Azure Monitor bills you for the logs nobody reads

Log Analytics is priced per gigabyte ingested, and nothing in Azure asks you whether a log is worth a gigabyte. A diagnostic setting is a checkbox. Somebody ticks it during an incident, the incident closes, and three years later that table is a five-figure annual line that no query has touched since.

We see this on nearly every Azure estate of any size. On a few it was the largest single line on the bill, larger than compute. The fix is not "log less". It is deciding, per table, what the data is for.

First, find out what you are paying for

One query answers most of the question:

Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize GB = sum(Quantity) / 1000 by DataType
| order by GB desc

Run it on every workspace. The distribution is almost always brutally top-heavy: three or four tables carry 80 percent of the bill. Those are the only ones worth your attention.

The usual offenders, in the order we find them:

• AzureDiagnostics from resources where somebody enabled all categories rather than the two that matter.
• ContainerLogInsights from an AKS cluster collecting stdout from every container in every namespace, including the chatty sidecars.
• AzureNetworkAnalytics_CL and NSG flow logs, which are enormous and, in raw form, almost never queried.
• AppTraces from an application with verbose logging left on in production after a debugging session.
• SecurityEvent at the "All events" collection setting instead of Common.

The six controls

1. Turn off categories, not tables. Go back to the diagnostic settings on the top resources and uncheck the categories nobody queries. This is the single highest-value hour in the whole exercise, and it is reversible. Do it per resource type, not per resource, or you will be there all week.

2. Filter at the collection rule, before ingestion. Data Collection Rules support KQL transformations that run before you are billed. Drop debug-level rows, drop health-probe requests from an application gateway's logs, project away the columns you never read. A transformation that discards 60 percent of a table's rows reduces that table's bill by 60 percent, and it is a single rule change.

3. Move the high-volume, rarely-queried tables to a cheaper tier. Basic and Auxiliary logs cost a fraction of analytics ingestion, in exchange for limited query features and no alerting on the table. Network flow logs, verbose application traces and raw firewall logs are the canonical fits: you want them available for an investigation, you do not want to pay analytics rates to keep them warm. Check first that nothing alerts on the table, because that is exactly what breaks.

4. Set retention per table, not per workspace. The workspace default applies to everything, so a 730-day setting chosen for one compliance-relevant table is being paid on all of them. Set the long retention where the auditor needs it, and 30 to 90 days everywhere else. Beyond the interactive window, archive is far cheaper than retention, and search jobs get the data back when you genuinely need it.

5. Buy a commitment tier once the volume is real. Workspaces at or above 100 GB per day get commitment tier pricing at a meaningful discount over pay-as-you-go. Do this last, for the same reason you buy reservations last on the Azure bill: a commitment sized against unfiltered ingestion locks in the noise you were about to delete. The tier is adjustable, so start one step below your filtered volume rather than above it.

6. Consolidate workspaces, carefully. Many small workspaces mean no commitment tier anywhere and the same platform tables duplicated across all of them. Fewer, larger workspaces is usually cheaper. The counter-argument is access control and data residency, and it is a real one. Consolidate where the boundary is organisational habit, not a requirement.

The Sentinel wrinkle

If Microsoft Sentinel is enabled on the workspace, you are billed for analysis on top of ingestion, so every gigabyte costs roughly double. That changes the arithmetic on all six controls above and makes filtering far more valuable. It also means the free-data-connector list matters: some Microsoft-first-party sources are free to ingest for Sentinel and are worth keeping, while the same volume from a third-party appliance is not.

Sentinel has its own commitment tiers, and they are separate from the Log Analytics ones. Check both.

What to expect

A workspace that has never been reviewed usually comes down 40 to 60 percent, with most of it from controls one through three, and with no loss of anything a team was actually querying. The way to know is to check: the Usage table tells you what arrives, and query audit logs tell you what anyone ever asks for. The gap between those two is the answer.

This is the same shape of problem as BigQuery bills that triple overnight — an observability system priced per unit of data with no natural back pressure. We work through it in the cost phase of a cloud engagement.

What to do this week

Run the Usage query above on your largest workspace, take the top table, and find out who queried it in the last 90 days. If the answer is nobody, you have found a line you can cut this afternoon with a checkbox.