The Short Version
Sentinel’s data lake tier costs $0.05 per GB to ingest, $0.10 per GB to process, $0.026 per GB a month to store (billed at 6:1 compression) and $0.005 per GB scanned, against $4.30 per GB for analytics-tier pay-as-you-go. A lakehouse wins when you also need that data outside security tooling.
- Cost: the lake tier is nearly 30 times cheaper per GB at ingest than analytics pay-as-you-go.
- Trade-off: lake-tier data is for hunting and retention, not real-time detection.
- Hidden line: queries bill on uncompressed GB scanned, so heavy hunting moves the bill.
- Lakehouse case: storage and query decouple, and the same copy serves security and the business.
Start with the money. Microsoft’s own Azure Retail Prices API, checked on 8 October 2026 for East US in US dollars, lists the Sentinel data lake meters at $0.05 per GB for ingestion, $0.10 per GB for processing, $0.026 per GB per month for storage and $0.005 per GB for queries. The analytics tier’s pay-as-you-go meter is $4.30 per GB, and the smallest listed commitment tier is $296 a day for 100 GB.
The marketing page will not show you those numbers. The Sentinel pricing page renders them behind a calculator and calls every figure an estimate, which is why third-party blogs disagree. The retail API is Microsoft’s published list price; your negotiated rate and region will differ, and your own invoice is the final word.
That gap between $0.15 to land a GB in the lake and $4.30 to land it in the analytics tier is the whole story. Security teams have been paying analytics-tier prices for firewall, proxy and DNS logs they rarely query, and the lake tier is Microsoft’s answer. The question for a mid-market budget holder is whether to take it, or to put those logs in a lakehouse you already run.
What Does Microsoft Charge for Each Sentinel Data Lake Meter?
Microsoft’s billing documentation lists five data lake meters. Rates are the East US list prices from the retail API on 8 October 2026.
| Meter | List rate | Unit | When it applies |
|---|---|---|---|
| Data lake ingestion | $0.05 | per GB | Tables set to data lake tier only |
| Data processing | $0.10 | per GB | Same tables; covers redaction, splitting, filtering and normalization |
| Data lake storage | $0.026 | per GB per month | Data remaining in the lake after analytics retention ends, billed at a flat 6:1 compression |
| Data lake query | $0.005 | per GB | Uncompressed data scanned by KQL queries or KQL jobs |
| Advanced data insights | $0.15 | per compute hour | Notebook sessions and jobs; compute hours are pool cores multiplied by active time |
| Analytics tier, pay-as-you-go (for contrast) | $4.30 | per GB | Real-time analytics tier, simplified pricing |
| Analytics tier, 100 GB/day commitment (for contrast) | $296 | per day | Effective $2.96 per GB at full use |
Two rules in that documentation matter more than the rates. Ingestion and processing charges do not apply to tables whose retention includes both the analytics and lake tiers, because analytics data is mirrored into the lake. And storage bills on compressed volume at a fixed 6:1 ratio: Microsoft’s own example says 600 GB of raw data is billed as 100 GB.
How Do the Analytics Tier and the Data Lake Tier Split the Work?
Sentinel is now a two-tier system. The analytics tier is the SIEM you know: scheduled analytics rules, alerting, incidents and advanced hunting, with the first 90 days of retention included. The data lake tier, per Microsoft’s data lake overview, stores security data in open-format Parquet files for up to 12 years, queried with KQL or Jupyter notebooks, with analytics-tier data mirrored into it as a single copy.
So the design decision is per table. High-signal sources that drive detections stay in analytics. High-volume, low-value sources such as verbose firewall, proxy, DNS and flow logs move to lake-only, where you hunt them and promote slices back to analytics with a KQL job when an investigation needs them. Retention for compliance sits in the lake at storage prices.
That is a sound architecture. It is also the same architecture a security lakehouse uses: cheap object storage for everything, a hot path for detections, and compute you pay for only when you query. The difference is who owns the storage, the format and the compute bill.
What Does 100 GB a Day Cost on Each Tier?
Take one log source at 100 GB a day of raw data, a 30-day month, kept for a year. Assume analysts scan the last 30 days of it 20 times a month during hunts. Every rate is the list price above; your discounts are not in it.
| Line | Analytics tier, pay-as-you-go | Analytics tier, 100 GB/day commitment | Data lake tier only |
|---|---|---|---|
| Monthly volume | 3,000 GB | 3,000 GB | 3,000 GB |
| Ingest per month | $12,900 | $8,880 | $450 (ingestion plus processing) |
| Storage, month 12 | 90 days included; longer retention extra | 90 days included; longer retention extra | 36,000 GB raw billed as 6,000 GB: $156 |
| Hunting queries per month | No separate query meter | No separate query meter | 60,000 GB scanned: $300 |
| Year one, approximate | $154,800 plus retention past 90 days | $106,560 plus retention past 90 days | About $10,000 |
The lake-only year breaks down as $5,400 in ingestion and processing, about $1,014 in storage as the volume builds month by month, and $3,600 in queries. Queries are the line to watch: they bill on uncompressed GB, so doubling hunt frequency adds more than the whole year of storage.
