# Suboptimal table plan selection in Log Analytics Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-table-plan-selection-in-log-analytics By default, all Log Analytics tables are created under the Analytics plan, which is optimized for high-performance querying and interactive analysis. By: Jurian van Hoorn Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Suboptimal Table Plan Selection in Log Analytics The short version By default, all Log Analytics tables are created under the Analytics plan, which is optimized for high-performance querying and interactive analysis. [Jurian van Hoorn](https://www.linkedin.com/in/j-hoorn/) Operations Senior (Azure Cloud) @ Netcompany Azure service [Azure Log Analytics](https://www.pointfive.co/efficiency-hub/cloud-services/azure-log-analytics) Category [Other](https://www.pointfive.co/efficiency-hub/service-category/other) Reference CER-0197 Type Suboptimal Pricing Model ## Explanation Why the waste happens and who it affects. However, not all telemetry requires real-time access or frequent querying. Some tables may serve audit, archival, or compliance use cases where querying is rare or unnecessary. Leaving such tables on the Analytics plan results in unnecessary spend - especially when ingestion volumes are high or the table receives data from verbose sources (e.g., diagnostic logs, platform metrics). Azure now allows users to assign different pricing plans at the table level, including the Basic plan, which offers reduced ingestion costs with queries charged separately, and the Auxiliary plan, which offers minimal ingestion costs with slower, separately charged queries. This provides a valuable opportunity to align cost with access patterns by assigning less expensive plans to tables that are retained for record-keeping or compliance, rather than analysis. ## Billing model The pricing dimensions that drive this cost. Azure Log Analytics charges based on the ingestion volume and pricing plan assigned to each table, and Basic and Auxiliary tables are also charged per GB of data scanned by queries. The default plan-Analytics-offers full query capabilities with queries included but has the highest ingestion price. The Basic plan has a reduced ingestion price, supports full KQL within the workspace scope, and charges separately for queries; it is intended for medium-touch troubleshooting and incident-response data. The Auxiliary plan has the lowest ingestion price and slower, separately charged queries, and is intended for low-touch verbose logs and audit or compliance data. Costs can accumulate rapidly when high-ingestion tables default to the Analytics plan despite minimal interaction or querying needs. Conversely, moving a frequently queried table to Basic or Auxiliary can increase total cost. Only Azure tables that support these plans and DCR-based custom tables can use them, and they are not available for workspaces in legacy pricing tiers. ## How to detect 6 checks to find it in your estate. - Identify Log Analytics tables assigned to the default Analytics plan - Analyze which tables are infrequently queried or used solely for audit purposes - Review ingestion volume by table to identify high-cost, low-access data - Check whether verbose or chatty data sources are routed to high-cost plans unnecessarily - Confirm with application owners whether full query functionality is required for each table - Assess whether table plans are intentionally assigned or left at default ## How to fix 4 ways to remove the waste. - Assign the Auxiliary plan to tables retained for audit, archival, or compliance purposes, and the Basic plan to occasionally queried troubleshooting tables, where the table type supports the plan - Split high-volume ingestion sources into separate tables based on access needs - Reconfigure ingestion routes to direct non-essential logs to lower-cost tables - Periodically audit table plan assignments to ensure alignment with usage patterns ## Documentation Vendor references for pricing and configuration. - [https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-logs-tables?tabs=azure-portal learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-logs-tables?tabs=azure-portal) - [Configure a Table Plan in a Log Analytics Workspace learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-table-plans) - [Pricing - Azure Monitor azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/monitor/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure Log Analytics CER-0422 ### [Missing Commitment Tier on High-Volume Log Analytics Workspaces](https://www.pointfive.co/efficiency-hub/inefficiencies/missing-commitment-tier-on-high-volume-log-analytics-workspaces) Log Analytics workspaces default to pay-as-you-go pricing for Analytics Logs ingestion, with no minimum volume. Workspaces that grow to ingest a steady 100 GB or more per day keep paying the full per-GB rate unless someone changes the... Other - Azure Log Analytics CER-0423 ### [Excessive Analytics Retention in Log Analytics Workspaces](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-analytics-retention-in-log-analytics-workspaces) Log Analytics keeps data in two states: analytics (interactive) retention, where it can be queried directly, and long-term retention, a lower-cost state from which data is retrieved with search jobs or restore. When a compliance or audit... Other - Azure Log Analytics CER-0424 ### [Unused Restored Tables in Log Analytics Workspaces](https://www.pointfive.co/efficiency-hub/inefficiencies/unused-restored-tables-in-log-analytics-workspaces) The Log Analytics restore operation brings a time range of data from long-term retention (or from any Analytics table) into the hot cache as a new table ending in \_RST, so that it can be queried with full KQL at high performance. It is... Other --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.