On October 1, 2025, Microsoft introduced a new 50 GB per day commitment tier for Microsoft Sentinel, now available in public preview. This tier comes with promotional pricing from October 1, 2025 through March 31, 2026, and customers who sign up within that period will maintain the promotional rate until March 31, 2027. The 50 GB/day tier is half the size of Sentinel’s previous smallest commitment option (100 GB/day), offering a lower entry point for organizations with moderate data volumes. This new tier is available globally via standard Azure channels, including Enterprise Agreement (EA), Cloud Solution Provider (CSP), and direct subscriptions.
What is Microsoft Sentinel
Microsoft Sentinel is a cloud-based security monitoring and response service. It functions as both a Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Microsoft Sentinel collects security data (logs and alerts) from across an organization’s IT environment, uses analysis and Artificial Intelligence (AI) to detect potential threats, and helps security teams investigate and respond to incidents. As a cloud service, Microsoft Sentinel can scale to handle large volumes of data without requiring on-premises infrastructure, making it convenient for organizations of various sizes.
Key Features
- Centralized Log Collection and Analysis: Microsoft Sentinel aggregates security logs and events from multiple sources (cloud platforms, on-premises servers, applications) into one platform for unified analysis and monitoring.
- Advanced Threat Detection: It uses built-in analytics and AI models to identify suspicious patterns and known attack techniques. Sentinel includes pre-defined detection rules and allows custom rules to catch issues like unusual user activity or malware outbreaks.
- Automated Response Playbooks: The service provides SOAR capabilities by enabling automated incident response. Security teams can create playbooks (automated workflows) that execute when specific alerts are triggered – for example, automatically isolating a compromised device or sending an alert to administrators.
- Investigation Tools: Microsoft Sentinel offers features to assist in investigating and resolving incidents. Analysts can use an interactive investigation graph to visualize attack paths and relationships and run queries across the collected data to pinpoint root causes.
- Integration and Extensibility: Sentinel integrates with a wide range of Microsoft and third-party tools. It supports data connectors for many services and can incorporate threat intelligence feeds. This extensibility allows organizations to fit Sentinel into their existing security ecosystems and workflows.
Licensing
Microsoft Sentinel’s pricing is primarily based on the volume of data ingested for analysis, with two main options:
- Pay-As-You-Go: You pay for each gigabyte of data ingested, with no upfront commitment. This model is flexible – you only pay for what you use each day. It is well-suited for organizations that are just starting with Sentinel or have variable data volumes.
- Commitment Tiers: You commit to ingesting a fixed amount of data per day (for example, 50 GB/day or 100 GB/day) in exchange for a discounted rate. If you ingest less than the committed amount on a given day, you still pay for the full amount (since it’s reserved capacity), and any data above the commitment is billed at the normal (pay-as-you-go) rate. The benefit of a commitment tier is cost predictability and savings for consistent workloads. Historically, the smallest commitment option was 100 GB/day, so the new 50 GB/day tier in public preview provides a more accessible choice for smaller deployments or budgets. During the public preview (until March 31, 2026), the 50 GB tier has special promotional pricing, as noted above.
Deciding on the right licensing approach can be complex. For an optimal setup, it is recommended to seek expert advice from SCHNEIDER IT MANAGEMENT – to ensure you choose the most cost-effective and suitable tier for your organization’s needs.
More information
For further details, please refer to the original sources:
- Official announcement: https://techcommunity.microsoft.com/blog/microsoftsentinelblog/what%E2%80%99s-new-in-microsoft-sentinel-november-2025/4466061
- Microsoft Sentinel pricing page: https://www.microsoft.com/en-us/security/pricing/microsoft-sentinel/
