Azure Monitor cost is an ingestion problem, not a feature problem. The charge that dominates the bill is per gigabyte ingestion into a Log Analytics workspace, and that volume is set by what you collect, how chatty each source is, and which tier the data lands in. Bringing the bill under control means three moves applied in order: stop collecting data nobody queries, route high volume low value logs to Basic Logs instead of the full Analytics tier, and set interactive retention against the window you genuinely investigate rather than the longest period anyone might imagine. Commitment tiers then lock in a discount on the steady volume that remains. Do these in order, because committing to a tier before you have cut the waste simply buys the waste at a discount.
Here is how Azure Monitor is priced, which levers move the bill, and how to cut it without losing the operational signal your alerts depend on.
How is Azure Monitor billed?
The bill has three meaningful components. The first and largest is data ingestion into Log Analytics, charged per gigabyte. Resource logs from your services, custom application logs, and Application Insights telemetry all ingest here, so a busy estate emitting verbose diagnostic logs builds cost quickly. The second is retention: each workspace includes a free retention period, and data kept interactively beyond it is charged per gigabyte per month. The third is the archive and search surface for data moved out of interactive retention, which is cheap to store but carries a per query search charge when you actually need it. Platform metrics and the Azure Activity log are effectively free, which is why the bill is rarely about metrics and almost always about logs. The single most useful question to ask of any Azure Monitor bill is which tables are driving ingestion, because cost concentrates in a handful of high volume tables, and you cannot manage what you have not measured per table.
Which logs belong in Basic Logs versus Analytics Logs?
Azure gives you two ingestion tiers for the same workspace, and using one tier for everything is the most common source of overspend. Analytics Logs are the full tier: the complete Kusto query language, scheduled alert rules, dashboards, and longer interactive retention, billed at the standard ingestion rate. Basic Logs ingest at a materially lower per gigabyte rate, often a fraction of the Analytics rate, but trade away most of that surface: a reduced query capability, eight day interactive retention, no scheduled alerts, and a per gigabyte search charge when you query. The decision rule is about how the data is used, not how important it feels. Data you alert on, dashboard, or query routinely belongs in Analytics. High volume verbose data you keep only so it exists when an incident requires a forensic look, think detailed network flow logs, verbose application debug logs, or chatty platform diagnostics, belongs in Basic Logs. Splitting a single noisy table into the right tier can cut its ingestion cost sharply while leaving the data available for the rare investigation that needs it.
How do you cap ingestion at source?
The cheapest gigabyte is the one you never ingest. Data collection rules let you filter and transform telemetry before it lands in the workspace, dropping columns you never read and rows that carry no signal, such as routine healthy heartbeat records or successful authentication noise. Diagnostic settings on each resource control which log categories flow at all, and many services default to emitting verbose categories that no one queries. Application telemetry through Application Insights should use sampling so that ingestion tracks the signal rather than raw request volume. A daily cap on the workspace is a blunt but effective backstop against a runaway source, a misconfigured debug logger or a sudden flood, that would otherwise turn one bad deployment into a large surprise on the bill. None of these reduce the value you get from observability, because the data being dropped is data you were not using. They simply stop you paying to store the confirmation that everything is fine.
A European SaaS company found Azure Monitor had grown into one of the larger lines on its Azure bill, with two tables, verbose application diagnostics and detailed network flow logs, driving most of the ingestion. We moved the network flow data to Basic Logs, where it remained available for incident investigation at a fraction of the rate, applied a data collection rule to drop unread columns and healthy heartbeat rows from the application diagnostics, and cut interactive retention on both from the long default to the window the team actually queried, with archive covering the compliance tail. Total Azure Monitor cost fell by roughly 40 percent with no change to a single alert or dashboard the operations team relied on. The figures are verified against billing data and anonymised.
When does a Log Analytics commitment tier pay back?
Once ingestion is clean and predictable, commitment tiers convert steady volume into a discount. A commitment tier trades a daily ingestion commitment, with the entry tier around 100 gigabytes a day, for a lower effective per gigabyte rate than pay as you go, and the discount deepens as the committed tier rises. The arithmetic is straightforward: if your optimised daily ingestion sits comfortably above a tier threshold every day, committing to that tier saves on every gigabyte. The trap is committing before optimising, because the tier locks you into paying for a volume you were about to cut, and the discount on waste is still waste. Optimise first so you know your true steady state ingestion, then commit to the tier just below it, leaving the variable peak on pay as you go. Review the tier whenever ingestion shifts materially, since a tier sized for last year's volume can quietly overcommit after a cleanup.
Frequently asked questions
How is Azure Monitor billed?
What is the difference between Analytics Logs and Basic Logs?
Do commitment tiers reduce Azure Monitor cost?
Bring your Azure observability cost under control
We tune Azure Monitor across Log Analytics tiers, data collection rules, retention, and commitment sizing so observability cost tracks the signal you use, not the volume you emit. We take zero provider commissions and answer only to you, and our guarantee is simple: we reduce your cloud spend or we reimburse our service fee, on either a Fixed Fee or a no risk Gainshare basis. Book a strategy call to scope it, and follow more in The Cloud Spend Navigator.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.