Skip to content
Logmetry
What we solve
SIEM and log costClean data for AI agentsCoverage, audit and PIIVendor independenceSIEM migrationObservability modernizationAll problems we solve
Who it’s for
For the CISOFor the CIO and CTOFor the CFOFor Architects
Platforms
SplunkMicrosoft SentinelCrowdStrikeElasticDatadogDynatraceSplunk ObservabilitySolarWindsCriblOpenTelemetryA Data LakeCompare the options
The Blueprint
The whole methodPhase 01 · FoundationPhase 02 · AI triagePhase 03 · RemediationPhase 04 · FootprintEverything as codeAI native
JournalAbout
About LogmetryYour teamTrust and securityStep one and the proofWhere we fit
Book the review

The journalEconomics

Why Sentinel commitment tiers do not work for MSPs

Sentinel prices commitment tiers per workspace with no ability to pool across tenants. For MSPs managing 30 clients, that means 30 separate cost buckets with no optimization. Here is what a pipeline layer changes.

Zbigniew Gajuk2026-03-071 min readFor CFO and FinOps

Five separate glass tanks on the left, two overflowing into red spill trays and two mostly empty below a dashed level mark. On the right the same five tanks are fed evenly through one dark teal pipeline stage that sends the bulk of the stream down into a wide layered storage slab.Five buckets that cannot share
Today each client workspace is its own bucket: some overflow, some sit half empty, and none can share. A pipeline in front keeps the noise out of every workspace and sends it to storage instead.

The per-workspace problem

Microsoft Sentinel prices commitment tiers per workspace per day. For an MSP with 30 clients, that means 30 separate commitment tiers with no ability to pool unused capacity. Over-provisioned workspaces waste budget. Under-provisioned workspaces trigger pay-as-you-go overflow rates. There is no optimization across the portfolio.

The rule cap

Analytics rules are capped at 512 per workspace. For MSPs running dozens of detection rules per client across multiple threat models, that cap becomes a constraint. Cross-workspace queries are recommended for a maximum of 5 workspaces before performance degrades, limiting correlation across tenants.

Basic Logs limitations

Basic Logs offer a cheaper tier but with severe constraints: 8-day retention and per-query charges make them unsuitable for investigation. Auxiliary Logs are cheaper still but nearly unusable for any analytical purpose. The tiering options within Sentinel do not solve the underlying cost architecture.

What a pipeline layer changes

A Cribl pipeline tiers data before it enters Sentinel. High-value security events flow to the Analytics tier. Verbose operational data routes to Azure Blob storage. Each workspace consumes less of its commitment tier because noise never reaches Sentinel. Cribl pre-normalizes to ASIM schema, reducing the number of analytics rules consumed on parsing edge cases.

Per-workspace commitment tiers, before and after a pipelineLeft: five client workspaces, each its own Sentinel commitment tier. Every source goes into every workspace, so two run over their tier into pay-as-you-go overflow, two sit under it with commitment paid and unused, and nothing pools between them. Right: a pipeline in front tiers the data before it enters Sentinel. High-value security events go to each workspace analytics tier, which now sits under its commitment, and verbose operational data goes to Azure Blob storage. Illustrative, not to scale.TODAY: EVERY SOURCE INTO EVERY WORKSPACEClient AClient BClient CClient DClient EOver its tier: billed as pay-as-you-go overflowThe commitment tier. Under it, capacity is paid and unusedUnused capacity cannot pool across workspaces.WITH A PIPELINE IN FRONTPIPELINETiers databefore Sentinel,ASIM-normalizedEach workspace under its tierAZURE BLOB STORAGEVerbose operational data, at storage pricesIllustrative, not to scale.
Per-workspace commitment tiers, before and after a pipelineLeft: five client workspaces, each its own Sentinel commitment tier. Every source goes into every workspace, so two run over their tier into pay-as-you-go overflow, two sit under it with commitment paid and unused, and nothing pools between them. Right: a pipeline in front tiers the data before it enters Sentinel. High-value security events go to each workspace analytics tier, which now sits under its commitment, and verbose operational data goes to Azure Blob storage. Illustrative, not to scale.PER-WORKSPACE COMMITMENT TIERSTODAYEvery source goes into every client workspace. Each is itsown commitment tier, and unused capacity in one cannotcover overflow in another, which bills at pay-as-you-gorates.PIPELINE IN FRONTTiers the data before it enters Sentinel, and normalizes itto ASIM.EACH WORKSPACEHigh-value security events. Each consumes less ofits commitment tier.AZURE BLOB STORAGEVerbose operational data, at storage prices.Illustrative, not to scale.
Sentinel prices commitment tiers per workspace, so one client’s unused capacity cannot cover another’s overflow. A pipeline in front sends verbose operational data to Azure Blob storage, and each workspace needs less of its own tier.

See your architecture drawn, with the costs, before you spend anything.

Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.

Book the architecture reviewOr take the Blueprint as a PDF →

Free. No system access. No obligation. You keep the drawing.

What you get

  • Your architecture today, drawn
  • The waste map
  • Costs before and after, with estimates
  • Your target architecture
  • Options for your business problem

What it costsNothing