Billing model for Log Analytics via Azure Lighthouse

Azure Lighthouse itself does not incur additional costs for managing Azure resources. However, when it comes to Log Analytics and Azure Monitor, the billing model is based on the data ingestion and retention within the Log Analytics workspaces, which are charged separately.

1. Workspace Location: The costs for Log Analytics are determined by the region where the workspace is located. Each Log Analytics workspace is treated as a separate service and contributes to the overall Azure subscription bill.
2. Query Execution: The costs associated with running queries in Log Analytics depend on the amount of data ingested and retained in the workspace. If queries are executed by users with delegated roles via Azure Lighthouse, the costs will still be attributed to the workspace where the data is stored.
3. Data Ingestion: Charges for data ingestion can vary significantly based on the configuration of the workspace and the types of data collected. The ingestion of log data is typically the largest component of Azure Monitor charges. Additionally, if the workspace has Microsoft Sentinel enabled, different billing meters may apply for data ingestion.

In summary, while Azure Lighthouse provides a way to manage resources without additional costs, the usage of Log Analytics and Azure Monitor will incur charges based on the workspace's data ingestion, retention, and the region it resides in, regardless of the access method used (delegated roles).

References:

• Azure Monitor cost and usage
• Azure Monitor Logs cost calculations and options

Hello Loh Wai Kit Thank you for posting your query on Microsoft Q&A platform.

Azure Lighthouse is free and does not alter billing ownership.

All Log Analytics charges (ingestion, retention, query/long‑term features) are billed to the subscription that contains the Log Analytics workspace, regardless of who or from which tenant sent the data or ran the query via Lighthouse.

Data ingestion: Billed by the workspace’s subscription under Pay‑As‑You‑Go or a Commitment Tier. Delegated users (MSP/central team) sending data or enabling diagnostics don’t change the billing owner.

Data retention & archiving: First 31 days for Analytics Logs are free, beyond that retention/archiving is billed to the workspace’s subscription.

Query costs: Standard queries across the workspace are not separately billed (query processing is included) except for specific cases like Basic/Auxiliary Logs, search jobs, or long‑term retention features. Any such charges accrue to the workspace’s subscription. Cross‑tenant/cross‑workspace querying via Lighthouse does not shift costs to the managing tenant.

Who runs the query or where data originates: Irrelevant for cost ownership. Whether a customer user or a managing‑tenant user via Lighthouse runs the query or configures collection, the workspace’s subscription is billed.

Recommended deployment pattern to keep costs aligned:

• Create Log Analytics workspaces in the customer’s tenant so their data and all related charges remain in their subscription.
• Automation accounts that access a workspace must be created in the same tenant as that workspace. This avoids cross‑tenant friction and keeps cost/ownership clean.

Choose Commitment Tier if daily ingestion is consistently high, use daily caps, table‑level Basic Logs for rarely queried data, and monitor with built‑in cost workbooks. These measures reduce the customer’s bill without impacting Lighthouse.

References:

1.https://learn.microsoft.com/en-us/azure/lighthouse/how-to/monitor-at-scale

2.https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs

3.https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/best-practices-cost

Thanks,

Suchitra.