Question 1

What is Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel is Microsoft's cloud-native SIEM — security information and event management — the system that collects security logs from across your estate, correlates them into incidents, and gives a security operations team one place to detect, hunt and respond. It is delivered only as SaaS on Azure infrastructure, runs on top of an Azure Monitor Log Analytics workspace, and is queried using KQL (Kusto Query Language). Beyond core SIEM it includes UEBA (user and entity behaviour analytics), SOAR-style automation through playbooks built on Azure Logic Apps, threat intelligence ingestion, and a Content hub of hundreds of ready-made detection rules and workbooks. Microsoft was named a Leader in the 2025 Gartner Magic Quadrant for SIEM, alongside Google Security Operations. Two structural facts matter more than the feature list. First, it is billed on data ingested rather than per user or per device, and a set of first-party Microsoft sources — Azure Activity logs, Office 365 audit logs, and security alerts from the Defender XDR family — ingest at no charge, which is why Microsoft-heavy estates see a much smaller bill than their raw log volume suggests. Second, Sentinel is consolidating into the Microsoft Defender portal, and after 31 March 2027 it will not be supported in the Azure portal at all. TechBag sells Splunk as well, so the advice you get here is about fit, not allegiance.

Question 2

How much does Microsoft Sentinel cost?

Accepted Answer

Sentinel is priced on the volume of data you ingest per day, which makes the honest answer 'it depends on your log sources' — but the rates themselves are public. On the simplified analytics tier, pay-as-you-go is about $4.30 per GB in East US (roughly ₹361 at ₹84 to the dollar). Commitment tiers start at 100 GB per day and bring that down to an effective rate of about $2.96 per GB (roughly ₹249), a saving of around 31 percent, with larger tiers up to 50,000 GB/day reaching about $2.05 per GB. The break-even point for the 100 GB commitment against pay-as-you-go is roughly 69 GB per day, so a commitment can pay for itself well below the committed volume. The data lake tier is priced separately and far lower for high-volume, low-value logs: around $0.05 per GB to ingest, about $0.026 per GB per month to store — billed on a uniform 6:1 compression rate, so 600 GB of raw data bills as 100 GB — and about $0.005 per GB of uncompressed data scanned by KQL queries. Retention of 90 days is included at no extra charge; beyond that you pay Log Analytics retention rates. There is a 31-day free trial covering the first 10 GB/day. Several things are billed separately and are the classic source of budget surprises: Logic Apps for playbooks, Azure Functions used by some connectors, Security Copilot compute units, and data lake notebook and graph compute. Prices vary by Azure region and Microsoft describes published figures as estimates rather than quotes, so treat these as the shape of the bill rather than your bill. TechBag models your actual GB/day by source and quotes in INR with GST.

Question 3

Is Microsoft Sentinel included in Microsoft 365 E5?

Accepted Answer

No — and this is a common and expensive misunderstanding worth being precise about. Microsoft Defender for Endpoint Plan 2 IS included in Microsoft 365 E5. Microsoft Sentinel is NOT: it is a separate, consumption-billed Azure service, and you pay for the data you ingest into it regardless of which Microsoft 365 licence you hold. What E5 does give you is significant, though, and it is where the confusion comes from. Security alerts from the Defender XDR products — Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps — ingest into Sentinel free of charge, as do Azure Activity logs and Office 365 audit logs covering SharePoint, Exchange and Teams. So an E5 customer gets a substantial amount of high-value security telemetry into Sentinel at no ingest cost. The important nuance in Microsoft's own documentation: while the alerts are free, the raw underlying logs for several of those products are paid data types. A team that connects alerts assumes it is all free, then connects raw advanced-hunting tables and sees a bill. There is also a separate Microsoft 365 E5 benefit that grants a daily free data grant per user for certain security logs. The practical answer: budget for Sentinel as its own line item driven by ingest, and treat the free first-party sources as the reason your effective rate is lower than a non-Microsoft shop's, not as a reason to expect no bill at all. TechBag checks exactly what your licensing already covers before quoting.

