Microsoft has extended promotional pricing on the Microsoft Sentinel fifty gigabyte commitment tier through December 31, 2026, allowing customers to lock discounted pricing through March 31, 2027. The promotion is available in all regions where Sentinel is sold.
Commitment tiers are the primary cost lever in Sentinel and the one most often set badly. The mechanism is simple — commit to a daily ingestion volume, receive a discount against pay-as-you-go rates, pay the commitment whether or not you use it — and the failure mode is equally simple: organizations commit to the volume they hope to reach rather than the volume they reliably ingest.
Sizing a commitment tier correctly
The right input is your actual daily ingestion over the last ninety days, examined as a distribution rather than an average. What matters is the floor, not the mean: the volume you exceed on essentially every day, including weekends and holiday periods when ingestion drops. Committing at or slightly below that floor captures the discount on the guaranteed base while everything above it bills at pay-as-you-go, which is the correct structure. Committing at the average means paying for unused capacity on every below-average day.
Then account for known changes. A planned onboarding of a new data source, an expansion of endpoint coverage, or a new regulatory requirement to retain a log type will all move the floor upward on a knowable date. Those belong in the model. Aspirations about future coverage do not.
The bigger lever is what you ingest
Before optimising the rate, optimise the volume. In most Sentinel deployments we review, a substantial share of ingested data has never been queried by an analytics rule, a hunting query, an investigation, or a report. It is there because a connector was enabled with default settings and nobody has revisited it.
Three techniques address this. Basic and auxiliary logs provide a substantially cheaper tier for high-volume, low-value data that needs to exist for occasional search but does not need to drive real-time analytics — firewall and network flow data are the usual candidates. Ingestion-time transformation lets you filter or reshape records before they land, dropping fields and events that provide no detection value. And connector-level review asks the direct question for each source: which analytics rule, workbook or investigation consumes this? A source with no consumer is a cost with no benefit.
Getting this right frequently reduces the commitment tier you need, which compounds with the promotional rate rather than competing with it.
The retention question
Retention is priced separately from ingestion and follows different logic. Analytics-tier retention is expensive and should cover the window in which data is actively queried, typically ninety days. Beyond that, long-term retention in a cheaper archive tier satisfies most compliance requirements at a fraction of the cost, with the trade being search latency when the data is eventually needed. Organizations retaining twelve months at analytics tier because nobody ever set a policy are a common and expensive pattern.
Timing this against the wider picture
The promotion running to December 31 with pricing locked to March 31, 2027 gives a comfortable window to do the volume optimisation work first and commit second. That ordering matters — committing to a tier sized against an unoptimised ingestion profile locks in the waste for the term.
It also sits alongside a broader set of Azure commitment changes: reservation exchanges for savings plan-eligible services end February 1, 2027, and commercial cloud local currency pricing moves to a single annual update each January starting January 1, 2027. Organizations reviewing Azure commitments should treat these as one exercise rather than three, because the same forecasting work supports all of them.
How Lorexus engages
We analyse ninety days of Sentinel ingestion by source, identify data with no detection consumer, implement transformation and tiering to remove it, and size the commitment tier against the optimised floor. In most environments the volume work alone pays for the engagement before the promotional rate is applied. Book a free 15-minute call with our senior engineers.