Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Switch to the simplified pricing tiers for Microsoft Sentinel

4 September 2026Doc update+20 / −14 lines

In brief

The article now highlights requirements to check before switching to simplified pricing, clarifies rollback instructions and dedicated-cluster billing language, and updates cost-management guidance and links.

What Defender admins need to know

Administrators evaluating simplified pricing should review the updated requirements and revised billing and cost guidance before making a change.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

#Customer intent: As a billing administrator, I want to switch to simplified pricing tiers for Microsoft Sentinel so that I can streamline billing and potentially reduce costs.

Switch to the simplified pricing tiers for Microsoft Sentinel

For many Microsoft Sentinel workspaces created before July 2023, there's a separate pricing tier for Azure Monitor Log Analytics in addition to the classic pricing tier for Microsoft Sentinel. To combine the data ingestion costs for Log Analytics and the data analysis costs of Microsoft Sentinel, enroll your workspace in a simplified pricing tier. This article explains eligibility requirements, walks through the steps to switch to simplified pricing, and covers the pricing impact for dedicated clusters.

Prerequisites

Before you switch to simplified pricing, make sure your workspace meets the following requirements:

  • The Log Analytics workspace pricing tier must be on pay-as-you-go or a Commitment tier before enrolling in a simplified pricing tier. Log Analytics legacy pricing tiers aren't supported.
  • Microsoft Sentinel was enabled on the workspace before July 2023. Workspaces that enable Microsoft Sentinel from July 2023 onwards are automatically set to the simplified pricing experience as the default.
  • You must have Contributor or Owner for the Microsoft Sentinel workspace to change the pricing tier. }

Only tenants that had Microsoft Sentinel enabled before July 2023 are able to revert back to classic pricing tiers. To make the switch back,revert from simplified pricing to classic pricing tiers, set the `Microsoft.OperationsManagement/solutions` `sku` name to `capacityreservation` and set the `capacityReservationLevel` for both the `Microsoft.OperationsManagement/solutions` resource and the `Microsoft.OperationalInsights/workspaces` resource to the appropriate pricing tier.

The following sample template sets Microsoft Sentinel to the classic pricing tier of pay-as-you-go and sets the Log Analytic workspace to the 100 GB/day Commitment tier.

}

See Deploying the sample templates toTo learn more about usingdeploying Azure Resource Manager templates.templates, see Deploying Azure Resource Manager sample templates.

To implement this template in Terraform or Bicep, see the Microsoft.OperationalInsights workspaces template reference.

Simplified pricing tiers for dedicated clusters

In classic pricing tiers, Microsoft Sentinel was always billed as a secondary meter at the workspace level. The meter for Microsoft Sentinel could differ from the overall meter of the workspace.

With simplified pricing tiers, the same Commitment tier and billing mode used by the dedicated cluster is set for the Microsoft Sentinel workspace. Microsoft Sentinel usage is billed at the effective per GB price of that tier meter, and all usage is counted towards the total allocation for the dedicated cluster. The dedicated cluster allocation is either at the cluster level or proportionately at the workspace level depending on the billing mode of the dedicated cluster. For more information, see Cost details - Dedicated cluster.

Dedicated cluster billing examples

Compare the following cluster scenarios to better understand simplified pricing when adding Microsoft Sentinel enabled workspaces to a dedicated cluster.

The table shows two scenarios where the three-workspace dedicated cluster is ingesting more data than the 5,000 GB per day commitment tier. In both scenarios, the first two workspaces, labeled A and B, aren't Microsoft Sentinel enabled. Workspace A ingested 1 TB of data, while workspace B ingested 2 TB of data. Workspace C is a Microsoft Sentinel enabled workspace that ingested 3 TB of data.

The first scenario uses cluster billing mode, Theand the second scenario uses workspace billing mode.

In cluster billing mode, the combined 3 TB of Log Analytics usage is billed to the cluster resource. The Commitment tier detail shows the price equals to 3 TB multiplied by the Log Analytics effective per GB (per day) price of the Commitment tier. The price is also expressed as 0.6 units of the commitment tier per day rate. Workspace C is a Microsoft Sentinel enabled workspace that ingested 3 TB of data. Its commitment tier detail shows the price equals 3 TB multiplied by the Microsoft Sentinel effective per GB (per day) price of the Commitment tier. The price is also expressed as 0.6 units of the commitment tier per day rate.

The first scenario uses cluster billing mode, and the second scenario uses workspace billing mode.

In cluster billing mode, the combined 2 TB of Log Analytics usage adds the extra 1 TB of unused usage and is billed to the cluster resource. The Commitment tier detail shows the price equals to 3 TB multiplied by the Log Analytics effective per GB (per day) price of the Commitment tier. The price is also expressed as 0.6 units of the commitment tier per day rate. Workspace C is the Microsoft Sentinel enabled workspace that ingested 2 TB of data. Its commitment tier detail shows the price equals 2 TB multiplied by the Microsoft Sentinel effective per GB (per day) price of the Commitment tier. The price is also expressed as 0.4 units of the commitment tier per day rate.

A Log Analytics workspace automatically configures its pricing tier to match the simplified pricing tier if Microsoft Sentinel is removed from a workspace while simplified pricing is enabled. For example, if the simplified pricing was configured for 100 GB/day Commitment tier in Microsoft Sentinel, the pricing tier of the Log Analytics workspace changes to 100 GB/day Commitment tier once Microsoft Sentinel is removed from the workspace.

Will switching reduce my costs?

Though the goal of the simplified pricing experience is to merely simplify pricing and cost management without impacting actual costs, three primary scenarios exist for a cost reduction when switching to a simplified pricing tier.

  • Reduce Microsoft Sentinel costs with a Microsoft Sentinel pre-purchase plan. Commit units of a pre-purchase plan don't apply to Log Analytics costs in the classic pricing tier. Since the entire simplified pricing tier is categorized as a Microsoft Sentinel cost, your effective spend with the simplified pricing tier is reduced with a pre-purchase plan that approaches your commitment tier.
  • The combined Defender for Servers benefit results in a total cost savings if utilized by the workspace.
  • If one of the separate pricing tiers for Log Analytics or Microsoft Sentinel was inappropriately mismatched, the simplified pricing tier could result in cost saving.

Is there ever a reason NOT to switch?

It's possible your Microsoft account team negotiated a discounted price for Log Analytics or Microsoft Sentinel charges on the classic tiers. You can't tell if this is so from the Microsoft Sentinel pricing interface alone. ItYou might be possibleable to calculate the expected cost vsversus the actual charge in Microsoft Cost Management to see if there'sdetermine whether a discount is included. In such cases, we recommend contacting your Microsoft account team if you want to switch to the simplified pricing tiers or have any questions.

Cost management resources for Microsoft Sentinel

Use the following resources to learn more about managing and optimizing Microsoft Sentinel costs:

Related content

For more information, see the following related articles: