What is the method for splitting Azure Sentinel costs based on the log volume originating from a specific subscription?

To allocate Azure Sentinel costs based on log volume from specific subscriptions, you have a couple of options:

1. Separate Microsoft Sentinel Instances: Creating a separate Microsoft Sentinel instance for each subscription is a straightforward way to manage costs. This allows you to track and allocate costs directly based on the logs ingested from each subscription. You can manage the configurations and rules using Terraform, which can help automate the deployment and management of these instances.
2. Consolidated Log Analytics Workspaces: Alternatively, you can consolidate multiple Log Analytics workspaces into a single Microsoft Sentinel instance. This approach can be beneficial if the combined log volume from all subscriptions reaches a commitment tier, potentially leading to cost savings. However, this may complicate cost allocation since all logs will be aggregated in one instance.

Regarding the transition of Microsoft Sentinel to the Microsoft Defender platform, it is essential to understand how costs will be structured in that environment. If there is only one Microsoft Sentinel instance within the Microsoft Defender platform, you will need to implement a strategy to allocate costs based on the logs collected from each client. This could involve tagging logs or using specific naming conventions to differentiate between clients, allowing for more straightforward reporting and cost allocation.

In your example with logs from several KeyVaults belonging to different clients, you could consider using Azure's resource tagging features to tag resources by client. This would help in tracking usage and costs associated with each client, even if all logs are collected in a single Sentinel instance.

Ultimately, the choice between separate instances or a consolidated approach depends on your specific needs for cost tracking, management complexity, and the volume of logs being processed.

References:

• Prepare for multiple workspaces and tenants in Microsoft Sentinel
• Reduce costs for Microsoft Sentinel