Azure Monitor’s Auxiliary Logs plan is now generally available in the sovereign clouds, specifically Azure Government (Fairfax) and Microsoft Azure operated by 21Vianet (Mooncake). The September 1 update closes a gap that has mattered to anyone running compliance or audit logging for public-sector or regulated workloads, and it caps a year of quiet expansion for what is probably the most cost-relevant table plan in Log Analytics.
For context: Auxiliary is the low-cost tier for high-volume, verbose logs. Log Analytics tables come in three plans. Analytics is the default, fully indexed and query-optimized. Basic is cheaper, with a 30-day query window. Auxiliary sits below that, built for data you ingest in bulk and query rarely: think web server logs, syslog firehoses, and the audit trails you keep because an auditor says so, not because anyone reads them on a Tuesday.
What the sovereign GA actually includes
The sovereign launch ships the existing Auxiliary functionality: DCR-based custom tables (the ones with the _CL suffix), the same long-term retention behavior, the same query model, and the same pricing posture as commercial Azure. The newer capabilities from the August update, standard Azure table support and in-place plan switching, will reach the sovereign clouds after a stabilization period in public clouds.
That August update from the Azure observability team is worth a separate look, because it addressed the two most common complaints about Auxiliary. First, Auxiliary now covers a subset of standard Azure tables, selected by ingestion pattern, instead of only DCR-based custom tables. Second, you can switch existing tables between the Analytics and Auxiliary plans in place, without recreating them. That second one changes the calculus for anyone who picked a plan in 2024 and has been living with it: repartitioning your log estate is no longer a migration project.
The pricing math
Auxiliary went GA in April 2025 at $0.15 per GB ingestion in US East, with long-term retention at $0.02 per GB. Querying and search jobs are billed separately at $0.005 per GB scanned, a charge that started in May 2025. Compare that with Analytics-plan ingestion and the savings on a 10 TB/month audit pipeline are not subtle. The trade is query performance: Auxiliary queries are unoptimized and can be slow, charges are based on data scanned, and the KQL surface has real limitations.
There is also a broader data-platform play behind this. Microsoft has been converging its log storage on a common data lake stack, and the Sentinel data lake announced in 2025 shares it: data ingested there is accessible through Auxiliary logs without copying. If you are sizing log costs for a Sentinel deployment, you should treat Auxiliary pricing and Sentinel data lake access as one conversation, not two.
The gotchas, because there are always gotchas
Read the fine print before moving anything. Queries on Auxiliary tables are unoptimized and can take noticeably longer than Analytics queries. Basic tables cap queries at the past 30 days; Auxiliary supports time ranges across the full retention period, but you pay per scan, so a careless query over a two-year archive is a real invoice line. Workbooks and Grafana work with these plans, Azure Monitor Dashboards do not. And a details-level trap: Auxiliary ingestion drops records with duplicate column names that differ only in case, while Analytics and Basic tables treat column names as case sensitive. If your schema hygiene is loose, that one will find you at 2am.
Who should act on this
If you run Azure Government or 21Vianet workloads and have been shipping verbose logs to storage accounts or third-party archives because Auxiliary was commercial-only, the GA removes the blocker, and the Microsoft Learn page for custom Auxiliary tables now covers the sovereign setup. If you are on commercial Azure and have not looked at Auxiliary since 2024, the August update changed the economics: Azure table support and in-place switching mean the plan you evaluated a year ago is not the plan that exists now. Check which of your high-volume tables are in the supported subset, model the scan costs against your real query patterns, and switch the tables nobody interactive-queries. The retention bill is where this pays for itself.
How this fits the tiered logging picture
It helps to see the three plans as one lifecycle decision instead of three products. The pattern most teams converge on: Analytics for the tables security and operations actually query daily, Auxiliary for volume and compliance, and search jobs as the bridge when someone needs to look back through cold data. Microsoft Sentinel adds a wrinkle, since multi-tier logging pushes detection-critical tables to Analytics while archive tiers absorb the rest, and the Sentinel data lake sharing means data can move between tiers without re-ingestion. The plan-switching capability matters most for Sentinel users, because a table that starts life as hot detection data often decays into audit material after 90 days, and until now moving it meant recreating the table and re-pointing every DCR.
One honest gap: this update is about where Auxiliary runs and what it costs, not what it can do. Query limitations on these plans remain real, and anyone hoping sovereign GA came with faster queries or a wider KQL surface will be disappointed. The bet Microsoft is making is that most log data is written once, read rarely, and should be priced accordingly. The August capabilities and the sovereign rollout are all consistent with that bet, and so far customers auditing their ingestion bills seem to agree.