SC-100 is the exam behind Microsoft Certified: Cybersecurity Architect Expert, the top rung of Microsoft’s security certification track. Every question puts a business requirement in front of you and asks which design satisfies it with the least risk under a stated constraint like cost or administrative effort. You need a scaled score of 700 to pass, the exam costs $165 in the United States, and you must also hold one of three associate certifications (SC-200, SC-300, or SC-500) before Microsoft awards the expert credential.
The timing matters right now. Microsoft’s skills outline for SC-100 updates on October 21, 2026, and the prerequisite list changed when AZ-500 retired on August 31. If your study plan was built earlier this year, some of it needs adjusting. This breakdown covers what the exam measures, how the questions are built, and where candidates lose points.
Candidates who pass SC-100 can explain why three perfectly reasonable designs are wrong for this particular customer.
What Is the SC-100 Exam?
SC-100: Microsoft Cybersecurity Architect is an expert level exam for people who design security strategy across an organization. Microsoft’s audience profile describes someone who translates business requirements into secure, scalable solutions across Zero Trust, governance and compliance, security operations, identity, infrastructure, applications, and data, in hybrid and multicloud environments.
That description tells you what the exam leaves out. You won’t be asked to click through a portal or recall a PowerShell parameter. The exam assumes you already know how the tools work and tests whether you can pick between them under constraints.
What Changed in the October 21, 2026 SC-100 Update?
According to the change log on the official SC-100 study guide, the October 21 revision is small. Two areas received minor changes: designing solutions for security operations, and evaluating solutions for securing Microsoft 365. The audience profile is unchanged, and the four domain weightings hold where they were.
The prerequisite change has a bigger practical effect. AZ-500, the Azure Security Engineer Associate, retired on August 31, 2026, and its replacement is SC-500, the Cloud and AI Security Engineer Associate. SC-500 now sits alongside SC-200 and SC-300 as a qualifying certification. We covered that transition in detail in AZ-500 Retires August 31, 2026: SC-500 Replaces It.
The other thing to check is AI coverage. The current outline threads AI through all four domains, and older prep material often skips it. You will see secure AI adoption strategy under the Cloud Adoption Framework, AI solutions aligned to the Microsoft Cloud Security Benchmark, agent identities through Microsoft Entra Agent ID and Conditional Access, Azure AI services security, data security for AI workloads, and the data security and compliance controls in Microsoft 365 Copilot. None of these are the core of the exam. Each is still a scored objective, and a candidate who studied from a 2024 book has never seen several of them. Compare your materials line by line against the current skills list before you trust them. Most outdated prep fails on exactly these objectives.
SC-100 Skills Measured: The Four Domains
Microsoft groups SC-100 into four domains. The two middle domains carry the most weight, which is where the bulk of your preparation should go.
| Domain | Weight | Main topics |
|---|---|---|
| Design solutions that align with security best practices and priorities | 20 to 25% | Ransomware resiliency, MCRA, Microsoft Cloud Security Benchmark, Zero Trust, Cloud Adoption Framework, Well-Architected Framework, landing zones, DevSecOps |
| Design security operations, identity, and compliance capabilities | 25 to 30% | XDR and SIEM, Sentinel automation, MITRE ATT&CK coverage, Entra ID, Conditional Access, privileged access, Purview compliance, Azure Policy |
| Design security solutions for infrastructure | 25 to 30% | Defender for Cloud, Secure Score, Exposure Management, endpoints, IoT and OT, SaaS, PaaS, and IaaS baselines, containers, Security Service Edge |
| Design security solutions for applications and data | 20 to 25% | Microsoft 365 security, Copilot controls, threat modeling, API security, Azure WAF, data classification, encryption, database and storage protection |
Domain 1: Best practices and priorities (20 to 25 percent)
Candidates underestimate this domain because it reads like theory. It is the domain most tied to Microsoft’s own reference material: the Microsoft Cybersecurity Reference Architectures (MCRA), the Microsoft Cloud Security Benchmark (MCSB), the Zero Trust adoption framework, the Cloud Adoption Framework, and the Azure Well-Architected Framework. When a question asks for the best approach, the right answer is the one those documents recommend, even when your own organization does it differently.
