Log Analytics Costs¶
Log Analytics is billed mainly on the volume of data ingested. The central workspace is designed to collect a lot: Entra ID logs, every subscription's Activity Log and, in future, resource logs. Without care, it can become one of the largest items on the bill.
Status: under control today, one large risk pending
Current ingestion (Entra ID and Activity Logs) is modest. The biggest risk is the resource diagnostics initiative psa-mon-diagres-001. It uses the allLogs category group for about 150 resource types. It is audit-only now. If it is switched to deploy, ingestion could grow sharply.
Where the cost comes from¶
| Source | Volume | Notes |
|---|---|---|
SigninLogs, AuditLogs |
Low to medium | Grows with the number of users |
NonInteractiveUserSignInLogs |
Often the largest identity table | Token refreshes. Consider keeping less of it, or using a cheaper table plan. |
AzureActivity |
Low | Activity Log ingestion into Log Analytics is free |
| Resource logs (allLogs) | Potentially very high | Storage, network and Key Vault data-plane logs grow with usage |
| Sentinel (if added) | Charged on top of ingestion | See Threat Detection |
Levers¶
| Lever | Effect |
|---|---|
| Audit instead of allLogs | Switch psa-mon-diagres-001 to the audit category group initiative. It collects security-relevant logs at a fraction of the volume. This is the most important decision. |
| Per-table retention | Keep 90 days interactive and move older data to the cheap archive tier (already done for SigninLogs, AuditLogs and AzureActivity). Never raise workspace-wide retention for compliance. |
| Table plans | Move high-volume, rarely queried tables to the Basic or Auxiliary plan. Ingestion is cheaper, and querying is limited or charged. |
| Transformations | Data collection rule transformations can drop columns or rows at ingestion. For example, remove successful non-interactive sign-ins from noisy clients. |
| Commitment tier | Once daily ingestion is steady at 100 GB or more, a commitment tier costs less than pay-as-you-go |
| Daily cap | A safety net only. Once the cap is hit, security logs stop too. Alert at 80% of the cap, and never rely on it for cost control. |
Watching ingestion¶
Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize GB = round(sum(Quantity) / 1024, 2) by DataType
| order by GB desc
Review this in the monthly FinOps review. Any table that has grown sharply needs an explanation.