daily volume is billed at the same effective per-GB rate of the selected tier.
50 GB/day promotional tier: A new 50 GB/day commitment tier entered public preview in October 2025, with promotional pricing locked through March 31, 2027 for customers who enrolled between October 1, 2025, and June 30, 2026. Save up to ~32% vs. pay-as-you-go at this tier.
Commitment Tier vs. SCU Pre-Purchase Plan
Commitment Tier: Daily ingestion capacity reservation set in the Sentinel workspace Pricing settings. No fixed term — effective immediately, adjustable (up any time; down after 31 days). Covers the bundled Sentinel + Log Analytics analytics-tier cost (simplified pricing). Savings up to ~52%.
SCU Pre-Purchase Plan (1-yr term, purchased in Azure Reservations portal): Prepaid credit pool denominated in Sentinel Commit Units (1 SCU = $1 USD of Sentinel cost). Purchased at a volume discount (~22% at baseline, ~44% at 5,000 CU tier). Auto-deducted from all eligible Sentinel analytics-tier charges across all scoped workspaces. No cancellations or exchanges — purchases are final. Does not cover data lake charges, retention, or Azure Monitor tiers.
Combined strategy: Select the Commitment Tier that most closely matches your expected daily ingestion volume, then layer an SCU Pre-Purchase Plan sized to roughly 5–6 months of projected spend for the highest combined savings (Microsoft documents a >51% combined saving in example scenarios).
Regional availability
Microsoft Sentinel Commitment Tiers are available in all commercial Azure regions where Microsoft Sentinel is supported. Each workspace is billed at its regional pricing — prices vary by region (East US is typically the reference/lowest price; Europe and Asia regions may be 10–30% higher).
The SCU Pre-Purchase Plan is scoped at purchase time (single subscription, shared/enrollment, or management group) and is not region-locked. The SCUs apply to eligible Sentinel analytics-tier charges regardless of which region the workspace is in, making the Pre-Purchase Plan regionally flexible.
Known exclusions: Azure Government and Azure China regions have separate pricing structures and may not support all Sentinel commitment options in the same way as commercial Azure. Verify availability in sovereign clouds via the Azure portal or Microsoft account team.
Portal note: As of March 31, 2027, Microsoft Sentinel will no longer be accessible from the Azure portal and will be available only through the Microsoft Defender portal. Billing and commitment management will continue through the same Azure Cost Management and Reservations infrastructure.
⚠️ Availability varies by SKU and region. Always verify in the Azure portal or via the Azure Retail Pricing API before purchasing.
Archera
Microsoft Sentinel is within Archera's commitment management scope via the SCU Pre-Purchase Plan (tracked as AzureSentinelReservation in the Archera platform). Archera can automate SCU purchase, monitor Sentinel analytics-tier spend against pre-purchased CU balances, and wrap Sentinel commitments in a GRI/GSP — providing downside protection if ingestion volume drops below the committed level. Commitment Tier selection (the daily GB/day tier set in the workspace) is managed directly in the Azure portal / Defender portal and is not purchased through the Azure Reservations API, so Archera's reservation automation applies to the SCU Pre-Purchase Plan rather than the workspace-level Commitment Tier dial.
Sources
⚠️ Pricing is region- and SKU-dependent and subject to change. Always verify with the Azure Pricing Calculator.
Last updated
Was this helpful?