# Azure logs without the analytics-tier decision.

Azure Monitor and Sentinel price the data you actively detect on, which pushes everything else into basic or archive tiers where investigating means restoring first. CtrlB keeps the full history in your own storage and searchable in place.

## Metadata

- **Canonical HTML**: https://ctrlb.ai/solutions/azure
- **Section**: Solutions — Azure

## At a glance

| Figure | What it refers to |
|--------|-------------------|
| One tier | No archive to restore from |
| Entra ID | Sign-in logs kept in full |
| Your storage | Azure Blob you control |
| Years | Retention at storage pricing |

## The tiering problem

- Analytics-tier pricing forces a decision about which logs are worth detecting on, made before you know what an incident will need.
- Basic and archive tiers are cheaper precisely because the data in them is not directly queryable.
- Restoring an archived table to answer one question adds hours to an investigation that should take minutes.
- Diagnostic settings that would be useful get left off, because the volume lands in the expensive tier.

## What changes

- Activity, Entra ID sign-in, and resource diagnostic logs land in your own Azure storage account at storage prices.
- There is no archive tier, so the oldest month answers as fast as the newest and nothing needs restoring first.
- Volume stops being the deciding factor in which diagnostic settings you turn on.
- Sentinel keeps the analytics rules and incident workflow your SOC already runs — see the coexistence page.

## How it works

1. **Export to your storage account** — Diagnostic settings already support export to Blob storage. Point them there and CtrlB indexes what lands.
2. **Index in place** — Indexes are written beside the data in the same storage account, so nothing leaves your subscription.
3. **Search the whole window** — One query surface across every retained day, whether it arrived this morning or two years ago.

## Capabilities

- **Entra ID sign-in logs**: High-volume identity telemetry kept complete rather than sampled to fit a tier.
- **Activity logs**: Control-plane changes across subscriptions, searchable as one history.
- **Resource diagnostics**: Per-service diagnostic logs land schema-less, so new fields never break ingestion.
- **Your subscription**: Data and indexes stay in the storage account and region you choose.
- **Multi-cloud**: Azure telemetry sits in the same lake as AWS and GCP, queried together.
- **Runs beside Sentinel**: Take the volume and the retention; leave the analytics rules where they are.

## FAQ

**Does this replace Sentinel?**

It does not have to. The common pattern is to keep Sentinel for analytics rules and incident workflow while the high-volume connectors and long-tail retention move to your own storage.

**Where does the data live?**

In your own Azure storage account, in the region you choose, with the indexes alongside it.

**Can we search archived data without restoring it?**

There is no archive tier to restore from. Every retained object is directly queryable at the same speed.

**Does it work alongside AWS and GCP sources?**

Yes. One lake spans clouds, with cloud and account as ordinary dimensions.

Markdown mirror: fetch `/solutions/azure.md` for this page as plain Markdown.