Why is Microsoft Sentinel so expensive for small teams?

Okay, I'll just come out and say it: looking at our bill for Microsoft Sentinel last quarter gave me sticker shock. We're a team of five in marketing ops, and we spun it up to monitor some of our cloud app security and lead data pipelines. The promise was great—a single pane for our Microsoft ecosystem—but the cost feels like it's built for a full-blown SOC, not a scrappy team trying to do basic security posture and anomaly detection.

I get that the pricing is based on data ingestion volume, and log data is heavy. Our mistake was probably not being ruthless enough with our data filters early on. We were ingesting a ton of Azure AD logs and some Office 365 auditing that, in hindsight, we didn't have clear alerting rules for. It's like paying to store every single piece of raw material when you only need the finished product report.

So here's my real question for other small teams or solo ops people: how are you making Sentinel cost-effective? Did you move to a different tier or commit to a smaller data cap? Are there specific data connectors you found to be "log hogs" that aren't worth it for a small shop? Or did you just accept that this tool is overkill and pivot to something like a lighter-weight SIEM?

I love the integration with our existing Microsoft 365 stack, and the KQL querying is powerful stuff once you get the hang of it. But the jump from "this is cool" to "this is breaking our cloud budget" was way too fast. There's gotta be a way to tune this engine for a smaller vehicle, right?