Microsoft Azure is a cloud computing platform and infrastructure for building, deploying, and managing applications and services through a global network of Microsoft-managed datacenters.
$29
per month
Microsoft Sentinel
Score 8.7 out of 10
N/A
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
$2.46
per GB ingested
Pricing
Microsoft Azure
Microsoft Sentinel
Editions & Modules
Developer
$29
per month
Standard
$100
per month
Professional Direct
$1000
per month
Basic
Free
per month
Azure Sentinel
$2.46
per GB ingested
100 GB per day
$123.00
per day
200 GB per day
$221.40
per day
300 GB per day
$319.80
per day
400 GB per day
$410.00
per day
500 GB per day
$492.00
per day
More than 500 GB per day
$492.00 + $98.40
per day/plus each additional 100 GB increment
Offerings
Pricing Offerings
Microsoft Azure
Microsoft Sentinel
Free Trial
Yes
Yes
Free/Freemium Version
Yes
No
Premium Consulting/Integration Services
No
No
Entry-level Setup Fee
No setup fee
No setup fee
Additional Details
The free tier lets users have access to a variety of services free for 12 months with limited usage after making an Azure account.
ArcSight is an on-prem solution that has a different approach than Sentinel.
In a basis this product is more complex to maintain and deploy. The query functionality in Sentinel is more powerful and easier to maintain. ArcSight has a much slower performance and an interface that …
Azure is particularly well suited for enterprise environments with existing Microsoft investments, those that require robust compliance features, and organizations that need hybrid cloud capabilities that bridge on-premises and cloud infrastructure. In my opinion, Azure is less appropriate for cost-sensitive startups or small businesses without dedicated cloud expertise and scenarios requiring edge computing use cases with limited connectivity. Azure offers comprehensive solutions for most business needs but can feel like there is a higher learning curve than other cloud-based providers, depending on the product and use case.
Specifically for Microsoft Sentinel, it's going to have what's next to no value if you're not on Azure. You have to be in as your customer. If you want greater insight into what is going on in your cloud environment, turn Microsoft Sentinel on, but focus on where you enable it. You're not going to turn it on to see everything because it's not like focus on the areas where you are at risk or you believe you're at risk or something that you're, depending on your environment, do you have multiple subscriptions? Do you have a Microsoft Sentinel subscription that you just turned on, but it's not getting the visibility, and then you can alert on stuff that goes out of trend, etc.?
Microsoft Azure is highly scalable and flexible. You can quickly scale up or down additional resources and computing power.
You have no longer upfront investments for hardware. You only pay for the use of your computing power, storage space, or services.
The uptime that can be achieved and guaranteed is very important for our company. This includes the rapid maintenance for security updates that are mostly carried out by Microsoft.
The wide range of capabilities of services that are possible in Microsoft Azure. You can practically put or create anything in Microsoft Azure.
Strong integration with the Microsoft security ecosystem allows seamless connection to services such as Microsoft Defender, Microsoft 365, and Azure. This makes it easy to bring together identity, endpoint, and cloud signals to support investigation and detection scenarios.
Effective correlation of alerts and incidents in collaboration with Microsoft Defender XDR helps combine related signals into higher‑fidelity incidents. This reduces noise and improves visibility into attack context, making investigations more efficient.
High scalability for data ingestion and processing enables large volumes of security telemetry to be handled efficiently.
The cost of resources is difficult to determine, technical documentation is frequently out of date, and documentation and mapping capabilities are lacking.
The documentation needs to be improved, and some advanced configuration options require research and experimentation.
Microsoft's licensing scheme is too complex for the average user, and Azure SQL syntax is too different from traditional SQL.
I think it's primarily going to be cost, since Microsoft Sentinel uses Microsoft Log Analytics as its base, right? So storing the logs and log retention is very expensive. That might result in users not adopting it as quickly. Second, I think Copilot for security can just do summarization and not many remediation tasks. In the future, we would like to see Copilot create many playbooks, including all box playbooks, to remediate many security issues.
Moving to Azure was and still is an organizational strategy and not simply changing vendors. Our product roadmap revolved around Azure as we are in the business of humanitarian relief and Azure and Microsoft play an important part in quickly and efficiently serving all of the world. Migration and investment in Azure should be considered as an overall strategy of an organization and communicated companywide.
As Microsoft Azure is [doing a] really good with PaaS. The need of a market is to have [a] combo of PaaS and IaaS. While AWS is making [an] exceptionally well blend of both of them, Azure needs to work more on DevOps and Automation stuff. Apart from that, I would recommend Azure as a great platform for cloud services as scale.
The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.
We were running Windows Server and Active Directory, so [Microsoft] Azure was a seamless transition. We ran into a few, if any support issues, however, the availability of Microsoft Azure's support team was more than willing and able to guide us through the process. They even proposed solutions to issues we had not even thought of!
As I have mentioned before the issue with my Oracle Mismatch Version issues that have put a delay on moving one of my platforms will justify my 7 rating.
As I continue to evaluate the "big three" cloud providers for our clients, I make the following distinctions, though this gap continues to close. AWS is more granular, and inherently powerful in the configuration options compared to [Microsoft] Azure. It is a "developer" platform for cloud. However, Azure PowerShell is helping close this gap. Google Cloud is the leading containerization platform, largely thanks to it building kubernetes from the ground up. Azure containerization is getting better at having the same storage/deployment options.
Microsoft Sentinel excels in cloud-native scalability, Microsoft ecosystem integration, and AI-driven threat detection with UEBA and Fusion rules, offering faster deployment and lower costs (48% cheaper per Forrester) than Splunk, QRadar, Exabeam, SentinelOne, Securonix, and Wazuh. It lags in third-party integrations and syslog parsing. Organizations choose Microsoft Sentinel for its cost-effectiveness, automation, and Microsoft synergy, especially in Azure-heavy environments, though Splunk and Exabeam lead in flexibility and UEBA, respectively.
For about 2 years we didn't have to do anything with our production VMs, the system ran without a hitch, which meant our engineers could focus on features rather than infrastructure.
DNS management was very easy in Azure, which made it easy to upgrade our cluster with zero downtime.
Azure Web UI was easy to work with and navigate, which meant our senior engineers and DevOps team could work with Azure without formal training.
As any cybersecurity product, this has to be more with risk to avoid loss in case of a ransomware that more than relate to a productivity increase. Maybe the impact could be that instead of having people that are checking 24/7 the dashboard, you could implement Sentinel and have less people checking that or people with less expertise. So the saving will be a minor but will be a saving in the cost of your team.
