Microsoft Sentinel

Microsoft Sentinel is a cloud-based SIEM, a security information and event management system, sold by Microsoft and run on Azure. Security teams connect log sources, and Sentinel collects the data, correlates signals across identities, endpoints, cloud apps and infrastructure, raises alerts and supports investigation and automated response.

The vendor says it combines detection, SOAR playbooks, user and entity behaviour analytics and threat intelligence, with a built-in data lake for cheaper long-term storage. Sentinel is billed on how much data you ingest rather than per user or per device. Microsoft says that after 31 March 2027 Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal, so new deployments should plan around that.

• Connectors. The vendor says data comes in through more than 400 connectors, plus a no-code framework for building custom connectors. Its stated aim is that new sources can be ingested within days instead of months.
• Analytics and data lake tiers. Data can go to the analytics tier, which supports all log types with full alerting and query, or to a low-cost data lake tier for long-term investigation and compliance storage. Microsoft suggests identity logs and threat intelligence for analytics, and firewall or proxy logs for the lake.
• SOAR automation. Built-in orchestration, automation and response offers ready-made playbooks and no-code automation. The vendor says this reduces manual triage and mean time to resolve. Azure Logic Apps used for playbooks are charged separately.
• UEBA. User and entity behaviour analytics builds a baseline of normal activity so that compromised accounts and insider risks surface where rule-based detection would miss them, according to the vendor.
• Security Copilot in Sentinel. The vendor says Security Copilot summarises incidents, drafts Kusto Query Language queries and suggests next steps, and claims it reduces mean time to resolve by about 30 percent. Usage may consume Security Compute Units.
• Graph and MCP server. Sentinel graph shows relationships across security data, with custom graphs billed per compute hour. An MCP server exposes platform capabilities to AI agents at no charge itself, while the underlying queries and graph operations are billed on their meters.

• A mid-sized company already on Microsoft 365. Turn on the free data sources such as Office 365 audit logs and Defender alerts, add Entra and endpoint logs to the analytics tier and run incidents from the Defender portal.
• A managed security provider. Run one workspace per client with commitment tiers chosen per workspace. The vendor notes commitment tiers apply at workspace level and cannot be shared across workspaces or subscriptions.
• A regulated firm that must keep firewall logs for years. Send high-volume network logs to the data lake tier, keep them queryable for forensics, and pay storage on the vendor's stated 6:1 compression basis rather than raw volume.

Sentinel is enabled on an Azure Monitor Log Analytics workspace. Microsoft says the first 10 GB a day ingested into the analytics plan is free for 31 days, with a limit of 20 workspaces per Azure tenant, and a News and guides page in the portal shows trial dates.

You then pick data connectors, choosing which free or paid data types to enable, turn on analytics rules and set up automation. Because the Azure portal experience ends on 31 March 2027, Microsoft recommends planning the move to the Defender portal. A cost estimator gives a three-year projection with growth modelling.

Sentinel bills analytics-tier data pay-as-you-go or through daily commitment tiers from 100 GB, with a cheaper data lake tier for high-volume logs.

Azure services used alongside it, such as Log Analytics and Logic Apps, are charged on top. After 31 March 2027 it is supported only in the Microsoft Defender portal, so that move belongs in the project plan from the start.

The SIEM software list places Microsoft Sentinel 9 of 12: Rapid7 InsightIDR sits directly above it and Google Security Operations directly below. Established names take the places after the first three, in ranked order, and we give no numeric score.

Counting headquarters, 10 out of 12 sit in North America; for Microsoft Sentinel that is the United States.

Charging model: Pay-as-you-go or daily commitment tiers; separate data lake tier; cost estimator offered.

The analytics tier is billed pay-as-you-go by gigabytes ingested, with data retention free for 90 days and charged beyond. Commitment tiers reserve daily ingestion from 100 GB to 50,000 GB, with savings up to 52 percent over pay-as-you-go according to Microsoft; they can be raised at any time and lowered after 31 days. A 50 GB tier is in public preview with promotional pricing to 31 December 2026. The data lake tier is metered separately for ingestion, processing, storage, query and compute hours. Per-gigabyte amounts depend on region and agreement and are shown on the vendor's pricing page and cost estimator; they are not reproduced here.

Where this comes from: the vendor pages at azure.microsoft.com/products/microsoft-sentinel, checked for Best SIEM Software in 2026 on 5 November 2026.

Independence is low: you need an Azure environment, and from April 2027 the Defender portal, so exit means rebuilding rules and playbooks elsewhere.

Microsoft says Sentinel runs in your Azure Log Analytics workspace, so the data stays in the region you choose for that workspace. Data tied to Azure Activity, Office 365 audit and Defender alerts can be ingested free.

Specific certifications are listed in the Microsoft Trust Center and Compliance Program for Microsoft Cloud, which the Sentinel page links, rather than on the product page itself. Export options are not detailed on the pages fetched.

Integrations the vendor names (10):

• Microsoft Defender XDR
• Microsoft Defender for Cloud
• Microsoft Entra ID
• Office 365 audit logs
• Azure Logic Apps
• Azure Machine Learning
• Security Copilot
• SAP applications
• Microsoft Purview
• AWS and GCP sources

We pick the closest products in the same guide by tags, price model and region.

• Securonix (#5 of 12): Not for: teams that want to compare published list prices first. Cloud SIEM that bundles UEBA, SOAR and threat intelligence together. (United States)
• Sumo Logic (#6 of 12): Log analytics vendor whose Cloud SIEM sits in the Enterprise Suite.
• Google Security Operations (#10 of 12): SIEM, SOAR and threat intelligence sold as ingestion-based packages. (United States)

Read from the vendor’s own pages on 5 November 2026.

• azure.microsoft.com/en-us/pricing/details/microsoft-sentinel: tiers, commitment tiers, promotional 50 GB tier, FAQ, cost estimator
• learn.microsoft.com/en-us/azure/sentinel/billing: free trial, billing meters, data lake charges, free data sources, retention, portal retirement
• azure.microsoft.com/en-us/products/microsoft-sentinel: capabilities, connectors, SOAR, UEBA, Security Copilot claim (fetched in Dutch)

Four tests decide a position: how soon the product is useful, what the bill really becomes, how data leaves and who it suits. On those tests Microsoft Sentinel lands at place 9 of 12. How vendor facts are sourced, and how money can and cannot influence a page, is in the editorial process.