On June 19, 2017, a new pricing model was introduced to the OMS Security and Compliance management offer and it applies to all OMS pricing tiers including the Free Tier. If the Security & Audit Solution is added anytime after June 19, 2017, it will be free for the first 60 days. After the 60-day trial for the continuous use of this solution, a per node billing will be applied. This feature is called Solution Based Billing.

The OMS Free Tier Solution Based Billing Tracker – Security & Audit Dashboard helps detect Security & Audit Solution related activities in the Azure Activity Log, like Add or Remove, that is happening in a particular workspace after June 19, 2017, and verifies if the Solution Based Billing feature has been enabled for the Security & Audit Solution in that Free Tier OMS Workspace. If the Solution Based Billing feature is enabled, per node billing after 60 days of continuous use of the Security & Audit Solution will apply.

The OMS Free Tier Solution Based Billing Tracker Dashboard – Security & Audit consists of a summary tile on the main page of the OMS Portal that shows

  1. The number of computers connected and sending data to the Security & Audit Solution
  2. A “1” if Solution Based Billing has been activated for the Security & Audit Solution of this OMS Workspace, and “0” if otherwise,

within a default 24 Hour window.




More Views are available to provide further information when drilling-in from the summary tile.





To implement the OMS Free Tier Data Consumption Tracker Dashboard in an OMS Workspace, download the .omsview JSON file first and upload the file to the OMS Workspace using the Import option in the View Designer:

 

 

Helpful Search Queries:
Since the AzureActivity typed records from the Azure Activity Logs are available in an OMS Workspace for 90 days, the list of Security & Audit Solution related activities beyond 7 days after June 19, 2017, like when was the solution added or removed, can be retrieved with the following log search query to help with further analysis or auditing:  

Here is the main log search query that  lists the Security & Audit Solution related activities captured after June 19, 2017:
Type=AzureActivity Resource=Security*w* TimeGenerated>2017-06-19T00:00

Here is the query that provides further filtering to look for records of the Security & Audit Solution being added successfully after June 19, 2017:
Type=AzureActivity Resource=Security*w* ActivityStatus=Succeeded ActivitySubstatus=Created* TimeGenerated>2017-06-19T00:00  



For more information and examples, please visit:   

https://blogs.msdn.microsoft.com/wei_out_there_with_system_center/2017/06/26/oms-free-tier-solution-based-billing-tracker-security-audit/