Azure Sentinel P1/P2 license

Question

Hello,

I have question about Azure P1/P2 licensing for Azure sentinel

For example I have Azure Sentinel and Azure AD data connector but i only could collect Audit logs.

For Azure AD Sign-in collecting I need P1/P2 license.

How many license I should buy to use this feature?

Could I buy 1 license and cover all Azure Sentinel features with this license or I need to buy as many license as I have endpoints?

What would be your recommendation? I don't have any information on Microsoft sites about this.

Thank you!

Answer 1

HI @Eduards

There's really no licensing for Azure Sentinel itself. Instead, make sure your licensing for the services that contain the data you want to connect to Azure Sentinel is licensed appropriately. For example, to export sign-in data from Azure AD, you need an Azure AD P1 or P2 license. So, at minimum, you would want Microsoft 365 E3 which includes P1.

information:https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/

if my answer is helpful please accept my answer

Thanks & Regards,
Sarat chandra

Answer 2

@Eduards Azure AD P1/P2 license comes per user. For Sentinel to be able to get the Sign-In logs you will need to Assign P1 or P2 license per user.
The logic is you will be able to send logs for those users who have p1 or P2 enabled for them.

Other features under P2 would have been available for whole organization even while not assigning P1 or P2 for everyone.
But in Sentinel scenario, you get the sign in logs for users who are License enabled.

Let me know if you have any questions.

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

Hello @VipulSparsh-MSFT is there somewhere documentation of this with link?

Thank you!