Based on the information provided in the context, Microsoft does charge for data ingestion over the 500-MB limit per workspace per node per day. However, workspaces created by Defender for Cloud, while configured for Azure Monitor logs per node billing, don't incur Azure Monitor logs charges. Defender for Cloud billing is always based on your Defender for Cloud security policy and the solutions installed on a workspace. It is not clear from the context whether pushing the agent logs of the cluster to CrowdStrike would incur additional charges from Microsoft.
Answer: It is not clear from the context whether Microsoft would charge for data ingestion when the agent logs of the cluster are pushed to CrowdStrike.
References: