$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-pricingGuidance for estimating and reasoning about the cost of Azure security services — using the Azure Pricing Calculator, understanding key cost drivers (Sentinel ingestion, Defender plans, Key Vault operations), and cost-optimization levers. WHEN: Azure security pricing, estimate co
| 1 | # Azure Security Pricing & Cost Estimation |
| 2 | |
| 3 | Security services on Azure mix **consumption-based** (e.g., data ingestion, transactions) and |
| 4 | **per-resource/seat** pricing. This skill helps reason about and estimate costs and identify |
| 5 | optimisation levers. Always confirm current rates on official pricing pages. |
| 6 | |
| 7 | ## When to use |
| 8 | Producing a cost estimate or optimising spend for a security solution. |
| 9 | |
| 10 | ## Key cost drivers |
| 11 | - **Microsoft Sentinel** — Driven mainly by **data ingestion** (per GB) and retention. Use |
| 12 | **Commitment Tiers**, route low-value logs to **Auxiliary/Basic logs** or ADX, and avoid |
| 13 | duplicate ingestion. |
| 14 | - **Defender for Cloud** — Foundational **CSPM is free**; **Defender plans** are per-resource |
| 15 | (e.g., per server/hour, per 10K transactions, per vCore). Enable plans where risk justifies. |
| 16 | - **Microsoft Defender XDR / Purview / Entra ID P2** — Largely **per-user licensing** (E5 / |
| 17 | add-ons) rather than consumption. |
| 18 | - **Key Vault** — Per-operation (secrets/keys/certs) and HSM pool charges (Managed HSM). |
| 19 | - **Azure Firewall / Front Door / DDoS** — Deployment + data processing charges. |
| 20 | |
| 21 | ## Approach |
| 22 | 1. **List components** and identify which are consumption vs licensed. |
| 23 | 2. **Estimate quantities** — e.g., Sentinel daily GB, number of protected servers/resources. |
| 24 | 3. **Use the Pricing Calculator** to model the estimate; add it to the workload TCO. |
| 25 | 4. **Apply optimisation** — commitment tiers, log tiering, right-size Defender plan coverage, |
| 26 | remove unused resources. |
| 27 | 5. **Validate licensing** — Confirm whether E5/add-ons already cover a capability before adding |
| 28 | consumption cost. |
| 29 | |
| 30 | ## Guardrails |
| 31 | - Pricing changes — always verify against the live pricing page and your agreement (EA/MCA/CSP). |
| 32 | - Sentinel ingestion is the most common cost surprise — plan log tiering up front. |
| 33 | - Don't disable needed protection purely for cost; optimise scope instead. |
| 34 | |
| 35 | ## Example prompts |
| 36 | - `Estimate the cost of Microsoft Sentinel and Defender for Cloud for my environment.` |
| 37 | - `What are the main cost drivers for Microsoft security services?` |
| 38 | - `How do I optimise security spend across licensing and consumption?` |
| 39 | - `Help me budget for security ingestion and per-resource Defender plans.` |
| 40 | |
| 41 | ## Microsoft Learn |
| 42 | - Azure Pricing Calculator: https://azure.microsoft.com/pricing/calculator/ |
| 43 | - Sentinel pricing/billing: https://learn.microsoft.com/azure/sentinel/billing |
| 44 | - Defender for Cloud pricing: https://azure.microsoft.com/pricing/details/defender-for-cloud/ |
| 45 | - Cost management: https://learn.microsoft.com/azure/cost-management-billing/costs/ |