Azure Security Pricing & Cost Estimation

Security services on Azure mix consumption-based (e.g., data ingestion, transactions) and per-resource/seat pricing. This skill helps reason about and estimate costs and identify optimisation levers. Always confirm current rates on official pricing pages.

When to use

Producing a cost estimate or optimising spend for a security solution.

Key cost drivers

• Microsoft Sentinel — Driven mainly by data ingestion (per GB) and retention. Use Commitment Tiers, route low-value logs to Auxiliary/Basic logs or ADX, and avoid duplicate ingestion.
• Defender for Cloud — Foundational CSPM is free; Defender plans are per-resource (e.g., per server/hour, per 10K transactions, per vCore). Enable plans where risk justifies.
• Microsoft Defender XDR / Purview / Entra ID P2 — Largely per-user licensing (E5 / add-ons) rather than consumption.
• Key Vault — Per-operation (secrets/keys/certs) and HSM pool charges (Managed HSM).
• Azure Firewall / Front Door / DDoS — Deployment + data processing charges.