What event IDs are considered authentication by the AADDS pricing table?

Question

I'm trying to calculate what SKU i would need to shift my current AD on-prem to AADDS.

According to this table https://azure.microsoft.com/en-us/pricing/details/active-directory-ds/

• Enterprise SKU is recommended for 3K to 10K auths/hour.
• Premium SKU is recommended for 10K to 70K auths/hour.

Are these numbers based on a single replica set (2 DCs)? More replica sets => more auths/hour?

I have captured events 4776 and 4648 from all my local DCs and the number exceeds 70K per hour. Does it mean I would need 2 premium replica sets?

Is there any way to calculate how many auths/hour I need? What events should I capture from my DCs?

Answer 1

Hi anonymous user,

Since your calculation is pretty specific your best bet would be to speak with someone on the Billing team or create a free ticket with them to figure out the total cost.

The two you mentioned are related to authentication attempts, and since the pricing page includes the number of requests I believe these would be included:
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648

https://azure.microsoft.com/en-us/support/options/

https://azure.microsoft.com/en-us/support/create-ticket/

For authentication information, you can also check the sign-in logs: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting