The amount of free retention in Sentinel

Question

Hey team,

My question is really basic - how many days of free retention do you get with Sentinel and what is the condition?
1: The Sentinel pricing page states: 'Once Microsoft Sentinel is enabled on your Azure Monitor Log Analytics workspace, every GB of data ingested into the workspace can be retained at no charge for the first: 90 days if ingested as Analytics Logs. Retention beyond 90 days and up to 2 years will be charged per the standard Azure Monitor retention prices.'

2: But on the other hand, if my default retention in Sentinel is 60 days and I configure just one table to use 90 days, I get this warning message: 'Your workspace is set to 60 days of interactive retention. Selecting a longer retention period will incur additional charges.'
This message indicates I only get the 90 days free if my workspace default is set to 90 days.

So, which one is the case?
Do I get an unconditional 90-day free retention in Sentinel, or do I have to set the workspace default to 90 days in order to get the 90-day free retention?

Either the warning message should be changed or the pricing page should be corrected to reflect this condition.

Answer 1

Hi, I suspect this is an edge case. You do get 90days included with Sentinel, so you'd always set workspace retention to 90days (not 60d).

I suspect this error is more aligned to Azure Monitor/Log Analytics usage and the 30days that's included there (without Microsoft Sentinel being assigned to the Workspace).

I've seen many not set the workspace retention to 90d, and then forget to make the individual table retention changes (often found after an incident, where that data could have been crucial) - so I'd advise workspace to 90days and then at least you get 90days for existing and future Tables that are added. Then adjust specific Tables after that.