IntegratedSOC
Menu

Economics

Estimate what your security data will cost

Most of the cost of a security operations platform comes from the data you bring into it. Enter your own volumes below to see how ingestion and allowances change a rough estimate. Nothing you type leaves your browser.

This planner gives an estimate for discussion, not a quote. Prices vary by region, agreement and commitment tier, so confirm current rates with Microsoft or your licensing partner.

Sentinel, the product this planner estimates ingestion for, in its place on the wheel. Open the wheel

Planner

Build your ingestion estimate

Start with the 100 GB/day example, then replace each bucket with your measured daily ingestion. The same day repeats for your selected period. Allowances count only after you verify eligibility; bring your own new rate in USD to model charges. This is variable Analytics ingestion, not a full bill.

Ingestion assumptions

Divide your daily data

Enter each GB once. Use measured ingested volume, not raw source size.

A steady daily estimate. Daily spikes need a day-by-day billing review.

Don't know your GB per day?

Start with one representative source. Scale measured volume, or model its event rate.

No sample yet? Use Microsoft's guided estimator ↗
Estimated daily ingestion

Add your sample to see a daily range.

No default data volume or promised savings.

Method & measurement

Sample MB ÷ 1,000 × 1,440 ÷ sample minutes × planned resources ÷ sampled resources.

Use representative billable data. Compressed transfer size can differ from billed record size. Repeat for each source and test quiet and busy days. Do not add native non-ingested XDR data to paid ingestion.

Microsoft's sample-sizing guidance ↗Find measured usage ↗Microsoft's guided cost estimator ↗

Apply verified allowances

Choosing a license in the wheel does not confirm billing eligibility.

5 MB per eligible user / day

Qualifying licenses and data

Listed Microsoft 365 E7, E5, A5, F5 and G5 families or qualifying Security offers, under EA, EAS or CSP. Check the exact SKU. Office 365 E5 alone is not the same offer.

Eligible Entra sign-in/audit, Cloud Apps discovery, information protection and advanced hunting tables only. Already-free alerts and audit sources belong in the free bucket.

Verify the offer and table list ↗

500 MB per eligible server / day

Workspace, tables and meter

Plan 2 must be active on the destination Log Analytics workspace. Use one subscription's applicable server allocation; do not reuse it across estimates.

Qualifying security tables only. Windows Application/System logs do not qualify. The allowance covers Log Analytics on classic meters, or Sentinel ingestion on unified meters.

Verify Plan 2 requirements ↗

Each allowance is capped at its own eligible data. Your estimate shows what each one takes off.

Use your commercial terms

Same data and allowances in both scenarios. No list price or discount is assumed.

New planning scenario

Current scenario Optional

See Estimate

Your estimate

Over 30 days

Billable unified ingestion

100 GB / day

3,000 GB over 30 days

to see charges. No rate is assumed.

Follow the volume, in GB per day and over 30 days
  1.  Total ingested100 GB per day3,000 GB over 30 days
  2. −Already free0 GB per day0 GB over 30 days
  3. −M365 allowanceNot applied0 GB per day0 GB over 30 days
  4. −Servers allowanceNot applied0 GB per day0 GB over 30 days
  5. =Billable unified ingestion100 GB per day3,000 GB over 30 days

Download is available once new modeled charges are valid.

Optional planning and scope
MACC planningOptional commitment tracking

Allocate the eligible share of these new charges to an active Microsoft Azure Consumption Commitment. This does not reduce your invoice.

Add verified allocation, balance and planning rates to calculate.

Verify MACC accounting ↗
Calculation assumptionsScope and daily caps
  • Decimal units: 1 GB = 1,000 MB. The entered day repeats for the selected period.
  • Each GB occupies one bucket. Allowances apply daily only to their matching eligible volume; unused capacity is not moved between buckets or days in this model.
  • Review daily usage and actual benefit meters. This model does not establish billing reset time, cross-workspace allocation or benefit stacking rules.
  • Both scenarios use the same eligible data and confirmed allowances. Discounts apply after allowances, across the entered rates.
  • Variable Analytics ingestion only. Commitment-tier minimums, other table plans, licenses, retention, lake storage/query/compute, automation, agent capacity and tax are excluded.
Check the applicable billing model ↗

Planning arithmetic, not a quote or total-cost forecast. Verify your exact offer, data tables and agreement before relying on the estimate. Values stay in this page.

ISOC

How ISOC changes the data question

Native Defender data does not need separate ingestion. Microsoft's ISOC page describes a 90-day data benefit for listed Defender, Defender for Cloud, Entra ID Protection and Azure Activity data, while the Learn preview documentation lists 30 days of included retention. Other data you ingest may cost extra.