A Microsoft Sentinel cost calculator that also compares your plan with ISOC. Pick your log sources, route each log type to the Analytics, Data Lake or Basic tier, and see the monthly Sentinel estimate for ingestion, retention, commitment tiers and pre-purchase plans, itemized with the arithmetic behind every figure.
Then compare that plan with ISOC, the Integrated Security Operations Center in Microsoft Defender (in preview for Microsoft 365 E5/E7 customers), at post-promotion pricing: which data ISOC leaves in Defender with no ingestion charge (retention beyond 30 days is billed), what the rest costs on its meters, and which option is cheaper for your organization. The planner is a LockBase Cyber tool.
Microsoft Sentinel costs $4.30/GB ingested into the Analytics tier at Pay-As-You-Go in East US, $2.96/GB on the 100 GB/day commitment tier and $2.052/GB at 50,000 GB/day; Data Lake-tier data costs $0.15/GB to ingest plus $0.026/GB-month of storage on compressed data. ISOC, the Integrated Security Operations Center in Microsoft Defender (in preview for Microsoft 365 E5/E7 customers), charges no ingestion for native Defender data and $2.40/GB for everything else. The calculator prices your own log sources under both and shows which is cheaper; the figures below are its pricing basis, East US list prices as of September 30, 2026.
| What | East US list price | How it is billed |
|---|---|---|
| Analytics tier, Pay-As-You-Go | $4.30/GB | per GB ingested; 90 days of retention included |
| 50 GB/day commitment tier (preview) | $161.25 a day | $3.225/GB, 25% below Pay-As-You-Go; the daily price is billed every day, and GB above the tier at the tier rate |
| 100 GB/day commitment tier | $296.00 a day | $2.96/GB, 31% below Pay-As-You-Go; the daily price is billed every day, and GB above the tier at the tier rate |
| 500 GB/day commitment tier | $1,265.00 a day | $2.53/GB, 41% below Pay-As-You-Go; the daily price is billed every day, and GB above the tier at the tier rate |
| 1,000 GB/day commitment tier | $2,480.00 a day | $2.48/GB, 42% below Pay-As-You-Go; the daily price is billed every day, and GB above the tier at the tier rate |
| 50,000 GB/day commitment tier | $102,600.00 a day | $2.052/GB, 52% below Pay-As-You-Go; the daily price is billed every day, and GB above the tier at the tier rate |
| Data Lake tier ingestion | $0.15/GB | $0.05/GB ingestion plus $0.10/GB processing, per GB |
| Data Lake storage | $0.026/GB-month | on compressed size (6:1), from the first day; the Data Lake retention is the plan's total retention |
| Data Lake queries | $0.005 per GB scanned | per query; the calculator takes your queries per day |
| Basic logs | $1.00/GB | 30 days included; a legacy plan Microsoft no longer enhances |
| Analytics retention beyond 90 days | $0.10/GB-month | the Log Analytics retention meter, priced per region; charged on grant-covered GB too |
| Microsoft 365 E5, E7, A5, F5 and G5 data grant | 5 MB per user per day | no ingestion charge on the listed Microsoft tables; retention past the included period is still billed |
| Defender for Servers Plan 2 | 500 MB per server per day | no ingestion charge on security events from enrolled servers |
| Pre-purchase plans (Sentinel Commit Units) | $10,000 to $150,000 of units at 11% to 25% off | a one-year term; units are used at retail against Analytics charges, spend beyond them bills normally, and unused units expire |
Preview tier: sign up by December 31, 2026. The price is locked until March 31, 2027, and Microsoft hasn't published the price after that.
The calculator prices 14 Azure regions from Microsoft's price list, meter by meter: East US 2, for example, charges $4.76/GB Pay-As-You-Go but the same commitment-tier prices as East US. West US, West US 3 and UK West have no Sentinel data lake, so long-term retention there bills on the Data Archive meter.
