Azure Monitor cost 2026: the Log Analytics bill explained

Microsoft is explicit in its own documentation: for most Azure Monitor implementations, the most significant charges are ingestion and retention of data in Log Analytics workspaces. Everything else (platform metrics, the Azure activity log, alert rules, Application Insights) either rides on top of that data or is a comparatively minor line item. So understanding the Azure Monitor bill means understanding the Log Analytics meters first.

The default table plan, Analytics Logs, ingests at roughly $2.30 per gigabyte after a free monthly allowance of 5 GB per billing account (shared across all workspaces on the account, not granted per workspace). That is materially more expensive per gigabyte than AWS CloudWatch Logs at $0.50 per gigabyte, and it is the figure that gives Azure Monitor its reputation for being pricey. But the headline rate overstates the real cost for two reasons. First, Azure bills the calculated record size, not the raw event: standard columns are excluded and the billed volume runs on average about 25 percent below the incoming JSON-packaged event size. Second, Analytics is only one of three table plans. Basic Logs ingest at roughly $0.50 per gigabyte and Auxiliary Logs at roughly $0.05 per gigabyte, so moving high-volume verbose data off the Analytics meter changes the economics entirely.

Retention is the second meter. Interactive (hot, fully queryable) retention is included free for the first 31 days, then bills at roughly $0.10 per gigabyte per month, configurable up to two years. Beyond that, long-term retention holds data at roughly $0.02 per gigabyte per month for up to twelve years, with a search-job charge per gigabyte scanned when you need to retrieve it. For compliance-driven log hoards, the long-term tier is five times cheaper than keeping data interactively queryable.

All of these rates are set regionally, so a workspace in a higher-cost region pays more than the figures above, which reflect typical commercial regions. The numbers here are list pay-as-you-go rates; the commitment tiers below and any Azure Commitment Discounts from an Enterprise Agreement apply on top.

The entry commitment tier, 100 GB per day, lists at $196 per day in East US. That is $1.96 per gigabyte against the $2.30 pay-as-you-go Analytics Logs rate, so the saving at the bottom of the ladder is about 15 percent, not the 30 percent the headline usually implies. Thirty percent is what you get at 5,000 GB per day, where the rate falls to $1.61 per gigabyte. The breakpoints in between are published, so you can work out whether the next tier up pays for itself before you commit.

Application Insights has no per-gigabyte price of its own. A workspace-based Application Insights resource writes its telemetry into a Log Analytics workspace and is billed on that workspace's meters: $2.30 per gigabyte of Analytics Logs ingestion in East US on 7 September 2026, after the 5 GB per billing account per month free allowance, with 31 days of interactive retention included and $0.10 per gigabyte per month after that. If you are pricing Application Insights, you are pricing Log Analytics.

That has one useful consequence: commitment tiers apply. A workspace sitting on the 100 GB per day tier ingests its Application Insights telemetry at $1.96 per gigabyte rather than $2.30, and application telemetry counts toward reaching a tier alongside infrastructure logs. Classic (non-workspace) Application Insights resources pay the same pay-as-you-go rates but cannot use commitment tiers at all, which is the clearest cost argument for converting them.

Two line items sit outside the ingestion meter. Availability testing bills telemetry like any other data, and Azure also publishes a separate Standard Web Test Execution meter at $0.0005 per test execution in East US, so a single URL tested every five minutes from five locations runs roughly $22 per month in execution charges before any telemetry cost. Live Metrics Stream, by contrast, carries no data-volume charge at all, which makes it the cheapest way to watch a deployment in real time.

The practical cost lever for Application Insights is therefore sampling, not plan choice. There is no cheaper Application Insights plan to move to; the only ways down are ingesting less (adaptive or fixed-rate sampling in the SDK), routing verbose custom telemetry into a Basic Logs table where the schema allows it, and reaching a commitment tier.

A small workload of 10 VMs sending around 5 GB per day of Analytics Logs ingests roughly 150 GB per month. After the 5 GB free allowance, that is about 145 GB at roughly $2.30, near $330 per month, with retention covered inside the free 31-day window. This is the scenario where the $2.30 Analytics rate stings most, because a small team has not yet split verbose logs into Basic tables and has nothing to commit to a tier.

A mid-market workload of 100 VMs at around 100 GB per day ingests roughly 3,000 GB per month. At the pay-as-you-go Analytics rate that is near $6,900 per month; moving to the 100 GB-per-day commitment tier at $196 per day brings that to $5,880 per month, and routing the noisiest tables (firewall, IIS, verbose application logs) to Basic Logs at roughly $0.50 per gigabyte cuts it further. Ninety-day interactive retention on the retained volume adds the roughly $0.10 per gigabyte per month retention meter beyond the free 31 days.

An enterprise or security-heavy workload is where table-plan discipline decides the bill. Keeping operational data and Microsoft Sentinel security data in separate workspaces avoids paying Sentinel meters on operational logs; pushing compliance archives to long-term retention at roughly $0.02 per gigabyte per month rather than holding them interactively is a five-fold saving; and combining workloads to reach a commitment tier that neither would reach alone can flip the economics. At this scale the difference between a naive all-Analytics configuration and a tuned one is routinely two to three times the monthly bill.