Forum Discussion
Solved
RE: Commitment Tiers in Microsoft Sentinel
If you choose a commitment tier of 100 GB per day, are you charged the fixed rate per day OR the amount of GB I use per day, say 50GB? So, let's say I use, on average, 50GB for 30 days, and I am ...
- In that Workbook I used this logic, however that was before the recent pricing changes, so I do need to go back and compare to the calculator to see if an update is needed.
i between (51 .. 180),"100",
i between (181 .. 286),"200",
i between (287 .. 390),"300",
i between (391 .. 476),"400",
i between (477 .. 975),"500",
i between (976 .. 1897),"1000",
i between (1898 .. 4729),"2000",
i >= 4730 ,"5000",
The tier thresholds are to do with the "saving over PAYG" you see some of that here - the % makes the difference.
https://azure.microsoft.com/en-gb/pricing/details/microsoft-sentinel/
Not sure if I understand your question so feel free to clarify if this doesn't answer it!
Only PAYG allows you to pay per GB, any other Tier is per day. So no matter if on T1 you're ingesting 1GB or 99GB, you will still be paying the set price for your location as per this calculator (and any overage will be calculated on top):
https://azure.microsoft.com/en-gb/pricing/details/microsoft-sentinel/#pricing
If it wasn't the case, everyone would be on the highest tier to take advantage of the cheapest per GB rate, no matter what their actual usage is...
Only PAYG allows you to pay per GB, any other Tier is per day. So no matter if on T1 you're ingesting 1GB or 99GB, you will still be paying the set price for your location as per this calculator (and any overage will be calculated on top):
https://azure.microsoft.com/en-gb/pricing/details/microsoft-sentinel/#pricing
If it wasn't the case, everyone would be on the highest tier to take advantage of the cheapest per GB rate, no matter what their actual usage is...
Thank you for your quick reply KubaTom...
I know it sounds like a simple point, but clarification is needed when dealing with what I call uncommitted data, not used...
So I am saying IF I am using the commitment Tier mentioned (so 100GB per day @ $200 per day) and I ONLY use 50GB, then I have 50GB 'un-committed' log storage not used. Am I basically still charged $200 per day, no matter what...
Not set up by me, but I have a client questioning why they should stick to this commitment tier, as they are constantly underutilising it.
I know it sounds like a simple point, but clarification is needed when dealing with what I call uncommitted data, not used...
So I am saying IF I am using the commitment Tier mentioned (so 100GB per day @ $200 per day) and I ONLY use 50GB, then I have 50GB 'un-committed' log storage not used. Am I basically still charged $200 per day, no matter what...
Not set up by me, but I have a client questioning why they should stick to this commitment tier, as they are constantly underutilising it.
You are making a "commitment" to a commitment tier, signing up for 31days at that level. You should monitor before, monitor during and then decide after the commitment what to do next (you might stay the same, go down a tier, or even up). This isn't a set and forget.
You need your average GB per day to put into the calculator + the knowledge of what you are likely to ingest in the next 31days. Pricing Calculator | Microsoft Azure
50Gb example - PAYG recommended51Gb+ would be 100GB/day Tier (the display will change in the calculator).
As an example, I'd get a sense that this workspace below isn't likely to grow (based on the last 30days). However if you plan to add a few firewalls then that ingestion profile may change pretty quicklyIn fact the 90day predication is downwards (red line). Switching to 90days lookback is advised, for this predication.
- Hi Clive_Watson.
THAT is exactly what I needed to understand...
I understand, in principle WHAT the Commitment Tier is doing with fixed pricing, BUT it is difficult to follow where the boundary settings are triggered, Clive...
I see with the 100GB commitment, it is basically triggered at 51GB as you say...
What I find interesting is the next tier (200GB) is triggered at 181GB!
I have used the workbook you mention...I will delve further into it now.
Thanks for the clarification, Clive.- In that Workbook I used this logic, however that was before the recent pricing changes, so I do need to go back and compare to the calculator to see if an update is needed.
i between (51 .. 180),"100",
i between (181 .. 286),"200",
i between (287 .. 390),"300",
i between (391 .. 476),"400",
i between (477 .. 975),"500",
i between (976 .. 1897),"1000",
i between (1898 .. 4729),"2000",
i >= 4730 ,"5000",
The tier thresholds are to do with the "saving over PAYG" you see some of that here - the % makes the difference.
https://azure.microsoft.com/en-gb/pricing/details/microsoft-sentinel/
- It's a balancing game - they need to do their own calculations and see if it's not going to be cheaper in a long run if they drop a tier lower or go PAYG. Also need to take into account any near-future changes to ingestion volumes, like new onboarding, increasing logging levels etc.
If budgeted and calculated correctly, then you won't be paying for an unused service as one option or another will be cheaper and actually a saving over another, even by a few quid.
Remember that you can switch tiers every 31 days, so you've still got some flexibility!
