Sentinel Data Lake

What stops most organizations from keeping all of their security data in Microsoft Sentinel is almost always the cost. For years, the Analytics tier priced comprehensive logging out of reach, so high-volume sources were sampled, dropped, or pushed into a separate platform such as Azure Data Explorer. That was not carelessness, it was rationing: remembering was expensive, and a great deal of visibility was lost. Data Lake changes that arithmetic. Storage runs at roughly two percent of the Analytics rate, ingestion at 0.065 USD per GB against 5.59, everything compressed six to one, with retention of up to twelve years. Storage and compute are billed separately, so large volumes stay cheap and you pay only when you query. That alone replaces the Basic and Auxiliary tiers and removes the need for a separate low-cost store alongside Sentinel. The more interesting part sits next to it: because the data is cheap and stays live, the way you work with it changes. What follows from that for an existing environment depends on the tables already running today.