The Sentinel bill nobody scoped for, and how to cap it

In 2025 Microsoft introduced the Sentinel data lake alongside the analytics tier: analytics ingest runs roughly $4 to $5.50 per GB pay-as-you-go, while data-lake ingest is about $0.05 per GB with cheap long-term retention. Get the routing wrong and the Log Analytics bill runs away from you; get it right and it is predictable.

1. Why Sentinel bills surprise people. Verbose sources (firewall, sign-in) at analytics-tier rates.
2. The dual-tier model. Analytics for detection, data lake for volume and retention.
3. A routing policy. What belongs in each tier, by table and by detection need.
4. Retention without pain. Meeting long-retention obligations at lake prices.
5. Holding a fixed fee. How we absorb this into a predictable monthly number.

Deliberately a non-security piece: pure cost engineering. It proves the fixed-price promise is real by showing the mechanism behind it, and it speaks to the accountable, budget-owning reader who has been burned by an unbounded cloud bill. This is the differentiator against threat-blog competitors.

• No CVEs here; lead entirely with cost and predictability.
• Use real per-GB figures, but flag them as current and worth confirming.
• Show a concrete routing table (source to tier); that is the useful artefact.
• Land it on the fixed-fee promise, which is the whole product model.