This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I need some help and assistance in configuring my current Azure Entra ID Premium P2 tenant to allow Azure Sentinel to ingest logs and query using KQL with no additional or monthly cost.
I can see the below article mentioning there is no data charged when ingesting these alerts and logs to Sentinel:
| Microsoft Sentinel data connector | Free data type |
|---|---|
| Azure Activity Logs | AzureActivity |
| Azure Activity Logs | AzureActivity |
| Microsoft Entra ID Protection | SecurityAlert (IPC) |
| Office 365 | OfficeActivity (SharePoint) |
| OfficeActivity (Exchange) | |
| OfficeActivity (Teams) | |
| Microsoft Defender for Cloud | SecurityAlert (Defender for Cloud) |
| Microsoft Defender for IoT | SecurityAlert (Defender for IoT) |
| Microsoft Defender XDR | SecurityIncident |
| SecurityAlert | |
| Microsoft Defender for Endpoint | SecurityAlert (MDATP) |
| Microsoft Defender for Identity | SecurityAlert (AATP) |
| Microsoft Defender for Cloud Apps | SecurityAlert (Defender for Cloud Apps) |
However, I am not sure where to start to configure the Azure Sentinel part.
I assume this https://azure.microsoft.com/en-au/pricing/details/microsoft-sentinel/ pricing is only applicable when I am ingesting some data sources, other than the above.
Thank you in advance.
That is correct you enable those data connectors from the [Content Hub]in Microsoft Sentinel. Workbooks like "Workspace Usage" will show you that a Table is billable or not just to confirm during the trial period. https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard#install-a-solution-from-the-content-hub
OK, so what are some things that are free forever or will not be billable in this case?
@Clive Watson ,
I assume the only bill will be for the log analytics or the workspace usage only.
If its in the free list you provided its free to ingest and retain for 90days (if you extend retention there is a charge for that, beyond 90days).
Workbooks and KQL use is free anyway.
There is also a free trial (within limits) https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#free-trial
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@EnterpriseArchitect Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.