The analytics figures buy something the lake does not: real-time rules and incidents on that source. If a log genuinely drives detections, the $4.30 rate is the price of that job, not waste.
What Does the Same Log Volume Cost on a Lakehouse?
On a lakehouse, storage is the cloud’s object storage rate. The same retail prices API lists Azure Data Lake Storage hot tier, locally redundant, at $0.021 per GB a month in East US, and cool tier at $0.015. If your Delta tables compress as well as Microsoft’s 6:1 assumption, which depends on the source, the month-12 storage line is about $126 on hot storage against Sentinel’s $156.
Storage is not where the lakehouse case is won, and anyone who tells you it is has skipped compute. Ingestion with Auto Loader, normalization and every query run on compute you pay for by usage. That bill depends on cluster sizing, serverless choices and how often analysts query, so measure it in a pilot from your own system tables before you compare totals. We will not quote a number we have not measured on your data.
The real argument is decoupling. In Sentinel, storage, query and the analytics engine are priced and governed by one vendor, and the data serves security tools. On a lakehouse, the same copy normalized to OCSF in the silver layer serves detection engineering, fraud, IT operations and finance, under one catalog, with compute you can size, schedule and switch off. Our security data lake guide covers that layout, and the OCSF explainer covers the normalization step.
Where Does the Per-GB Math Mislead Budget Holders?
- Query bills on raw size. Storage is billed compressed, queries uncompressed. A team that hunts broadly across a year of lake data pays for every raw GB it scans, every time.
- Promotion is a second ingest. Moving lake data back to analytics for an investigation means paying analytics prices on the promoted slice. Frequent promotion erodes the saving.
- Notebook compute is separate. Advanced data insights bills per compute hour, and hours are pool cores multiplied by time, so a 32-core pool running for an hour is 32 compute hours.
- Classic and simplified pricing look different. Workspaces older than July 2023 can still carry separate Log Analytics charges under classic tiers. Check which model your workspace runs before comparing.
- Free sources are already free. Microsoft lists Azure Activity, Office 365 audit logs and Defender alerts as free data sources. Moving them saves nothing.
- The lake tier does not replace detection. A source moved to lake-only stops driving real-time rules. Decide per table which detections you are giving up.
How Does Your Team Score on This Sentinel Checklist?
Give yourself one point for each statement that is true today. The total tells you where to spend the next quarter.
- You know your daily ingest per table, not just per workspace.
- You can name which tables drive analytics rules and which only feed hunts.
- More than a third of your volume is high-volume, low-signal network or proxy data.
- Your retention requirement is longer than 90 days for at least one source.
- Someone outside the SOC (fraud, IT operations, audit) wants the same log data.
- You already run a lakehouse with a governed catalog for business data.
- You can measure query frequency and scan volume per analyst or job.
0 to 2: measure before you move anything; you cannot price either option yet. 3 to 4: move low-signal tables to the Sentinel lake tier and keep the SIEM as the system of record. 5 to 7: a security lakehouse deserves a priced pilot, because the same data already has a second customer. If that is you, our lakehouse security work starts with that measurement, and the Splunk alternative comparison shows how the same decision looks from other SIEMs.
Frequently Asked Questions (FAQs)
How much does the Microsoft Sentinel data lake cost?
At East US list prices checked 8 October 2026: $0.05 per GB ingestion, $0.10 per GB processing, $0.026 per GB per month storage billed at 6:1 compression, and $0.005 per GB of uncompressed data scanned. Notebook compute is $0.15 per compute hour.
Is data in the Sentinel analytics tier also stored in the data lake?
Yes. Microsoft states analytics-tier data is mirrored to the lake tier as a single copy, and lake ingestion and processing charges do not apply to tables that keep both tiers.
How long can the Sentinel data lake keep data?
Up to 12 years, according to Microsoft’s data lake overview. The analytics tier includes the first 90 days of retention at no extra charge.
Can Sentinel run analytics rules on data lake tier data?
Lake-tier data is for KQL exploration, jobs and notebooks. To run real-time detections on it, you promote the relevant data back into the analytics tier, which bills at analytics prices.
Is a lakehouse cheaper than the Sentinel data lake?
On storage, the two are close: Azure hot storage lists at $0.021 per GB a month against Sentinel’s $0.026 on compressed data. The difference comes from compute and reuse, so price a lakehouse pilot on your own query patterns before deciding.
What format does the Sentinel data lake use?
Microsoft describes it as open-format Parquet files with storage separated from compute. Microsoft documents KQL queries and Jupyter notebooks as the ways to analyze it.