Question 4

What happens to Microsoft Sentinel in the Azure portal after March 2027?

Accepted Answer

It goes away, and this is the single most important operational fact for anyone buying or renewing Sentinel today. Microsoft has stated that after 31 March 2027, Microsoft Sentinel will no longer be supported in the Azure portal; all customers using it there will be redirected to the Microsoft Defender portal and will use Sentinel in the Defender portal only. Microsoft has also said that from July 2026, Sentinel is supported in the Defender portal only for the purposes of new capability. The transition itself carries no additional cost — Microsoft is explicit that customers continue to be billed for Sentinel consumption as usual, including non-E5 customers — but 'no cost' is not the same as 'no work'. The changes worth scoping before you migrate: the Fusion analytics rule that correlates alerts in the Azure portal is disabled, with the Defender XDR correlation engine taking over incident creation and alert grouping; Workspace Manager is not available in the Defender portal, so content-as-code or the multitenant portal replaces it; incidents created programmatically through the API, by a Logic App playbook, or manually in the Azure portal do not synchronise to the Defender portal; the IdentityInfo table becomes a native Defender table that does not support table-level RBAC, which matters if you used that to restrict access; some automation-rule conditions behave differently, including the removal of the SecurityIncident Description field, which will break an integration with a ticketing system like ServiceNow that depends on it; and alerts from analytics rules configured to trigger alerts without creating incidents are not visible in the Defender portal. Data storage and privacy policies also switch from Sentinel's to Defender XDR's. None of this is a reason to avoid Sentinel — it is a reason to plan the migration deliberately, and to prefer building new automation against the Defender portal model now rather than the Azure one. TechBag scopes this transition as part of any Sentinel engagement.

Question 5

Where does Microsoft Sentinel store and process our data — and is that the same thing?

Accepted Answer

No, they are two different questions, and for an Indian regulated buyer the difference is the whole point. Storage: Microsoft Sentinel stores data — including customer data — in the same region as the associated Azure Log Analytics workspace. The supported India regions for Sentinel SIEM are Central India, Jio India West and Jio India Central; the data lake is supported in Central India. So you can genuinely keep the raw data in India, and that satisfies a storage-residency requirement. Processing is different, and Microsoft documents it plainly: Sentinel processes customer data in Europe for workspaces located in Europe, in Israel for Israeli workspaces, and in China 21Vianet for those regions — and “for workspaces located in any other location, Microsoft Sentinel processes customer data in a US region.” India is in that last category. Your logs rest in Mumbai or Hyderabad; the correlation, detection and analysis that Sentinel performs on them happens in the United States. That is not a loophole or a misconfiguration — it is the documented design, and it applies to every non-European, non-Israeli, non-China deployment. Two further things worth knowing: when you onboard from the Defender portal, the service may process data in the destination regions chosen at onboarding or in existing Microsoft Defender XDR regions, though the raw data storage location is unchanged; and Sentinel may share data, including customer data, among Microsoft Defender XDR, Azure Log Analytics and Security Copilot. Why this matters commercially: if your obligation is worded as storage or localisation, Sentinel meets it with an India region. If your regulator, your board or your contract speaks about processing, cross-border transfer, or where data is “handled”, you need to put this in front of them BEFORE the PoC, not at the audit. Under India’s DPDP Act and for RBI, SEBI and IRDAI-regulated entities, that is a conversation worth having early. Products that are genuinely on-premises — ManageEngine Log360, FortiSIEM on appliances, Kaspersky KUMA — satisfy both halves by definition, which is a real part of why they stay on Indian shortlists. TechBag will put the Microsoft documentation in front of your compliance team rather than paraphrasing it, and will tell you when an on-prem SIEM is the honest answer for your mandate.

Question 6

How does Microsoft Sentinel compare to Splunk and QRadar?

