Update billing.md with Data Lake query charges details

[garis]

Clarified billing details for Data Lake queries and usage reporting.

Part of IcM 784150762.

[learn-build-service-prod]

Learn Build status updates of commit d850eb3:

✅ Validation status: passed

File	Status	Preview URL	Details
sentinel/billing.md	✅Succeeded

For more details, please refer to the build report.

[prmerger-automator]

@garis : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

[prmerger-automator]

@garis : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

[ShannonLeavitt]

@edbaynash

Could you review the proposed changes?

IMPORTANT: When the changes are ready for publication, adding a #sign-off comment is the best way to signal that the PR is ready for the review team to merge.

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

[Copilot]

Pull request overview

Clarifies how Microsoft Sentinel data lake query usage is billed and how that usage appears (or doesn’t appear) in Defender portal usage reporting, specifically when queries are executed via Log Analytics / Azure Monitor.

Changes:

• Added guidance explaining that queries/search jobs run via Log Analytics or Azure Monitor are billed on the Log Analytics workspace resource.
• Clarified that some of this usage won’t appear in Defender Cost Management usage reporting.

[learn-build-service-prod]

Learn Build status updates of commit 91f21a6:

✅ Validation status: passed

File	Status	Preview URL	Details
sentinel/billing.md	✅Succeeded

For more details, please refer to the build report.

[learn-build-service-prod]

Learn Build status updates of commit 900c74f:

✅ Validation status: passed

File	Status	Preview URL	Details
sentinel/billing.md	✅Succeeded

For more details, please refer to the build report.