Azure HIPAA Cost in 2026

Microsoft's HIPAA BAA is a default term of the Data Protection Addendum rather than something you buy, and no Azure meter carries a HIPAA rate. What you pay is Defender, Sentinel, Key Vault and Log Analytics at their ordinary published rates. This page gives you those rates with the dimension each is actually charged on, which for most of Defender for Cloud is per node per hour and not the per-month figure you have probably seen quoted.

The structural point

There is no HIPAA SKU on Azure. Microsoft states the BAA is available through the Data Protection Addendum by default to any customer who is a covered entity or business associate, so there is nothing to negotiate and no fee attached to it. Your HIPAA-attributable Azure spend is the security services you choose to switch on, metered the way Microsoft meters them, plus the engineering time to configure and evidence them. Microsoft publishes no figure for that engineering time and neither do we.

The Microsoft BAA mechanics

Microsoft's HIPAA and HITECH Act offering page states that the BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA", checked July 2026. Two things follow that are worth internalising. There is no acceptance workflow to complete, unlike AWS Artifact or the Google Cloud console: if you are on the DPA and you are a covered entity or business associate, the BAA already applies. And Microsoft will not sign your paper, stating that it cannot use a customer's Business Associate Agreement.

Microsoft attaches no price to the BAA anywhere on that page. It also never says the BAA is free. Those are different statements and this page keeps them apart: what is verifiable is that the BAA is a default contract term with no fee published against it.

This is an informational cost reference, not legal or compliance advice. Consult a cloud-compliance attorney or a HIPAA-qualified compliance professional before architecting a HIPAA workload on Azure.

The published meters

Each row below is a separate meter on its own dimension. Microsoft publishes no combined security total for Azure and this page does not build one into a headline.

Meter	Published rate	Charged per
Defender for Servers Plan 1	$0.00672	per node per hour
Defender for Servers Plan 2	$0.02	per node per hour
Defender CSPM	$0.007	per node per hour
Defender for Storage	$0.0134	per storage account per hour
Defender for SQL, servers on machines	$15	per node per month
Microsoft Sentinel, pay-as-you-go	$4.30	per GB analysed
Sentinel Basic Logs	$1.00	per GB
Key Vault, secrets and software keys	$0.03	per 10,000 transactions
Key Vault, HSM-protected RSA 2048	$1	per key per month
Log Analytics, Analytics Logs	$2.30	per GB, first 5 GB per month free
Log Analytics retention	$0.10	per GB per month beyond the free period

East US, checked July 2026, read from Microsoft's own Azure Retail Prices API, which returns the actual billing meters. Commitment tiers and Defender Commit Units reduce these rates and are published separately; Microsoft advertises up to 22 percent off pay-as-you-go on Defender pre-purchase and up to 52 percent on Sentinel commitments.

Why you will not find these numbers on the pricing page

Azure's pricing pages render every dollar figure client-side. Fetch the Defender for Cloud pricing page and the served HTML contains placeholder dashes where the prices go: "$- /Vault/month", "$- /Subscription/month". The unit wording is server-rendered and citable. The numbers are not.

This is why the "$5 per server per month" and "$15 per server per month" Defender for Servers figures circulate so widely and cite nothing. We could not verify either from a Microsoft surface. The Learn documentation on selecting a Defender for Servers plan carries no dollar figures at all. What Microsoft's API does return is $0.00672 and $0.02 per node per hour. Multiply by a 730-hour month and you land near $4.90 and $14.60, which is close to the folklore but is our arithmetic on an hourly meter, not a Microsoft-published monthly price. We report the meter.

Microsoft's Sentinel pricing page is the starker case: it publishes no rates at all, only a percentage saving claim and a link to sales. A per-GB figure exists and is real, but you have to query the API to see it.

What the stack costs at one worked volume

Our arithmetic, not a vendor price

Microsoft publishes the per-unit meters. Microsoft does not publish this total, and does not publish a monthly figure for the hourly meters at all: the 730-hour month is ours, as are the volumes. Substitute your own.