Accepted Answer

TechBag sells Splunk too, so here is the comparison without the sales pitch. Microsoft Sentinel's genuine strengths are the free first-party Microsoft telemetry, native Defender XDR correlation putting SIEM and XDR alerts in one incident queue, no infrastructure to run because it is SaaS, and the data lake tier making long retention of high-volume logs genuinely affordable. Its genuine weaknesses are that ingest costs from noisy non-Microsoft sources can escalate quickly and less predictably than capacity-based models, and that it is cloud-only on Azure, so on-premises or air-gapped requirements rule it out entirely. Splunk remains the benchmark for raw search power and detection-engineering flexibility, handles genuinely diverse telemetry at scale better than anything else, and deploys on-premises, in cloud or hybrid — it is the right answer for mature teams whose value comes from what they can build, though it has historically been the expensive option and Cisco's ownership is still reshaping its roadmap. IBM QRadar's appeal is EPS-based pricing that a regulated buyer can actually forecast, plus strong out-of-the-box compliance reporting, which is why it held healthcare, financial services and government — but the important current fact is that Palo Alto Networks acquired IBM's QRadar SaaS assets, closing in September 2024, and QRadar SaaS customers are being migrated to Cortex XSIAM, with IBM continuing to support on-premises QRadar clients who stay. Anyone evaluating QRadar SaaS today is really evaluating that migration path; QRadar on-prem remains an IBM product (licensed per EPS/FPM or per managed server), which IBM says it will keep developing with no end-of-life planned. Also worth shortlisting: Google Security Operations, also a 2025 Gartner MQ Leader, priced on committed ingestion volume (quote-only, per Google’s SecOps docs) and built for very large log estates; and Elastic Security, the low-cost and air-gapped-capable route that a lot of engineering teams are already running informally. The honest rule of thumb: if your estate is Microsoft-shaped, Sentinel is usually the most cost-effective and best-integrated choice; if your highest-volume logs are non-Microsoft, or you need on-premises, model the alternatives seriously before committing.

Question 7

Why buy Microsoft Sentinel through TechBag?

Accepted Answer

TechBag is a Bengaluru-headquartered reseller serving pan-India, and because we also sell Splunk and other security platforms, the advice you get is about fit rather than quota. For Sentinel specifically, the most valuable thing we do is the ingest model: inventorying your log sources, estimating GB per day for each, separating the free first-party Microsoft sources from the paid third-party ones, and showing you what the annual bill actually looks like in INR before you commit. That single exercise is where Sentinel projects succeed or blow their budget, and it is the calculation vendors are slowest to help buyers do. Beyond that we scope licensing honestly — checking what your existing Microsoft 365 entitlement already covers, and being clear that Sentinel is a separate consumption charge rather than something bundled into E5 — advise on analytics-tier versus data-lake-tier placement per table, plan the 31 March 2027 Defender portal transition including any automation that depends on Fusion or Workspace Manager, and deploy and tune the detection content so you are not buried in noise. We will also tell you plainly when Sentinel is the wrong answer: if your log volume is dominated by non-Microsoft network gear, or you have an on-premises or air-gapped requirement, we will say so and price the alternative. Everything is quoted in INR with GST-compliant invoicing and local support.

Dimension	No / separate AI tool	Microsoft Sentinel
Pricing axis	Per device or per user	Per GB ingested per day
Microsoft logs	Paid like any other source	Azure Activity, M365, XDR alerts free
High-volume logs	Full rate or drop them	Data lake tier at a fraction of analytics
Infrastructure	Servers, storage, upgrades	SaaS on Azure — nothing to run
SIEM and XDR	Two consoles, manual correlation	One incident queue in Defender
Retention	Priced from day one	90 days included, then charged
Honest caveat	—	Third-party ingest escalates the bill
Best fit	—	Microsoft-standardised estates

