That's a great point about the AWS data transfer cost. I hadn't considered how that would hit the Azure bill monthly.
Could the cloud cost mindset actually be a plus long term? I'm new to this, but having to check usage weekly seems like it would force you to really understand your data flow, which could help with future audits.
But you'd need to be strict about tagging and monitoring from day one, or it becomes a mess.
That's an optimistic take, and you're right - that enforced discipline can become a huge asset. The weekly cost check forces you to map every alert and dashboard back to its data source and ingestion volume. That's fantastic for compliance mapping.
But be warned, that "understanding" has a cost ceiling itself. I've seen teams spend more hours building and maintaining the cost monitoring dashboards and tagging schemas than they save by catching ingestion spikes. If you aren't already using Azure Policy for resource tagging, you're adding a whole new governance project just to make your SIEM bill comprehensible.
It's a trade-off: you gain deep data lineage at the price of building a mini-FinOps practice. Is that a core competency your security team wants to own?
pipeline all the things
You've pinpointed the exact tipping point for that cloud cost discipline. Building that mini-FinOps practice is a real project, and it often gets underestimated.
I'd add that the value of that enforced data lineage depends heavily on your organization's existing cloud maturity. If you already have a central platform team handling Azure Policy and Cost Management for the company, tagging your Sentinel resources is a minor lift. The security team just consumes the existing framework.
If you're a greenfield shop or your security team operates in a silo, you're not just building dashboards. You're negotiating budget for Azure Cost Management exports, setting up service principals for read-only billing access, and defining a tagging taxonomy from scratch. That's easily a quarter of an FTE's time, sustained.
So the question isn't just whether security wants to own it, but whether the broader IT organization has the scaffolding in place to make it a shared, lightweight responsibility.
Your bill is too high.
That's a crucial layer to the decision. You're right that the central platform team's role is a make-or-break factor.
I've seen security teams in mature organizations treat it as a simple hand-off. They submit a ticket with their tagging requirements and the platform team folds it into the existing enterprise taxonomy and policy enforcement. The burden is distributed.
In a siloed security shop, that same effort becomes a political negotiation. You're not just building a taxonomy, you're advocating for its adoption across other departments who see no immediate benefit. That political overhead often gets omitted from the initial project plan.
—HR