Ransomware resiliency gets specific attention. Know how Microsoft frames business continuity and disaster recovery, secure backup and restore across hybrid and multicloud, and why privileged access is part of ransomware mitigation rather than a separate topic. If Zero Trust as a model is still fuzzy, our breakdown of what NIST 800-207 actually defines gives you the vendor neutral foundation that Microsoft’s framework builds on.
Domain 2: Security operations, identity, and compliance (25 to 30 percent)
This is the widest domain on the exam. Security operations covers detection and response with Microsoft Sentinel and Defender XDR, centralized logging including Microsoft Purview Audit, SOAR, threat hunting workflows, and measuring detection coverage against MITRE ATT&CK for Enterprise, Mobile, and ICS.
Identity is where candidates with SC-300 feel comfortable, and Conditional Access, continuous access evaluation, B2B access, and risk based policies will look familiar. Privileged access is where that comfort runs out. Expect questions on the enterprise access model, Privileged Identity Management, entitlement management, access reviews, cloud tenant administration, hardening AD DS, and privileged access workstations. Compliance closes the domain with Purview, Azure Policy, and validating regulatory alignment through Defender for Cloud.
Domain 3: Infrastructure (25 to 30 percent)
Posture management anchors this domain. You need to know where Defender for Cloud, Secure Score, Azure Arc, Defender External Attack Surface Management, and Microsoft Security Exposure Management each fit, because several questions hinge on picking the right one. Exposure Management’s attack path analysis and initiatives are fair game.
Endpoint objectives cover servers, mobile devices, IoT, and OT environments through Defender for IoT, plus security baselines and Windows LAPS. The rest of the domain asks you to specify baselines for SaaS, PaaS, and IaaS, secure containers and orchestration, and evaluate Security Service Edge designs using Microsoft Entra Internet Access and Microsoft Entra Private Access.
Domain 4: Applications and data (20 to 25 percent)
Microsoft 365 questions draw on Secure Score, Defender for Office 365, Defender for Cloud Apps, Intune, Purview data security, and the data controls in Microsoft 365 Copilot. Application security covers threat modeling, secure development lifecycle standards, workload identities, API Management, and Azure Web Application Firewall.
Data security asks you to prioritize discovery and classification, design encryption at rest and in transit with Azure Key Vault, and protect Azure SQL, Synapse, Cosmos DB, and Azure Storage with the matching Defender plans.
How Are SC-100 Questions Built?
The questions on SC-100 read like design reviews. Most items describe an organization, list requirements and constraints, then ask which solution you should recommend or which step comes first. Long scenarios and case studies are part of the format, so reading discipline matters as much as product knowledge.
The constraint words decide the answer. Two options can both meet the security requirement, and only one meets “minimize administrative effort” or “minimize cost.” Train yourself to underline the constraint before you look at the options.
A requirement to minimize administrative effort usually favors the native, managed Microsoft capability over a custom build. For least privilege on administrator accounts, look for just in time access through Privileged Identity Management before anything involving permanent role assignments. Questions about what to do first tend to land on assessment or discovery, because Microsoft’s frameworks put understanding the environment ahead of deploying controls. Drill these patterns until you spot them without thinking.
When candidates who know the products fail SC-100, the usual cause is misreading what the question was optimizing for.
Which Prerequisite Should You Earn Before SC-100?
You can sit SC-100 before you hold an associate certification, but Microsoft only issues the Cybersecurity Architect Expert credential once you also hold one of the three qualifying certifications. Pick the one that matches your current work, because each one maps to a different part of the SC-100 outline.
| Prerequisite | Credential | Best fit | SC-100 overlap |
|---|---|---|---|
| SC-200 | Security Operations Analyst Associate | SOC analysts, detection engineers | Security operations objectives in Domain 2 |
| SC-300 | Identity and Access Administrator Associate | Identity and Entra ID administrators | Identity and privileged access in Domain 2 |
| SC-500 | Cloud and AI Security Engineer Associate | Cloud security engineers, former AZ-500 track | Infrastructure and data in Domains 3 and 4 |
For most candidates who have no associate certification yet, SC-300 is the strongest starting point. Identity sits underneath Zero Trust, Conditional Access shows up across several domains, and privileged access is the area where SC-100 candidates most often struggle. A SOC analyst who lives in Sentinel every day should take SC-200 instead, because the shorter path is the one built on work you already do. For a full view of how these exams fit Microsoft’s role based structure, see the complete guide to Microsoft certifications.
