The invoice lands. The Sentinel line is three times bigger than last month. You ask the team what changed, and the team answers as one: "Nothing." Somewhere, a firewall in debug mode quietly disagrees.

Rebuilt in my lab tenant with made-up data, checked against Microsoft Learn (October 2026). My lab: a Contoso workspace law-lab-sentinel in rg-lab-sentinel , a Windows client LAB-WIN11-01 , and a CEF collector LAB-SYSLOG-01 fed by a made-up LabFirewall . All numbers are made-up lab numbers. No prices here, in any currency: they change by region and by month, so use the Microsoft Sentinel pricing page and its cost estimator.

TL;DR

A bill jumps for one of four reasons: more billable GB, a higher price per GB (free trial ended, tier or benefit changed), longer retention, or a new meter (Basic, Auxiliary or data lake queries, search jobs, restore, notebooks).…