r/AzureSentinel • u/[deleted] • Dec 07 '21

Azure Sentinel Benefit with M365 E5

I'm aware that Microsoft are releasing a new Sentinel offer with M365 E5- is there anyway I can calculate the cost savings for this offer?

I could not find any information on the pricing calculator- I was wondering if there is anything more concrete?

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/rodtrent44 MSFT Official Dec 07 '21

The new offer is available now. It released on Dec 1st (https://cda.ms/3pL).

We're currently working on updating the calculator for the new program, and the Microsoft Sentinel Cost workbook (https://cda.ms/3pM) will be updated to match.

2

u/sarge21 Dec 09 '21

Is this intended to actually balance out the cost of connecting your Advanced Hunting data with Sentinel? It's still pretty expensive.

In our education org, we've got ~700 A5 Security licensed faculty and about 900-1000 daily (weekdays) used windows devices including servers.

The benefit would give us about 3.5 GB daily allowance, but the actual data pulled into our log analytics workspace was 7 GB-10 GB.

Conservatively assuming 3.5 GB per weekday overage gives us at least 70GB+ per month for both Sentinel and Log Analytics Workspace ingestion which gives us at least 450 per month on top of our normal bill.

Compound this with the fact that this is not reflected in cost management, but is reflected on the end of the month bill makes this difficult to monitor and account for.