Explanation
Why the waste happens and who it affects.
However, not all telemetry requires real-time access or frequent querying. Some tables may serve audit, archival, or compliance use cases where querying is rare or unnecessary. Leaving such tables on the Analytics plan results in unnecessary spend - especially when ingestion volumes are high or the table receives data from verbose sources (e.g., diagnostic logs, platform metrics).
Azure now allows users to assign different pricing plans at the table level, including the Basic plan, which offers reduced ingestion costs with queries charged separately, and the Auxiliary plan, which offers minimal ingestion costs with slower, separately charged queries. This provides a valuable opportunity to align cost with access patterns by assigning less expensive plans to tables that are retained for record-keeping or compliance, rather than analysis.
Billing model
The pricing dimensions that drive this cost.
Azure Log Analytics charges based on the ingestion volume and pricing plan assigned to each table, and Basic and Auxiliary tables are also charged per GB of data scanned by queries. The default plan-Analytics-offers full query capabilities with queries included but has the highest ingestion price. The Basic plan has a reduced ingestion price, supports full KQL within the workspace scope, and charges separately for queries; it is intended for medium-touch troubleshooting and incident-response data. The Auxiliary plan has the lowest ingestion price and slower, separately charged queries, and is intended for low-touch verbose logs and audit or compliance data. Costs can accumulate rapidly when high-ingestion tables default to the Analytics plan despite minimal interaction or querying needs. Conversely, moving a frequently queried table to Basic or Auxiliary can increase total cost. Only Azure tables that support these plans and DCR-based custom tables can use them, and they are not available for workspaces in legacy pricing tiers.
How to detect
6 checks to find it in your estate.
- Identify Log Analytics tables assigned to the default Analytics plan
- Analyze which tables are infrequently queried or used solely for audit purposes
- Review ingestion volume by table to identify high-cost, low-access data
- Check whether verbose or chatty data sources are routed to high-cost plans unnecessarily
- Confirm with application owners whether full query functionality is required for each table
- Assess whether table plans are intentionally assigned or left at default
How to fix
4 ways to remove the waste.
- Assign the Auxiliary plan to tables retained for audit, archival, or compliance purposes, and the Basic plan to occasionally queried troubleshooting tables, where the table type supports the plan
- Split high-volume ingestion sources into separate tables based on access needs
- Reconfigure ingestion routes to direct non-essential logs to lower-cost tables
- Periodically audit table plan assignments to ensure alignment with usage patterns
Documentation
Vendor references for pricing and configuration.