Azure Monitor cost and usage

This article describes the different ways that Azure Monitor charges for usage and how to evaluate charges on your Azure bill.

Tip

For strategies to reduce your Azure Monitor costs, see Cost optimization and Azure Monitor.

Pricing model

Azure Monitor uses a consumption-based pricing (pay-as-you-go) billing model where you only pay for what you use. Features of Azure Monitor that are enabled by default do not incur any charge, including collection and alerting on the Activity log and collection and analysis of platform metrics.

Several other features don't have a direct cost, but you instead pay for the ingestion and retention of data that they collect. The following table describes the different types of usage that are charged in Azure Monitor. Detailed current pricing for each is provided in Azure Monitor pricing.

Type Description
Logs Ingestion, retention, and export of data in Log Analytics workspaces and legacy Application insights resources. This will typically be the bulk of Azure Monitor charges for most customers. There is no charge for querying this data except in the case of Basic Logs or Archived Logs.

Charges for Logs can vary significantly on the configuration that you choose. See Azure Monitor Logs pricing details for details on how charges for Logs data are calculated and the different pricing tiers available.
Platform Logs Processing of diagnostic and auditing information is charged for certain services when sent to destinations other than a Log Analytics workspace. There's no direct charge when this data is sent to a Log Analytics workspace, but there is a charge for the workspace data ingestion and collection.
Metrics There is no charge for standard metrics collected from Azure resources. There is a cost for collecting custom metrics and for retrieving metrics from the REST API.
Prometheus Metrics Pricing for Azure Monitor managed service for Prometheus is based on data samples ingested and query samples processed. Data is retained for 18 months at no extra charge.
Alerts Alerts are charged based on the type and number of signals used by the alert rule, its frequency, and the type of notification used in response. For log search alerts configured for at scale monitoring, the cost will also depend on the number of time series created by the dimensions resulting from your query.
Web tests There is a cost for standard web tests and multi-step web tests in Application Insights. Multi-step web tests have been deprecated.

A list of Azure Monitor billing meter names is available here.

Data transfer charges

Sending data to Azure Monitor can incur data bandwidth charges. As described in the Azure Bandwidth pricing page, data transfer between Azure services located in two regions charged as outbound data transfer at the normal rate. Inbound data transfer is free. Data transfer charges for Azure Monitor though are typically very small compared to the costs for data ingestion and retention. You should focus more on your ingested data volume to control your costs.

Note

Data sent to a different region using Diagnostic Settings does not incur data transfer charges

View Azure Monitor usage and charges

There are two primary tools to view, analyze and optimize your Azure Monitor costs. Each is described in detail in the following sections.

Tool Description
Azure Cost Management + Billing Gives you powerful capabilities use to understand your billed costs. There are multiple options to analyze your charges for different Azure Monitor features and their projected cost over time.
Usage and Estimated Costs Provides estimates of log data ingestion costs based on your daily usage patterns to help you optimize to use the most cost-effective logs pricing tier.

Azure Cost Management + Billing

To get started analyzing your Azure Monitor charges, open Cost Management + Billing in the Azure portal. This tool includes several built-in dashboards for deep cost analysis like cost by resource and invoice details. Select Cost Management and then Cost analysis. Select your subscription or another scope.

Note

You might need additional access to use Cost Management data. See Assign access to Cost Management data.

Screenshot that shows Azure Cost Management with cost information.

To limit the view to Azure Monitor charges, create a filter for the following Service names. See Azure Monitor billing meter names for the different billing meters that are included in each service.

  • Azure Monitor
  • Log Analytics
  • Insight and Analytics
  • Application Insights

Other services such as Microsoft Defender for Cloud and Microsoft Sentinel also bill their usage against Log Analytics workspace resources, so you might want to add them to your filter. See Common cost analysis uses for details on using this view.

Note

Alternatively, you can go to the Overview page of a Log Analytics workspace or Application Insights resource and click View Cost in the upper right corner of the Essentials section. This will launch the Cost Analysis from Azure Cost Management + Billing already scoped to the workspace or application. Screenshot of option to view cost for Log Analytics workspace.

Automated mails and alerts

Rather than manually analyzing your costs in the Azure portal, you can automate delivery of information using the following methods.

  • Daily cost analysis emails. Once you've configured your Cost Analysis view, you should click Subscribe at the top of the screen to receive regular email updates from Cost Analysis.
    • Budget alerts. To be notified if there are significant increases in your spending, create a budget alerts for a single workspace or group of workspaces.

Export usage details

To gain deeper understanding of your usage and costs, create exports using Cost Analysis. See Tutorial: Create and manage exported data to learn how to automatically create a daily export you can use for regular analysis.

These exports are in CSV format and will contain a list of daily usage (billed quantity and cost) by resource, billing meter, and several other fields such as AdditionalInfo. You can use Microsoft Excel to do rich analyses of your usage not possible in the Cost Analytics experiences in the portal.

