Differences between Sentinel Cost Workbook and Azure Cost Analysis

Anonymous
2022-10-11T13:37:14.393+00:00

Hello,

Today I've been checking the cost of our Microsoft Sentinel Instance. I have opened the Microsoft Sentinel Cost workbook for my workspace and it calculates around 72 dollars for the ingested data. That's fine. Then I want to compare it to the Azure Cost Analysis tab for the same duration and workspace, yet it tell me the costs are 0. Does anyone know how this is possible or am I missing something obvious?

Azure Cost Management
Azure Cost Management
A Microsoft offering that enables tracking of cloud usage and expenditures for Azure and other cloud providers.
2,694 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,159 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. David Broggy 5,906 Reputation points MVP
    2022-10-11T16:12:15.317+00:00

    It has been my experience that the Azure Cost Analysis isn't as granular at calculating costs at the resource level.

    Or it may be that the Azure cost calculator doesn't update it's statistics as frequently as from where the Sentinel workbook is pulling the information from, so you may need to wait longer to see the update.

    However I'd be happy to replicate your finding if you can tell me what filter settings you used in the Azure cost analysis, or provide a screenshot without your personal data in the image.


  2. Clive Watson 6,601 Reputation points MVP
    2022-10-12T10:02:47.913+00:00

    Your [Scope] in the Costs Analysis screenshot is set to a Resource Group, can we assume this is the LA/Sentinel one? Maybe try to back up one level to the Subscription. If that does work, I suspect you don't have some RBAC to allow this (maybe you have rights to the Subscription but not the RG)?

    249683-image.png

    Let us know if this helps by Accepting the answer


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.