Most engineers think…
Most people picture a SIEM as 'a server you install that swallows logs and shows alerts'. For Sentinel that mental model is wrong and it shows in interviews.
Microsoft Sentinel is a cloud-native SIEM + SOAR layered on top of a Log Analytics workspace — the same Azure Monitor store that holds your other Azure logs. Sentinel adds the security brain (detections, hunting, incidents, automation) on top of that workspace. Once you see it as workspace-centric — connectors fill tables, tiers decide cost and retention, RBAC and workspace design decide who sees what — every architecture and pricing question becomes easy. And in 2026 you drive the whole thing from the unified Microsoft Defender portal, not the Azure portal.
① What Microsoft Sentinel actually is — a SIEM + SOAR on a workspace
The single most important idea: Microsoft Sentinel is not a box and not a separate database. It is a cloud-native SIEM and SOAR that runs on top of a Log Analytics workspace, which is part of Azure Monitor. You enable Sentinel onto a workspace; that workspace is where every log actually lives.
So the architecture is layered. The workspace is the storage and query engine (tables of logs you query with KQL). Sentinel is the security layer on top — detections, hunting, incidents, UEBA and automation. Because the store is shared Azure Monitor plumbing, Sentinel inherits its connectors, its tables, its retention controls and its pricing model. Get the workspace right and the rest follows.
Microsoft Sentinel is best described as…
② Data connectors and the ingestion pipeline — filling the tables
Data gets into the workspace through data connectors, and they come in a few flavours. Microsoft service-to-service connectors (Entra ID, Microsoft 365, Defender XDR, Azure activity) wire up natively inside a tenant. For firewalls, proxies and Linux boxes you use CEF/Syslog via the Azure Monitor Agent (AMA) — the agent sits on a log forwarder and a Data Collection Rule (DCR) filters what ships. For SaaS APIs there is the Codeless Connector Framework (CCF), a fully-SaaS config-file connector with no servers to run.
Where the data lands
Each source maps to a table in the workspace. Plain Syslog lands in the Syslog table; CEF lands in CommonSecurityLog; codeless connectors usually create their own _CL custom tables. The interview line: connectors fill tables, KQL reads tables. Choosing the right connector is mostly about where the source lives — Microsoft cloud, on-prem appliance, or third-party SaaS.
The Azure Monitor data store Sentinel runs on — holds every log as a table you query with KQL. Get this right and the rest follows.
How data enters: Microsoft service-to-service, CEF/Syslog via AMA, or Codeless Connector Framework for SaaS APIs. Each maps a source to a table.
The agent on a log forwarder that collects Syslog/CEF, filters it with a Data Collection Rule (DCR), and ships it into the workspace.
The unified SecOps console where Sentinel now lives — incidents correlated with Defender XDR. The Azure portal retires after 31 Mar 2027.
In an interview, sort connectors by source: Microsoft cloud → service-to-service; on-prem firewall/Linux → CEF/Syslog via AMA with a DCR; third-party SaaS API → Codeless Connector Framework. Naming the right path for each source shows you understand the pipeline, not just the buzzwords.
▶ Watch a firewall log travel from the wire to an incident
How one Syslog/CEF event is ingested end-to-end. Press Play for the healthy path, then Break it to see the classic failure.
You must bring logs from an on-prem Linux firewall into Sentinel. Which connector path fits?
③ Tiers, retention and workspace design — cost, access and scale
Not every log deserves premium storage. The analytics tier keeps data in fast, fully-queryable interactive retention for 90 days by default (extensible up to two years) — use it for primary detection data. The cheaper data-lake tier (and the older Basic/Auxiliary table plans) holds high-volume, low-value logs like NetFlow or proxy logs for long-term retention, where you pay mostly per GB scanned. Sentinel gives the first 90 days of retention free; beyond that you pay.
One workspace or many?
A single workspace is simplest and is enough for many orgs. You go multi-workspace for data residency, separate billing, or tenant isolation. Access is controlled with Azure RBAC (Sentinel Reader, Responder, Contributor), ideally scoped at the resource-group level. For multiple tenants — an MSSP or a group of subsidiaries — you use Azure Lighthouse (and the Defender portal's multitenant view) so one SOC can query and manage many tenants without copying data into one place.
The classic cost blow-up is sending every noisy, low-value log into the premium analytics tier. That data is billed at the highest rate but rarely queried. Tier per table: analytics for detection data, data-lake (or Basic/Auxiliary) for high-volume retention. Cost is driven by ingestion volume and how long you keep it.
You have huge volumes of low-value proxy logs you must keep for a year but rarely query. Best home?