Assumed monthly volume	Against the published meter	Line
10 VMs on Defender for Servers Plan 2	10 x 730 h x $0.02	$146.00
10 nodes on Defender CSPM	10 x 730 h x $0.007	$51.10
50 GB per month into Sentinel	50 x $4.30	$215.00
5 HSM-protected RSA 2048 keys	5 x $1	$5.00
200,000 Key Vault transactions	20 x $0.03	$0.60
Our total for these assumed volumes		$417.70

As on AWS, the total is ours and applies to nobody. The shape is the transferable part: Sentinel ingestion and Defender node-hours are the whole bill, and key management is a rounding error. The two levers are how many nodes you protect and how many GB you send to Sentinel. Before you model anything else, meter your log volume, and check whether your workspace is still inside the 31-day, 10 GB per day free window that Microsoft grants new workspaces, because that window is why Sentinel bills look fine in month one and different in month two.

Common Azure HIPAA budget mistakes

Letting Defender auto-enrol the estate. Microsoft states that "when you enable Microsoft Defender for Cloud, we automatically enroll and start protecting all your resources unless you explicitly decide to opt-out", and that the first 30 days are free. Both facts together produce the classic Azure surprise: a free month across every subscription, then a bill for node-hours nobody scoped.

Reading the hourly meters as monthly. $0.02 per node per hour is not $0.02 per node per month. On a 100-VM estate that mistake is two orders of magnitude.

Assuming the free Sentinel data sources cover you. Azure Activity, Sentinel Health, Office 365 audit logs and Defender alerts are free. Microsoft warns that the raw underlying logs for several Defender data types are paid, so the alert is free and the evidence behind it may not be.

Forgetting retention. Sentinel retains ingested data at no charge for the first 90 days. After that, Log Analytics retention is $0.10 per GB per month. HIPAA sets no single retention period for audit logs, but 45 CFR 164.316(b)(2)(i) requires six-year retention of the documentation the rule requires, and where your own policy commits you to a long log-retention window, that window has a published per-GB price.

Azure HIPAA cost FAQ

Does Microsoft charge for the HIPAA BAA?

Microsoft makes no pricing statement about the BAA at all. What it makes is an availability statement, in its own words on the HIPAA and HITECH Act offering page: "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA" (learn.microsoft.com, checked July 2026). Microsoft also states "Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services." There is no separate BAA to negotiate, sign or buy, because it is already a default term of the DPA you are on. That is not the same as Microsoft publishing that the BAA is free, and this site does not put that phrase in Microsoft's mouth: the accurate statement is that the BAA is a default contract term and Microsoft attaches no price to it. One carve-out is worth knowing: the BAA is also available for in-scope Microsoft Professional Services, and for that Microsoft says to contact your services representative.

What does Microsoft Defender for Cloud cost?

Microsoft meters Defender for Cloud hourly, per node, not monthly. From Microsoft's own Azure Retail Prices API for East US, checked July 2026: Defender for Servers Plan 1 at $0.00672 per node per hour, Plan 2 at $0.02 per node per hour, Defender CSPM at $0.007 per node per hour, Defender for Storage at $0.0134 per storage account per hour, and Defender for Key Vault at $0.00034 per hour. Defender for SQL for servers on machines is one of the few genuinely monthly meters, at $15 per node per month. Two cautions. First, the widely repeated "$5 per server per month" and "$15 per server per month" headline figures for Servers Plan 1 and Plan 2 are not verifiable on any Microsoft surface we could read: the pricing page renders its figures client-side and the Learn documentation carries no dollar amounts, so this site quotes the hourly meters that Microsoft's own API returns and lets you do the multiplication. Second, Microsoft states that Defender for Cloud is free for the first 30 days and that enabling it automatically enrols all your resources unless you opt out, which is a real budget trap on a large estate.

