Azure Log Analytics & Sentinel Cost Calculator

Most teams first encounter Log Analytics pricing through ingestion charges, because that is the clearest ongoing meter. Data volume per day or per month still matters, but table plan choice also matters. Analytics, Basic, and Auxiliary data are not intended for the same query patterns or retention assumptions.

If you price everything as Analytics by default, the estimate may be conservative but operationally blunt. If you push too much into cheaper plans without understanding the query consequences, the bill may look lower while investigation quality suffers.

Retention is not a single switch. Interactive retention keeps data readily available for normal query workflows, while archive-oriented access patterns depend on search jobs or restore operations. Those choices should match how your platform, security, and compliance teams actually work with older data.

If historic logs are rarely touched, archive-style approaches can make sense. If investigators repeatedly need fast ad hoc access, the cheapest retention choice on paper may create friction and extra operational cost later.

Commitment tiers can be powerful for mature environments with predictable ingestion, because they shift pricing away from pure retail per-GB behavior. The risk is taking a commitment based on temporary peaks, migration noise, or poor data hygiene and then locking in spend that the estate does not actually justify.

Use the pre-deployment and ingestion calculators together when you are still estimating volume. That gives you a better signal for whether a commitment model is a sensible FinOps move or just a premature optimisation.

A platform team troubleshooting App Service and VM incidents has different log access needs from a security team running Sentinel detections or an engineering team keeping long retention for audit evidence. Those use cases affect how much data must stay interactive, how quickly old logs need to be searched, and whether restore actions are realistic in an incident response process.

That is why this page separates ingestion, retention, search jobs, restore, and pre-deployment modelling into distinct tools. They map more closely to operational reality than a single logs cost number.

• Filter or reduce noisy data sources before they hit the workspace instead of paying to ingest them forever.
• Match table plan and retention settings to the real investigation value of the data.
• Review commitment tiers only after daily volume stabilises and temporary spikes are understood.
• Use search jobs or restore selectively, based on response workflow, rather than treating them as interchangeable.
• Revisit Sentinel assumptions separately because security analytics can materially change volume and retention needs.

Is ingestion the only major Log Analytics cost? No. Retention, search jobs, restore, and Sentinel-related decisions can materially affect spend.

When do commitment tiers make sense? When your ingestion baseline is stable enough that discounted committed volume is lower risk than pure retail pricing.

What should teams validate after using these calculators? Actual daily volume, table mix, retention requirements, query frequency, and whether old-data investigations need search jobs or restore access.