④ Pricing and the 2026 Defender portal — what you pay and where you work
Cost is driven by how much data you ingest and how long you keep it. Pay-as-you-go bills per GB ingested — simple, and right for small or spiky volumes. Commitment tiers (starting at 100 GB/day) give a discounted flat rate for a committed daily volume; anything above bills at that discounted rate. Newer workspaces use the simplified pricing tier that combines the Log Analytics ingestion cost and the Sentinel analysis cost into one meter.
The big 2026 change
Microsoft Sentinel now lives in the unified Microsoft Defender portal (unified SecOps), where Sentinel incidents are correlated with Defender XDR in one queue. It is generally available there even without an E5 licence or Defender XDR. The old Azure portal experience is being retired — after 31 March 2027 remaining customers are redirected to Defender. So in 2026 the right answer is: design the workspace, but drive Sentinel from the Defender portal.
Priya, a SOC lead at a Pune fintech, faces this
The monthly Sentinel bill suddenly doubles after the team onboards verbose firewall and proxy logs into the analytics tier.
Every new high-volume source was ingested into the premium analytics tier on pay-as-you-go, so noisy logs are billed at the most expensive rate.
Open Data management ▸ Tables and sort by volume — the proxy and firewall tables dominate ingestion, yet analysts almost never query them interactively.
Defender portal ▸ Microsoft Sentinel ▸ Data management ▸ Tables + Settings ▸ PricingSwitch the noisy, low-value tables to the data-lake tier for cheap long retention, keep detection-critical tables in analytics, and move steady volume onto a commitment tier.
Re-check the cost view next cycle: ingestion cost drops sharply, detections still fire on the analytics-tier tables, and the year-long retention requirement is met cheaply.
Don't assume screenshots from old guides still apply. In 2026 Sentinel is generally available in the unified Microsoft Defender portal, and the Azure portal experience is retiring after 31 March 2027. Verify you are working in the Defender portal so incidents correlate with Defender XDR in one queue.
Your daily ingestion is steady at ~150 GB/day. Which pricing choice is usually smartest?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is Microsoft Sentinel called 'workspace-centric' rather than 'a SIEM appliance'? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Log Analytics workspace
- The Azure Monitor data store Sentinel runs on; holds every log as a table you query with KQL. Sentinel is enabled onto a workspace.
- SIEM + SOAR
- Security Information and Event Management (collect, correlate, alert) plus Security Orchestration, Automation and Response (automated playbooks). Sentinel is both.
- Data connector
- How data enters Sentinel: Microsoft service-to-service, CEF/Syslog via AMA, Codeless Connector Framework, or API/Functions/Logic Apps. Each maps a source to a table.
- Azure Monitor Agent (AMA)
- Agent on a log forwarder that collects Syslog/CEF, filters via a Data Collection Rule (DCR), and ships events into the workspace.
- Codeless Connector Framework (CCF)
- A fully-SaaS, config-file way to build connectors for third-party APIs with no servers to install; includes health monitoring.
- Analytics tier
- Premium storage for primary security data — fast interactive query, 90 days free retention by default, extensible to two years; powers analytics rules.
- Data-lake tier
- Low-cost storage for high-volume, low-value logs kept long-term; you pay mostly per GB scanned, ideal for retention and compliance.
- Commitment tier
- A pricing model starting at 100 GB/day that gives a discounted flat rate for a committed daily ingestion volume, with overage at the same rate.
- Azure Lighthouse
- Lets a managing tenant query and manage Sentinel workspaces across many customer tenants at scale, keeping each tenant's data and ownership separate.
- Unified Defender portal
- The Microsoft Defender portal (unified SecOps) where Sentinel is managed in 2026; correlates Sentinel and Defender XDR incidents. Azure portal retires after 31 Mar 2027.
📚 Sources
- Microsoft Learn — What is Microsoft Sentinel? overview & the Defender portal. learn.microsoft.com/azure/sentinel/overview
- Microsoft Learn — Connect data sources: agent-based, CEF/Syslog via AMA, and Codeless Connector Framework. learn.microsoft.com/azure/sentinel/connect-data-sources
- Microsoft Learn — Log retention tiers in Microsoft Sentinel (analytics tier vs data-lake tier). learn.microsoft.com/azure/sentinel/log-plans
- Microsoft Learn — Plan costs and understand Microsoft Sentinel pricing and billing (pay-as-you-go & commitment tiers). learn.microsoft.com/azure/sentinel/billing
- Microsoft Learn — Extend Microsoft Sentinel across workspaces and tenants (Azure Lighthouse, multi-tenant). learn.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants
- Microsoft Learn — Plan / deploy for unified security operations & Azure portal retirement timeline (after 31 Mar 2027). learn.microsoft.com/unified-secops/overview-plan
What's next?
Got the architecture? Next, learn KQL and analytics rules — the query language and scheduled detections that actually turn those workspace tables into alerts and incidents, plus SOAR playbooks that automate the response.