Budget Azure security logging by managing volume, retention and table type, then apply the current price list to those numbers. Price changes, volume mostly does not. Measure gigabytes per source per day, filter what no detection or audit needs, and choose retention per table. This post states no prices; check Microsoft's pricing pages for current rates.
I read Microsoft's Azure Monitor cost guidance on 18 October 2026. The levers below come from that page. Rates and tier names change, so verify them before you commit.
What drives the bill?
For Log Analytics workspaces, cost follows three things: how much data you ingest, how long you keep it, and how you query it. Microsoft's guidance says the default retention is 31 days, with a charge for keeping data longer in the workspace, and that the default is 90 days when Microsoft Sentinel is enabled. If Sentinel is on, all data in that workspace falls under Sentinel pricing, so mixing noisy operational logs with security logs in one workspace can raise cost. Decide deliberately whether to combine them.
How do you find what you ingest?
Start with a usage view. Group ingestion by table and by resource for a representative week and one busy day. A few sources usually dominate: verbose diagnostic settings on busy PaaS resources, network flow logs, and agent-collected performance counters or syslog at debug levels.
Build the budget in a spreadsheet with one row per source: gigabytes per day, retention in days, and the detection or audit need that justifies it. Rows with an empty justification are the first candidates to cut.
Which cost levers does Microsoft describe?
- Filter at collection. Microsoft notes diagnostic settings do not allow granular filtering of resource logs, so it points to workspace transformations to drop unneeded data in supported tables. The Azure Monitor agent can also filter using transformations.
- Pick a table plan. Tables for debugging, troubleshooting and auditing can be set as Basic Logs, which have a lower ingestion cost in exchange for limited features and a charge per query.
- Use commitment tiers. If you collect enough data, committing to a daily minimum gives a lower rate. This only pays off with stable volume.
- Tune retention and archive. Keep hot data short, move the audit trail to long-term retention.
- Alert on spikes and consider a daily cap. The guidance suggests alerts when collection is high.
Is a daily cap a good idea for security data?
Be careful. The documentation states a daily cap disables data collection in the workspace for the rest of that day. For security logs that is a blind spot, and a noisy attack day is exactly when volume spikes. If you use a cap, use it on workspaces for test and operational data, and prefer alerts for the security workspace.
A constructed example
A team's security workspace ingests firewall flow data, identity sign-in logs, endpoint audit events and a verbose application debug stream. Reviewing a week of usage, the debug stream is the largest table and feeds no alert. They filter it out at collection, move the flow data to a lower-cost table plan because it is queried only during investigations, keep sign-in logs at long retention for audit needs, and add an alert for a day over a set multiple of the baseline. Detection rules still work, and the budget is now a set of explicit choices.
What to do
- Measure ingestion per table and per source for a normal week and a busy day.
- Write the detection, audit or legal need next to each source; cut sources with none.
- Filter at collection with transformations where supported.
- Assign table plans by how the data is used: alerting, investigation, or retention only.
- Set retention per table to match the audit requirement, with archive for the long tail.
- Alert on abnormal volume instead of capping the security workspace.
- Recheck commitment tiers once volume has been stable for a quarter.
- Apply current published rates to your volume table, and review monthly.
Quick check
Should I cut logs to save money?
Cut logs that serve no detection, audit or investigation need. Cutting logs you may need for an incident, or that regulation requires you to keep, saves money now and costs more later.
Does a commitment tier always save money?
Only if daily volume stays above the committed minimum. Spiky or shrinking volume can make it a poor fit.
Sources
- Microsoft Learn: Azure Monitor best practices, cost optimization (fetched 18 October 2026)
- Microsoft Learn: Azure Monitor Logs cost calculations and options (fetched 18 October 2026)
- OWASP Logging Cheat Sheet
Last reviewed: 18 October 2026.