Dimension	Microsoft Sentinel	Splunk Enterprise Security	IBM QRadar	Google Security Operations	Elastic Security
Position	Cloud-native SIEM for Microsoft estates	The search-power incumbent	The regulated-industry stalwart	Cloud-agnostic security analytics	Open, ELK-based
Pricing axis	Per GB ingested per day	Workload or ingest — historically costly	On-prem: EPS/FPM or per server	Ingest volume, by subscription	Resource-based; free self-managed tier
Microsoft-estate integration	Native; first-party logs free	Good connectors, paid ingest	Connectors, no native tie	Connectors, no native tie	Connectors, no native tie
Search & detection engineering	KQL — powerful, Azure-shaped	SPL — still the benchmark	AQL, strong OOTB content	YARA-L, very large scale	Lucene/ES\|QL, very flexible
Deployment model	SaaS only, on Azure	Cloud, on-prem or hybrid	Cloud or on-prem	SaaS only, on Google Cloud	Cloud, on-prem, air-gapped
Cost predictability	Varies with log volume — model it first	Historically the expensive option	EPS licensing forecasts cleanly	Committed GB; overage at negotiated rate	Self-managed cost is controllable
Long-term log retention	Data lake tier at ~$0.026/GB/mo	Available, priced accordingly	Available	12 months hot by default	Frozen/searchable snapshots
SOAR & automation	Playbooks on Logic Apps (billed separately)	Splunk SOAR (own product)	QRadar SOAR	Native SOAR included	Basic; often paired with a SOAR
AI in the SOC	Security Copilot + MCP server for agents	Cisco AI Assistant	watsonx-assisted	Gemini-powered	Elastic AI Assistant
The thing to plan around	Azure portal retires 31 Mar 2027	Cisco integration reshaping roadmap	SaaS assets sold to Palo Alto; XSIAM migration	Google Cloud dependency	You run and tune it yourself
Best fit	Microsoft-standardised estates	Mature detection-engineering teams	Regulated buyers needing forecastable cost	Huge volume, cloud-agnostic	Budget-constrained or air-gapped

Microsoft Sentinel

The Microsoft platform family

Quick facts

Understand SIEM economics before you buy it

What is it?

A traditional SIEM bill vs Sentinel’s — the honest table

The five pieces of the platform

Log Analytics workspace

Data connectors

Analytics rules & Fusion

Data lake tier

Defender portal & MCP

Twelve capabilities. Collect, detect, respond.

Hundreds of data connectors

Free first-party ingest

Data lake tier

Ingest-time transformation

Scheduled & near-real-time rules

User & Entity Behaviour Analytics

Advanced hunting (KQL)

Threat intelligence

Playbooks (Logic Apps)

Automation rules

Unified SecOps with Defender

Security Copilot & MCP server

Watch Microsoft Defender in action

Microsoft Sentinel: The AI-ready security platform

Introduction to Microsoft Sentinel data lake

Cost management in Microsoft Sentinel data lake

AI works best where the work already happens.

The bill is ingest, not seats — and Microsoft logs are free

The data lake tier fixed the worst part of SIEM economics

One incident queue across SIEM and XDR

The deadline you must plan around: 31 March 2027

The honest caveat — third-party ingest is where budgets break

The honest positioning

The numbers behind the platform

What your Microsoft Sentinel rollout looks like

Model the ingest

Workspace & connectors

Detections & automation

Defender portal & steady state

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag SIEM Grid

SIEM Depth × Cost Predictability

Microsoft Sentinel vs the field

Does Microsoft Sentinel fit you?

Choose Microsoft Sentinel if…

Choose Splunk if…

Choose IBM QRadar if…

Choose Google Security Operations if…

Choose Elastic Security if…

What will your ingest actually cost?

Three ways to consume it

Analytics tier — pay-as-you-go

Analytics tier — commitment

Data lake tier

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 9 questions to ask every SIEM vendor

Questions buyers ask

Ready to evaluate Microsoft Sentinel?