What does Microsoft Sentinel cost?

Microsoft's Sentinel pricing page publishes no figures. It redirects to a security pricing page that states only "savings up to 52% over Pay-As-You-Go rates" and directs you to a cost estimator and to sales. The rates are however published through Microsoft's own Azure Retail Prices API: pay-as-you-go Sentinel analysis at $4.30 per GB in East US, with commitment tiers from 100 GB per day at $296 per day down to 50,000 GB per day at $102,600 per day, checked July 2026. Basic Logs analysis is $1.00 per GB. Microsoft does publish the free allowances in its documentation: the first 10 GB per day is free for 31 days on a new workspace, subject to a 20-workspace limit per tenant, and Microsoft states "Retain all data ingested into the workspace at no charge for the first 90 days." Azure Activity Logs, Microsoft Sentinel Health, Office 365 audit logs and security alerts from the Defender products are free data sources, though Microsoft warns that "although alerts are free, the raw logs for some Microsoft Defender XDR... data types are paid."

What does Azure Key Vault cost?

Microsoft publishes, in East US and confirmed against both the Azure Retail Prices API and the pricing page's own calculator data, checked July 2026: $0.03 per 10,000 transactions for secrets and software-protected keys, the same rate on both the Standard and Premium tiers; $0.15 per 10,000 transactions for advanced key operations on ECC and RSA 3072/4096 keys; $1 per HSM-protected RSA 2048 key per month on Premium; and a graduated rate for HSM-protected advanced keys starting at $5 per key per month for the first 250 and falling to $0.40 per key per month above 4,000. A Managed HSM pool is $3.20 per hour. Automated key rotation is $1 per scheduled rotation and a certificate renewal request is $3.

Is there a HIPAA surcharge on Azure?

No Azure service carries a HIPAA-specific rate on Microsoft's published meters. You pay for Defender, Sentinel, Key Vault and Log Analytics at the same rates as any other customer, and the BAA that brings them into scope is a default term of the Data Protection Addendum rather than a SKU. Unlike Google, Microsoft does not publish an explicit statement of a no-HIPAA-premium policy, so this site reports the absence of a surcharge on the meters rather than quoting Microsoft a promise it has not made. The practical consequence is the same either way: budget the services, not the compliance.

Why does this page quote an API rather than the pricing page?

Because the pricing page does not publish figures in a form that can be read and cited. Azure's pricing pages render every dollar amount client-side: the served HTML contains literal placeholder dashes, and the unit wording is all that is server-rendered. So the pages are good citations for the dimension, for example Defender for Key Vault's "per Vault per month", and useless as citations for the number. The Azure Retail Prices API at prices.azure.com is Microsoft's own documented first-party endpoint returning the actual billing meters, which makes it the better primary source and the one we cite. Where the two disagree on shape, we say so, as with Defender for Key Vault: the page words it per vault per month, the API meters it hourly.

Does the BAA make my Azure workload HIPAA compliant?

No, and Microsoft says so plainly: "By offering a Business Associate Agreement, Microsoft helps support your HIPAA compliance. However, using Microsoft services doesn't on its own achieve HIPAA compliance. Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place, and that your particular use of Microsoft services aligns with your obligations under HIPAA and the HITECH Act." Microsoft also states that it cannot use a customer's own BAA paper. The Security Rule work that remains yours is the same on any cloud: the risk analysis, the safeguards your analysis determines you need, the workforce and policy layer, and the evidence that all of it operates.

Related cost guides

AWS HIPAA Cost

KMS, CloudTrail, Config, GuardDuty rates

GCP HIPAA Cost

The one cloud that states its HIPAA pricing policy

Digital Health Startup Cost

Seed to Series A HIPAA pricing

Business Associate Agreements

BAA scope, cost, and red flags

HIPAA Email Cost

Microsoft 365 and Google Workspace

2026 Security Rule Changes

Cloud-architecture impact