Azure Monitor cost 2026: the Log Analytics bill explained

Microsoft is explicit in its own documentation: for most Azure Monitor implementations, the most significant charges are ingestion and retention of data in Log Analytics workspaces. Everything else (platform metrics, the Azure activity log, alert rules, Application Insights) either rides on top of that data or is a comparatively minor line item. So understanding the Azure Monitor bill means understanding the Log Analytics meters first.

The default table plan, Analytics Logs, ingests at roughly $2.30 per gigabyte after a free monthly allowance of 5 GB per workspace. That is materially more expensive per gigabyte than AWS CloudWatch Logs at $0.50 per gigabyte, and it is the figure that gives Azure Monitor its reputation for being pricey. But the headline rate overstates the real cost for two reasons. First, Azure bills the calculated record size, not the raw event: standard columns are excluded and the billed volume runs on average about 25 percent below the incoming JSON-packaged event size. Second, Analytics is only one of three table plans. Basic Logs ingest at roughly $0.50 per gigabyte and Auxiliary Logs at roughly $0.05 per gigabyte, so moving high-volume verbose data off the Analytics meter changes the economics entirely.

Retention is the second meter. Interactive (hot, fully queryable) retention is included free for the first 31 days, then bills at roughly $0.10 per gigabyte per month, configurable up to two years. Beyond that, long-term retention holds data at roughly $0.02 per gigabyte per month for up to twelve years, with a search-job charge per gigabyte scanned when you need to retrieve it. For compliance-driven log hoards, the long-term tier is five times cheaper than keeping data interactively queryable.

All of these rates are set regionally, so a workspace in a higher-cost region pays more than the figures above, which reflect typical commercial regions. The numbers here are list pay-as-you-go rates; the commitment tiers below and any Azure Commitment Discounts from an Enterprise Agreement apply on top.

A small workload of 10 VMs sending around 5 GB per day of Analytics Logs ingests roughly 150 GB per month. After the 5 GB free allowance, that is about 145 GB at roughly $2.30, near $330 per month, with retention covered inside the free 31-day window. This is the scenario where the $2.30 Analytics rate stings most, because a small team has not yet split verbose logs into Basic tables and has nothing to commit to a tier.

A mid-market workload of 100 VMs at around 100 GB per day ingests roughly 3,000 GB per month. At the pay-as-you-go Analytics rate that is near $6,900 per month; moving to the 100 GB-per-day commitment tier (up to about 30 percent off) brings the effective rate down toward $4,800 per month, and routing the noisiest tables (firewall, IIS, verbose application logs) to Basic Logs at roughly $0.50 per gigabyte cuts it further. Ninety-day interactive retention on the retained volume adds the roughly $0.10 per gigabyte per month retention meter beyond the free 31 days.

An enterprise or security-heavy workload is where table-plan discipline decides the bill. Keeping operational data and Microsoft Sentinel security data in separate workspaces avoids paying Sentinel meters on operational logs; pushing compliance archives to long-term retention at roughly $0.02 per gigabyte per month rather than holding them interactively is a five-fold saving; and combining workloads to reach a commitment tier that neither would reach alone can flip the economics. At this scale the difference between a naive all-Analytics configuration and a tuned one is routinely two to three times the monthly bill.