# Non-Security Data Ingested into Microsoft Sentinel Workspaces Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/non-security-data-ingested-into-microsoft-sentinel-workspaces Microsoft Sentinel is enabled on a Log Analytics workspace, and once it is, Sentinel analyzes and bills all data collected in that workspace. By: PointFive Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) The short version Microsoft Sentinel is enabled on a Log Analytics workspace, and once it is, Sentinel analyzes and bills all data collected in that workspace. PointFive Research Cloud cost research at PointFive Azure service [Microsoft Sentinel](https://www.pointfive.co/efficiency-hub/cloud-services/microsoft-sentinel) Category [Other](https://www.pointfive.co/efficiency-hub/service-category/other) Reference CER-0427 Type Inefficient Architecture ## Explanation Why the waste happens and who it affects. Azure Monitor's documentation states that when Sentinel is enabled, all data collected in the workspace is subject to Microsoft Sentinel charges along with Log Analytics charges. Operational telemetry that has nothing to do with threat detection, such as performance counters, application traces, container logs and verbose resource diagnostics, therefore pays the security analytics rate if it lands in the SOC workspace. This happens through consolidation: a single central workspace is created for everything, Sentinel is later enabled on it, or diagnostic settings and agents across the estate default to the same workspace. Microsoft's guidance is direct: Sentinel's cost reduction page recommends a separate workspace for non-security operations data so it doesn't incur Sentinel costs, and the Azure Monitor cost checklist asks teams to decide deliberately whether to combine operational and security data. The main exception Microsoft notes is when neither data set alone is large enough to reach a commitment tier but the combined volume is. ## Billing model The pricing dimensions that drive this cost. Sentinel-enabled workspaces are billed on Sentinel meters for the data they receive. Analytics tier ingestion Billed per GB on pay-as-you-go or through commitment tiers starting at 100 GB per day; on simplified pricing tiers this single Sentinel charge includes Log Analytics ingestion Classic pricing tiers Older workspaces pay Sentinel analysis charges on top of separate Log Analytics ingestion charges Data lake tier Lower-cost ingestion, processing, storage and query meters for secondary security data kept out of the analytics tier Free data sources Some sources, such as Azure Activity logs, Office 365 audit logs and Microsoft security alerts, are not charged ## How to detect 4 checks to find it in your estate. - For each Sentinel-enabled workspace, query the Usage table for billable volume by DataType over the last 30 days and flag large operational tables such as Perf, AppTraces, AppRequests, ContainerLogV2, InsightsMetrics and AzureDiagnostics - Use Log Analytics workspace insights to see billable data by table and by source resource, and identify which resources and data collection rules send operational data to the SOC workspace - Review diagnostic settings and data collection rules that target the Sentinel workspace for categories used only for application or infrastructure monitoring - Check whether operational data is in the same workspace only to reach a commitment tier, by comparing security-only volume with the lowest commitment tier ## How to fix 5 ways to remove the waste. - Create a separate Log Analytics workspace without Sentinel for operational monitoring and repoint diagnostic settings, Azure Monitor Agent data collection rules and Application Insights resources to it - Move lower-fidelity or secondary security data that is not needed for real-time detection to the Sentinel data lake tier under Data management, Tables - Filter Windows Security Events and other agent-collected sources with data collection rules so only the events used by detections are ingested - Recheck the commitment tier after moving data, since the analytics volume will drop; lowering a commitment tier is allowed only after the 31-day commitment period - Keep cross-workspace queries in mind: splitting workspaces means some investigations must query both, which Sentinel and Log Analytics support ## Documentation Vendor references for pricing and configuration. - [Reduce costs for Microsoft Sentinel learn.microsoft.com](https://learn.microsoft.com/en-us/azure/sentinel/billing-reduce-costs) - [Plan costs and understand pricing and billing - Microsoft Sentinel learn.microsoft.com](https://learn.microsoft.com/en-us/azure/sentinel/billing) - [Azure Monitor Logs Cost Calculations And Options learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs) - [Cost optimization in Azure Monitor learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/best-practices-cost) - [Microsoft Sentinel Pricing microsoft.com](https://www.microsoft.com/en-us/security/pricing/microsoft-sentinel/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Microsoft Fabric CER-0337 ### [Oversized Microsoft Fabric Capacity During Low-Utilization Periods](https://www.pointfive.co/efficiency-hub/inefficiencies/oversized-microsoft-fabric-capacity-during-low-utilization-periods) Microsoft Fabric capacity is billed based on the provisioned SKU tier (F2, F4, F8, F16, F64, etc.) on an hourly basis, regardless of whether workloads are actively consuming those resources. Each SKU tier provides a fixed pool of Capacity... Other - Azure Container Registry CER-0329 ### [Overprovisioned or Idle Azure Container Registry Tier](https://www.pointfive.co/efficiency-hub/inefficiencies/overprovisioned-or-idle-azure-container-registry-tier) Azure Container Registry charges a fixed daily fee based on the selected tier - Basic, Standard, or Premium - regardless of whether the registry is actively used. This means a registry with zero image pulls, zero pushes, and no active... Other - Azure Logic Apps CER-0309 ### [Idle or Untriggered Azure Logic Apps Generating Continuous Charges](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-or-untriggered-azure-logic-apps-generating-continuous-charges) Azure Logic Apps can quietly accumulate costs even when no workflows are actively executing, but the mechanism differs significantly depending on the deployment model. In the Consumption (multitenant) plan, Logic Apps with polling triggers... Other --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.