@Nicholas DiCola (SECURITY JEDI) What about the first part of the question? 

If I have 1000GB of data being ingested daily with 200GB of it being from O365 am I paying for

A) 1000GB of data for Sentinel and 800GB for Log Analytics Ingestion

B) 800GB for Sentinel and 1000GB for Log Analytics Ingestion

C) 800GB for Sentinel and 800GB for Log Analytics Ingestion

 

Plus the 1000GB data retention after 90 days

www.000webhost.com