For example, usage from Log Analytics can be found by first filtering on the Meter Category column to show

  1. Log Analytics (for Pay-as-you-go data ingestion and interactive Data Retention),
  2. Insight and Analytics (used by some of the legacy pricing tiers), and
  3. Azure Monitor (used by most other Log Analytics features such as Commitment Tiers, Basic Logs ingesting, Data Archive, Search Queries, Search Jobs, etc.)

Add a filter on the Instance ID column for contains workspace or contains cluster. The usage is shown in the Consumed Quantity column. The unit for each entry is shown in the Unit of Measure column.

Note

See Azure Monitor billing meter names for a reference of the billing meter names used by Azure Monitor in Azure Cost Management + Billing.

View data allocation benefits

There are several approaches to view the benefits a workspace receives from various offers such as the Defender for Servers data allowance and the Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers.

View benefits in a usage export

Since a usage export has both the number of units of usage and their cost, you can use this export to see the amount of benefits you are receiving. In the usage export, to see the benefits, filter the Instance ID column to your workspace. (To select all of your workspaces in the spreadsheet, filter the Instance ID column to "contains /workspaces/".) Then filter on the Meter to either of the following two meters:

View benefits in Usage and estimated costs

You can also see these data benefits in the Log Analytics Usage and estimated costs page. If the workspace is receiving these benefits, there will be a sentence below the cost estimate table that gives the data volume of the benefits used over the last 31 days.

Screenshot of monthly usage with benefits from Defender and Sentinel offers.

Query benefits from the Operation table

The Operation table contains daily events which given the amount of benefit used from the Defender for Servers data allowance and the Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers. The Detail column for these events are all of the format Benefit amount used 1.234 GB, and the type of benefit is in the OperationKey column. Here is a query that charts the benefits used in the last 31-days:

Operation
| where TimeGenerated >= ago(31d)
| where Detail startswith "Benefit amount used"
| parse Detail with "Benefit amount used: " BenefitUsedGB " GB"
| extend BenefitUsedGB = toreal(BenefitUsedGB)
| parse OperationKey with "Benefit type used: " BenefitType 
| project BillingDay=TimeGenerated, BenefitType, BenefitUsedGB
| sort by BillingDay asc, BenefitType asc
| render columnchart 

(This functionality of reporting the benefits used in the Operation table started January 27, 2024.)

Tip

If you increase the data retention of the Operation table, you will be able to view these benefit trends over longer periods.

Usage and estimated costs

You can get additional usage details about Log Analytics workspaces and Application Insights resources from the Usage and Estimated Costs option for each.

Log Analytics workspace

To learn about your usage trends and optimize your costs using the most cost-effective commitment tier for your Log Analytics workspace, select Usage and Estimated Costs from the Log Analytics workspace menu in the Azure portal.

Screenshot of usage and estimated costs screen in Azure portal.

This view includes the following:

A. Estimated monthly charges based on usage from the past 31 days using the current pricing tier.
B. Estimated monthly charges using different commitment tiers.
C. Billable data ingestion by solution from the past 31 days.

To explore the data in more detail, click on the icon in the upper-right corner of either chart to work with the query in Log Analytics.

Screenshot of log query with Usage table in Log Analytics.

Application insights

To learn about your usage trends for your classic Application Insights resource, select Usage and Estimated Costs from the Applications menu in the Azure portal.

Screenshot of usage and estimated costs for Application Insights in Azure portal.

This view includes the following:

A. Estimated monthly charges based on usage from the past month.
B. Billable data ingestion by table from the past month.

To investigate your Application Insights usage more deeply, open the Metrics page, add the metric named Data point volume, and then select the Apply splitting option to split the data by "Telemetry item type".

Operations Management Suite subscription entitlements

Customers who purchased Microsoft Operations Management Suite E1 and E2 are eligible for per-node data ingestion entitlements for Log Analytics and Application Insights. Each Application Insights node includes up to 200 MB of data ingested per day (separate from Log Analytics data ingestion), with 90-day data retention at no extra cost.

To receive these entitlements for Log Analytics workspaces or Application Insights resources in a subscription, they must use the Per-Node (OMS) pricing tier. This entitlement isn't visible in the estimated costs shown in the Usage and estimated cost pane.

Depending on the number of nodes of the suite that your organization purchased, moving some subscriptions into a Per GB (pay-as-you-go) pricing tier might be advantageous, but this requires careful consideration.

Also, if you move a subscription to the new Azure monitoring pricing model in April 2018, the Per GB tier is the only tier available. Moving a subscription to the new Azure monitoring pricing model isn't advisable if you have an Operations Management Suite subscription.

Tip

If your organization has Microsoft Operations Management Suite E1 or E2, it's usually best to keep your Log Analytics workspaces in the Per-Node (OMS) pricing tier and your Application Insights resources in the Enterprise pricing tier.

Next steps