question

traz-5632 avatar image
0 Votes"
traz-5632 asked MarileeTurscak-MSFT answered

What event IDs are considered authentication by the AADDS pricing table?

I'm trying to calculate what SKU i would need to shift my current AD on-prem to AADDS.

According to this table https://azure.microsoft.com/en-us/pricing/details/active-directory-ds/
- Enterprise SKU is recommended for 3K to 10K auths/hour.
- Premium SKU is recommended for 10K to 70K auths/hour.

Are these numbers based on a single replica set (2 DCs)? More replica sets => more auths/hour?

I have captured events 4776 and 4648 from all my local DCs and the number exceeds 70K per hour. Does it mean I would need 2 premium replica sets?

Is there any way to calculate how many auths/hour I need? What events should I capture from my DCs?

azure-ad-domain-services
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

MarileeTurscak-MSFT avatar image
0 Votes"
MarileeTurscak-MSFT answered

Hi @traz-5632,

Since your calculation is pretty specific your best bet would be to speak with someone on the Billing team or create a free ticket with them to figure out the total cost.

The two you mentioned are related to authentication attempts, and since the pricing page includes the number of requests I believe these would be included:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648

https://azure.microsoft.com/en-us/support/options/

https://azure.microsoft.com/en-us/support/create-ticket/

For authentication information, you can also check the sign-in logs: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.