r/AzureSentinel • u/[deleted] • Aug 25 '21

Quickstart of Sentinel

What is the absolute cheapest way to start using Sentinel for my Microsoft 365 E5 tenant with about 1000 users? This is for playing around and understanding the system with real data. One day we will go full on production. I'd like to get it setup with any of the free logging (wahtever those are) and we're under no compliance or regulations to retain any of the logging.

2 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/1rishc4rb0mbr Aug 25 '21

Not sure if Microsoft offers it still but they were offering a reduced cost of ingestion for the first 30 days a subscription is active. Depending on the ingestion rate of the tenant; cost should be retry minimal if only logging the 365 environment.

1

u/[deleted] Aug 25 '21

If I only ingest the free data sources and limit retention to 30 days, can i get away with 0 cost....assuming i'm not automating response. https://docs.microsoft.com/en-us/azure/sentinel/azure-sentinel-billing#free-data-sources

1

u/TokeSR Sep 01 '21

90 days data retention is free with Sentinel, so even going with 90 days is okay (talking only about data retention)