specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: Azure Log Analytics
providerId: azure-log-analytics
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Observability
  - Logs
  - Monitoring
  - FinOps
  - FOCUS
description: 'FOCUS-aligned FinOps for Azure Log Analytics: per-GB ingest is the dominant meter, with
  daily-commit tiers, table-tier optimization (Analytics vs Basic vs Auxiliary), retention beyond 31
  days, and search/restore from archive as additional billable lines. Ingest tier and table choice are
  the primary cost levers.'
sources:
  - https://azure.microsoft.com/en-us/pricing/details/monitor/
  - https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
publisherName: Microsoft Corporation
serviceCategory: Observability
billingModel:
  pricingCategory: Pay-As-You-Go + Committed Use
  billingFrequency: Monthly
  billingCurrency: USD
  chargeCategories:
    - Usage
    - Purchase
    - Tax
    - Adjustment
focusColumns:
  ServiceName: Azure Monitor / Log Analytics
  ServiceCategory: Observability
  ProviderName: Microsoft
  PublisherName: Microsoft Corporation
  InvoiceIssuerName: Microsoft Corporation
  PricingCategory: Pay-As-You-Go
  BillingCurrency: USD
  ChargeCategory: Usage
meters:
  - name: analytics_logs_ingest
    description: Standard Analytics-tier table ingest
    unit: GB
    aggregation: sum
    dimensions:
      - workspace
      - region
      - table
  - name: basic_logs_ingest
    description: Basic-tier ingest (cheaper, query-restricted)
    unit: GB
    aggregation: sum
    dimensions:
      - workspace
      - table
  - name: auxiliary_logs_ingest
    description: Auxiliary-tier ingest (cheapest, archival-only)
    unit: GB
    aggregation: sum
    dimensions:
      - workspace
      - table
  - name: interactive_retention
    description: Per-GB-month for retention beyond the included 31 days
    unit: GB-month
    aggregation: avg
    dimensions:
      - workspace
      - table
  - name: long_term_archive
    description: Long-term archive storage up to 12 years
    unit: GB-month
    aggregation: avg
    dimensions:
      - workspace
      - table
  - name: search_scan
    description: Per-GB scanned by Basic/Auxiliary search and archive restore
    unit: GB
    aggregation: sum
    dimensions:
      - workspace
      - table
principles:
  - name: Visibility
    description: Use the Usage and Estimated Costs blade in the workspace and Azure Cost Management
      to see ingest by table and Solutions; build Workbooks for ingest trend by source.
  - name: Allocation
    description: Use one workspace per business unit / environment for clean attribution; tag workspaces;
      use Resource Context RBAC and table-level access for chargeback.
  - name: Optimization
    description: Move high-volume / low-query tables to Basic or Auxiliary; configure table-level retention;
      drop noisy fields with ingestion-time transforms; use daily caps; commit to a tier matching steady-state
      ingest; review verbose diagnostic settings (especially AzureDiagnostics) for waste.
  - name: Accountability
    description: Set workspace daily cap alerts; assign workspace owners; review monthly per-table ingest
      growth; investigate sudden spikes for misconfigured logging.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com