Is a daily cap a safe way to control a client's Log Analytics costs?

Not as a primary control. Microsoft positions the daily cap as a safeguard against unexpected spikes: once it is reached, billable data collection stops until the workspace's reset hour, leaving you blind to alerts and events. Filter with transformations instead, and alert before the cap is hit.

Should we consolidate client workspaces to reach a commitment tier?

Microsoft recommends starting with one workspace and adding only as many as requirements demand. Data split across workspaces can't pool towards a commitment tier unless they share a dedicated cluster. Separate client tenants usually need their own workspaces, which Azure Lighthouse lets you manage from your own tenant.

How can we catch an ingestion spike before it reaches the bill?

Set an alert rule for unusually high data collection and review workspace insights to see which tables and machines drive volume. Recheck whenever you onboard new resources for a client.

Coverage

Azure Monitor and Log Analytics cost optimisation for MSPs

Azure Monitor spend is driven mainly by the volume of data collected into Log Analytics workspaces, so money leaks on logs that are never queried or alerted on, duplicated across workspaces, or kept longer than needed. Microsoft advises collecting only the data needed to judge service health, and reviewing volumes whenever new resources are onboarded.

13

automated finders for monitoring

Read-only, across every connected client tenant, tied to real billing data.

Remove unused
Rightsizing

Where monitoring spend goes to waste

The main cost levers Microsoft documents for monitoring, and the ones an MSP should check across every client.

Move steady workspaces onto commitment tiers

Commitment tiers starting at 100 GB per day can cut Analytics Logs ingestion costs by as much as 30 percent compared with pay-as-you-go. Each tier commits you for 31 days and does not discount Basic or Auxiliary ingestion, so size it on sustained Analytics volume. ^[2]

Match each table to the right plan

Analytics suits continuous monitoring, Basic suits troubleshooting and incident response, and Auxiliary stores high-volume, verbose data cheaply for the long term. The cheaper plans add query charges and Auxiliary tables lose alerting, so reserve them for data you rarely query. ^[3]

Push ageing data into long-term retention

Ingestion already includes 31 days of analytics retention, while extending interactive retention adds cost. For audit and compliance data, set a longer total retention and let older records sit in the low-cost long-term state, retrieving them with search jobs when needed. ^[4]

Filter noise before it is ingested

Transformations in a data collection rule drop unwanted rows or columns before data reaches the workspace. Filtering is usually free for Analytics and Basic tables, but removing more than 50 percent of incoming data adds a processing charge on the excess, so cut volume at source first where you can. ^[5]

Collect only the diagnostic categories you use

The allLogs category group switches on every resource log category for a resource. Select just the categories each service needs, and skip sending platform metrics to the workspace unless you query them there, because metrics explorer already has them. ^[6]

Tune Application Insights sampling

Sampling trims telemetry volume and cost while keeping traces complete, using either a fixed percentage or a ceiling on traces per second. Metrics aren't sampled, so metric alerts stay reliable. ^[7]

How Cerberus Cloud covers monitoring

Cerberus Cloud runs 13 automated finders for monitoring across every connected client tenant. Each one ties a technical signal to real billing data, so findings arrive with an estimated recoverable value, ranked by impact, effort and risk, with evidence and remediation scripts for your engineers to review.

Access is read-only, so nothing changes in a client environment until your team decides it should. See how it works or the multi-tenant portfolio view.

Remove unused
Rightsizing

Frequently asked questions

Is a daily cap a safe way to control a client's Log Analytics costs?: Not as a primary control. Microsoft positions the daily cap as a safeguard against unexpected spikes: once it is reached, billable data collection stops until the workspace's reset hour, leaving you blind to alerts and events. Filter with transformations instead, and alert before the cap is hit.
Should we consolidate client workspaces to reach a commitment tier?: Microsoft recommends starting with one workspace and adding only as many as requirements demand. Data split across workspaces can't pool towards a commitment tier unless they share a dedicated cluster. Separate client tenants usually need their own workspaces, which Azure Lighthouse lets you manage from your own tenant.
How can we catch an ingestion spike before it reaches the bill?: Set an alert rule for unusually high data collection and review workspace insights to see which tables and machines drive volume. Recheck whenever you onboard new resources for a client.

See monitoring findings on a sample portfolio

A 15-minute walkthrough: tenant connection, prioritised findings, remediation scripts and savings history.

Book a Walkthrough All coverage

Sources

Last checked 15 October 2026. Product details change; tell us if something here is out of date.

All 15 coverage families