Azure Monitor pricing: log plans, retention and commitments

Azure Monitor charges for log ingestion, retention and export, alongside meters for features such as alerts, notifications and availability web tests. Automatically enabled standard metrics and activity logs are free. The first 5 GB/month of Analytics pay-as-you-go ingestion is free per billing account, not per workspace.

Use Microsoft's pricing page and calculator to select your region and price the workload under your agreement. Microsoft describes displayed prices as estimates; purchase date, agreement and currency can affect the quote.

A workspace can combine Auxiliary, Basic and Analytics tables. Choose around the queries and monitoring features each table needs, rather than assigning a plan by team size.

Auxiliary: single-table KQL with lookups to Analytics tables, summary rules and 30 days of interactive queries. Older data uses search jobs. Log processing is charged separately.

Basic: single-table KQL with Analytics lookups, summary rules and 30 days of interactive queries. Simple Log Alerts are in preview; older data uses search jobs.

Analytics: full KQL, insights and alerting, with query cost included and interactive retention available up to two years. Compare this capability against Basic and Auxiliary's charge for data scanned by queries.

Basic and Auxiliary include 30 days of retention; Analytics includes 31 days. Analytics data in a Sentinel-enabled workspace has a 90-day allowance, as does classic or workspace-based Application Insights data. Retention beyond the applicable allowance is charged per GB-month, prorated daily. Long-term retention is available up to 12 years.

Sentinel can also change the billing meter: Auxiliary and Basic ingestion in Sentinel-enabled workspaces uses Sentinel meters; Analytics ingestion does too under a Sentinel simplified plan. With Sentinel data lake enabled, query, search-job and long-term-retention billing also uses Sentinel meters.

Start with daily ingested GB by table and plan. Add data retained beyond its allowance, Basic and Auxiliary query scans, search jobs and exports. Search jobs charge for scanned data plus ingestion of their results. Summary rules have no additional fee, but their queries and result ingestion are billed.

For Analytics, compare pay-as-you-go with daily ingestion commitments, which start at 100 GB/day. A commitment buys fixed daily capacity for a fixed daily fee. You must wait at least 31 days before reducing capacity or opting out; every tier change resets that clock. Increases and eligible reductions take effect the following day. Base that choice on measured daily ingestion, including quieter days, rather than an assumed monthly bill for a team of a particular size.

Inspect ingestion, retained volume and query scans separately. A cheaper ingestion plan can add query charges, while extending retention adds storage charges beyond the included period. Neither establishes a universal cost multiplier. Include export, alerts and web-test usage when estimating the whole service.

Auxiliary log processing is a separate meter. For Basic and Analytics, Microsoft's processing table distinguishes filtering below and above 50% of incoming data; the start date for billing the excess-filtering case is to be announced. Do not treat that future charge as an unconditional current fee.

Choose the table plan around the investigation and alerting you need, then price the workload. Analytics includes queries; Basic and Auxiliary make scanned volume part of the decision. Commit daily capacity only when your measured ingestion justifies both the reservation and its resettable commitment period. Azure Monitor's free collection features and account-wide allowance are useful starting points, not a promise that a small team's monitoring will be free.