If you held AZ-500 before it retired, check the certification dashboard in your Microsoft Learn profile before you schedule. Microsoft’s current prerequisite list names SC-200, SC-300, and SC-500 only.
How to Prepare for the SC-100 Exam
Start with the frameworks, because they shape how Microsoft wants questions answered. Read the security guidance in MCRA, the Microsoft Cloud Security Benchmark, the Cloud Adoption Framework, and the Well-Architected Framework security pillar, then the Zero Trust adoption guidance. Next, work through the Microsoft Learn path for the exam or the four day instructor led course, SC-100T00, which Microsoft positions for experienced security engineers. Spend time in a real tenant. Reading about Exposure Management attack paths and opening them in a lab are two very different levels of preparation. Practice with scenario based questions, and review every wrong answer by asking which requirement or constraint you missed. Keep a running list of product pairs that confuse you, such as Defender EASM versus Exposure Management, and resolve each one before exam day. Leave the final week for full length timed practice, since case studies punish slow readers.
Study tip: Build a single page map that lists every requirement type from the outline and the Microsoft product or framework that answers it. Ransomware recovery, privileged access, SaaS discovery, OT monitoring, data classification, and so on. When you can fill that page from memory, you are close to ready.
Some candidates prefer a structured, instructor led format for an expert exam. Training Camp’s SC-100 boot camp runs four days and includes the exam voucher.
Frequently Asked Questions About the SC-100 Exam
What is the SC-100 exam?
SC-100: Microsoft Cybersecurity Architect is the expert level exam required for the Microsoft Certified: Cybersecurity Architect Expert credential. It tests whether you can design security solutions across Zero Trust, security operations, identity, compliance, infrastructure, applications, and data in hybrid and multicloud environments.
What is the passing score for SC-100?
You need a scaled score of 700 or higher to pass SC-100. Microsoft uses scaled scoring, so 700 does not equal 70 percent of questions answered correctly.
What are the prerequisites for the Cybersecurity Architect Expert certification?
You must pass SC-100 and hold one of three associate certifications: SC-200 (Security Operations Analyst), SC-300 (Identity and Access Administrator), or SC-500 (Cloud and AI Security Engineer). Taking SC-100 first is allowed, but the expert credential is issued only once a qualifying associate certification is in place.
How much does the SC-100 exam cost?
The SC-100 exam costs $165 USD in the United States. Microsoft prices exams by country, so the fee differs elsewhere.
Does AZ-500 still count toward SC-100?
AZ-500 retired on August 31, 2026, and Microsoft’s current prerequisite list names SC-200, SC-300, and SC-500. If you earned AZ-500 before it retired, confirm your status in your Microsoft Learn certification dashboard before scheduling SC-100.
How hard is the SC-100 exam?
SC-100 is one of the harder Microsoft exams because it tests design judgment rather than configuration steps. Most questions are scenario based and hinge on constraints like cost or administrative effort, so candidates with strong product knowledge can still struggle if they misread what the question is optimizing for.
How do you renew the Cybersecurity Architect Expert certification?
Microsoft expert certifications expire after one year. You renew by passing a free online renewal assessment on Microsoft Learn, which becomes available in the six months before your expiration date.
Director, Educational Services | Training Camp
Mark Sabo is the Director of Educational Services at Training Camp, where he oversees the training team, course design, and certification program development. He holds a B.S. in Information Sciences and Technology from Penn State University and more than 50 industry certifications. Mark joined Training Camp in 2005, became a Technical Trainer in 2007, and assumed his current leadership role in 2015. His specialty is practice exam development and exam preparation strategy, built from years of teaching students in the classroom and studying how certification exams are constructed. His writing focuses on the technical details that matter most to professionals preparing for high stakes exams.