| What | Price | Basis |
|---|---|---|
| Native Microsoft Defender data | No ingestion charge | stays in Defender; 30 days of retention included |
| Other data (the ISOC additional-data meter) | $2.40/GB | from Microsoft's ISOC announcement, not yet on Microsoft Learn; regional prices unpublished, so the calculator scales it by each region's Pay-As-You-Go ratio |
| Defender data kept up to 180 days | $1.20/GB | a planned meter reported by third parties that Microsoft hasn't published |
| Interactive retention past 180 days | $0.10/GB-month | a planned meter reported by third parties that Microsoft hasn't published |
| Data lake under ISOC | the same lake meters as Sentinel | ingestion, processing, storage and queries |
| Eligibility | Microsoft 365 E5, Microsoft 365 E7 and Microsoft Defender Suite | in public preview since September 23, 2026 |
| Not counted | 90 days of included Defender retention from November 15, 2026 | a preview promotion; the calculator prices post-promotion terms only |
Take a 2,000-user organization in East US with 2,500 endpoints and 60 servers that sends Microsoft Entra ID, Defender for Endpoint - Advanced Hunting Tables, Microsoft Defender for Office 365, Microsoft Defender for Identity, Office 365 Management Activity, Azure Activity Log, Microsoft Defender XDR - Incidents & Alerts, On-Prem Windows Security Events and Palo Alto Networks Firewall to Sentinel, with the Microsoft 365 E5 and Defender for Servers data grants applied. The calculator estimates 113.2 GB a day ingested: 18.3 GB a day in the Analytics tier (14.5 GB of it covered by the data grants), 83.2 GB a day in the Data Lake tier, and 11.7 GB a day in Microsoft's no-charge tables.
At Pay-As-You-Go that is about $1,010 a month; Pay-As-You-Go is already the cheapest option. Priced under ISOC at post-promotion rates, the same plan comes to about $1,537 a month, so classic Sentinel stays about $527 a month cheaper for this organization. Every figure is itemized in the calculator, with the arithmetic behind it.
$4.30/GB ingested into the Analytics tier at Pay-As-You-Go in East US, as of September 30, 2026. Commitment tiers bring that down to $2.96/GB at 100 GB a day and $2.052/GB at 50,000 GB a day. Data Lake-tier data costs $0.15/GB to ingest plus $0.026/GB-month of storage on compressed data. Other regions price each meter differently; the calculator uses the region you pick.
A commitment tier is a daily price for a daily volume: the 100 GB/day tier is $296.00 a day in East US, which is $2.96/GB, 31% below Pay-As-You-Go; the daily price is billed every day, and GB above the tier at the tier rate. The minimum commitment is 31 days. The calculator bills the daily price even on days you ingest less, shows how much of it pays for unused commitment, and recommends the tier that costs least for your billable Analytics volume.
Analytics-tier data is kept 90 days at no charge, then $0.10/GB-month in East US on the Log Analytics retention meter, which is priced per region. Data kept beyond its Analytics retention, up to the plan's total retention, is stored in the Sentinel data lake at $0.026/GB-month on 6:1 compressed data. Basic logs include 30 days. A six-year HIPAA retention is priced on every GB, including GB the data grants cover, because the grants waive ingestion only.
Azure Activity, Office 365 audit (SharePoint, Exchange and Teams), the SecurityAlert and SecurityIncident tables and Sentinel's own health table are billed for neither ingestion nor retention. Microsoft 365 E5, E7, A5, F5 and G5 licences add 5 MB per user per day of ingestion on listed Microsoft tables, and Defender for Servers Plan 2 adds 500 MB per server per day on security events. Both grants cover ingestion only.
ISOC is a Microsoft 365 E5 and E7 benefit (and part of the Microsoft Defender Suite), in public preview since September 23, 2026, with no licence of its own. Native Defender data has no ingestion charge and 30 days of included retention. Other data is billed at $2.40/GB on Microsoft's announced additional-data meter. Keeping Defender data longer is priced on planned meters that third parties have reported ($1.20/GB to 180 days, then $0.10/GB-month) and Microsoft hasn't published.
It depends on what you ingest. ISOC's $2.40/GB meter is well below Sentinel's $4.30/GB Pay-As-You-Go rate but above the deepest commitment tiers, and Microsoft hasn't said whether the E5 and Defender for Servers data grants apply in an ISOC workspace. ISOC wins when most of your data is native Defender data; classic Sentinel wins when a commitment tier or the data grants already price your Analytics data below $2.40/GB, or when you need retention and workspace features ISOC's preview doesn't cover. The calculator prices your own plan both ways and names the assumption that would flip the verdict.
Pick from 232 Microsoft Sentinel connectors, each split into log types routed to the Analytics, Data Lake or Basic tier, and describe your organization. The calculator prices ingestion, retention, storage, queries, commitment tiers, pre-purchase plans and the data grants from Microsoft's published rates for your region, compares the plan with ISOC at post-promotion pricing, shows the arithmetic behind every figure, and exports an executive report. It is updated weekly with new connectors and price changes, and your plan never leaves your browser.
Prices as of September 30, 2026 from the Azure Retail Prices API (list prices in USD); ISOC's meters from Microsoft's ISOC announcement and third-party reports, each labelled as such. The calculator is updated weekly with new connectors and price changes. This page was built on October 20, 2026.
Built by LockBase Cyber, a Microsoft security consultancy. Estimates are approximate; confirm prices with Microsoft or an Azure partner before you buy.