MICROSOFT SENTINEL —
PRICING IN AUD.

Sentinel is billed in two stacked components — Sentinel itself for the analysis layer, and Log Analytics for the underlying storage and query. Then there are commitment tiers (100, 200, 300, 400, 500, 1000, 2000, 5000 GB/day) each with a different per-GB rate. Then there's free Defender data, Basic Logs (different rate), Auxiliary Logs (different rate again), retention beyond 90 days, and per-region adjustments. The Microsoft Azure pricing calculator handles each piece separately, but most buyers want one number — annual AUD — and that's what this tool produces.

Microsoft Sentinel doesn't charge for ingest from Microsoft 365 Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Microsoft 365 audit logs, or Azure Activity logs. For organisations on M365 E5 with the full Defender stack, these connectors typically represent 30–60% of total ingest volume. Setting the 'free-connector share' input correctly is the single biggest variable in the AUD output.

Yes, materially — but only if you actually use the committed capacity. The 100 GB/day tier is roughly 27% cheaper per GB than Pay-As-You-Go; the 500 GB/day tier is about 40% cheaper; the 5000 GB/day tier is over 46% cheaper. The trap is over-committing: you pay for the committed capacity whether you ingest it or not. The calculator flags 'over-commit' when the unused capacity exceeds 20% of the tier — those tiers are technically cheaper per used GB but more expensive in absolute AUD.

Sentinel data is retained for 90 days by default at no additional charge (above the ingest charge). Retention beyond 90 days is billed at USD $0.10 per GB per month. For a tenant ingesting 50 paid GB/day with 12 months of extra retention, that's USD $1,800/month — material money. The calculator factors retention into the annual figure for each tier so you compare like-for-like.

It depends on your data mix. For organisations heavy on Microsoft 365 and Azure, Sentinel is usually meaningfully cheaper than Splunk Cloud at equivalent scope — particularly because Defender data is free to ingest into Sentinel. For organisations with significant non-Microsoft estate (heavy Linux, network logs, big CDN logs, OT/ICS sources) the per-GB economics shift and Splunk or Elastic can win. The calculator covers the Microsoft side; the comparison decision needs the same modelling on your current SIEM.

The defaults reflect Microsoft's USD list prices at the time of writing, converted at AUD 1.50 per USD. Microsoft adjusts regional pricing without notice — promotional pricing, Cloud Solution Provider pricing and Enterprise Agreement pricing all differ from list. Always validate the AUD output against your current Microsoft quote before signing a commitment tier.