Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,242 questions
Workspace transformation cost for native Entra ID connector
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 79%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIK%3C/text%3E%3C/svg%3E)
Iliyan Karakashev
5
Reputation points
Hey team! I want to apply workspace transformation to the native Entra ID connector and it's log types to filter logs only for specific domain. While from KQL perspective this is not difficult, I'm doubting if the cost reduction effect will be applied also to the ingestion costs and not only to the retention costs. As from my understanding transformation happens prior the logs are being ingested into Sentinel (and therefore should not be any ingestion costs), however going thru the docs I found out this Custom data ingestion and transformation in Microsoft Sentinel | Microsoft Learn in which is mention only that this action will reduce the costs by reducing the storage requirements.
What is your opinion and someone from you already have experience with such use case ?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 94%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESN%3C/text%3E%3C/svg%3E)
Sándor Tőkési 251 Reputation points2025-02-26T09:14:48.1333333+00:00 Hey, could you copy paste the part from the linked page that indicates for you that it won't decrease the ingestion cost of Entra ID data?
I can confirm that if you filter out fields or logs your cost will be lower.
also from the same link, there is a statement that specifically mentions this: 'Reduce data costs. Filter data collection by either rows or columns to reduce ingestion and storage costs.'
-
Iliyan Karakashev 5 Reputation points
2025-02-28T11:41:49.1666667+00:00 Hi Sandro,
Actually this was raised by one of my colleagues in a conversation, but given your answer and similar others from different channels I do believe that the described way will reduce the cost for the Entra logs. Thanks again for your input!
Sign in to comment
Sign in to answer