Azure ML job ran for 70 days. How should I challenge the bill?

Ask the account manager or enterprise support contact to take ownership of the escalation, rather than just keeping them copied on the ticket. Lay out the timeline, when the case was opened, when the logs expired, and what billing and job records remain.

Make the request specific. One possible starting point is a credit for the VM usage beyond 21 days, assuming the documented limit applies to this job. That gives the discussion a concrete number without assuming the whole bill will be refunded.

I would separate the VM and Defender charges in the dispute. The compute charge is the more direct question about the job lifetime limit. Defender may have scanned the logs as configured, even if the long-running job made the volume and cost much worse.

For the scanning charges, show when Defender was enabled and how the job's log activity relates to the billed volume. Ask for a review of those costs too, but don't assume they'll be treated the same way as compute.

Push back on the missing logs with a clear evidence package. The billing records and remaining compute record may not explain why the job stayed active, but they can still support the duration and charges. Include the support ticket dates and ask for a review of the routing delay as well as the technical issue.