Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
SC-100: Microsoft Cybersecurity Architect is the exam behind the Microsoft Certified: Cybersecurity Architect Expert, Microsoft's expert-level security certification. This guide covers the October 21, 2026 outline and its four domains, the three associate certifications that qualify you, the 700 passing score and $165 fee, the free annual renewal, DoD 8140 status, and the roles it fits.
The Microsoft Certified: Cybersecurity Architect Expert is Microsoft's expert-level security certification. You earn it by passing exam SC-100: Microsoft Cybersecurity Architect and holding one of three security associate certifications. It sits above SC-200, SC-300, and SC-500, and it's the only expert-level credential on Microsoft's security track.
The associate exams check whether you can implement and run a product. SC-100 asks what you would design around it, and its objectives are written with verbs like design, evaluate, specify, and recommend. You'll weigh a ransomware resiliency plan, a privileged access model, posture management for a hybrid and multicloud estate, and the controls for data used in AI workloads. Microsoft's audience profile describes an architect who turns a cybersecurity strategy into capabilities that protect an organization's assets, business, and operations, following Zero Trust principles across identity, devices, data, AI, applications, network, infrastructure, and DevOps.
The credential is issued and maintained by Microsoft. Besides the exam, you need one associate certification: Identity and Access Administrator (SC-300), Security Operations Analyst (SC-200), or Cloud and AI Security Engineer (SC-500). Azure Security Engineer Associate (AZ-500) isn't on the current list, and that exam retired on August 31, 2026. The English exam updates on October 21, 2026, and this page describes that outline: the same four domains and weights, with minor changes to the security operations and Microsoft 365 skill groups.
Ransomware resiliency, MCRA, the Cloud Security Benchmark, Zero Trust, secure AI adoption, CAF, Well-Architected, landing zones, and DevSecOps. 20 to 25%.
XDR, SIEM, and SOAR design, Entra ID and agent identities, privileged access, and Purview compliance. 25 to 30%.
Posture management, endpoints, IoT and OT, SaaS, PaaS, and IaaS baselines, containers, and Security Service Edge. 25 to 30%.
Microsoft 365 and Copilot controls, application security, API Management and WAF, classification, encryption, and Azure data services. 20 to 25%.
Four things that set the Cybersecurity Architect Expert apart from the SC-200, SC-300, and SC-500 exams below it.
SC-100 hands you requirements and asks which design meets them. Two answers can both protect the workload while only one fits the cost, effort, or compliance limit in the question. The outline also spans identity, security operations, infrastructure, applications, and data, so even a strong SC-300 holder walks in with three domains of design work outside their specialty.
Microsoft issues the expert credential only to candidates who also hold SC-300, SC-200, or SC-500. AZ-500 retired on August 31, 2026 and isn't on the current list. Our article on the AZ-500 to SC-500 change explains what replaced it.
The first domain ties straight to Microsoft reference material: the Cybersecurity Reference Architectures (MCRA), the Cloud Security Benchmark (MCSB), the Zero Trust adoption framework, the Cloud Adoption Framework, and the Azure Well-Architected Framework. Read them before you sit, because the best answer is usually the one those documents recommend, even when your own shop does it differently.
Microsoft doesn't claim a DoD 8140 mapping for SC-100, so don't count on it to satisfy a cyber-coded position on its own. The current matrix is published at the DoD Cyber Exchange.
Its standing comes from the market instead. The credential carries weight with organizations that run Entra ID, Defender, Sentinel, and Purview, and with the Microsoft partners and consultancies that design for them, because it maps to products they already own.
The certification and the SC-100 exam on the October 21, 2026 outline, checked against Microsoft Learn in October 2026.
SC-100 is the top of Microsoft's security track, so the next step goes sideways rather than up. The usual options are a vendor-neutral architecture credential, broader Azure solution design, or an advanced exam that is DoD 8140 approved.
The vendor-neutral architecture credential from ISC2. ISSAP is a 125-item, 3-hour exam across four domains with a $599 fee, and it's DoD 8140 approved. You qualify with an active CISSP plus 2 years in its domains, or with 7 years of cumulative experience and no CISSP. See our ISSAP guide.
Microsoft's other expert-level architect credential. AZ-305 covers the design of identity, governance, and monitoring, data storage, business continuity, and infrastructure on Azure, and it requires the Azure Administrator Associate. Pair it with SC-100 if your design work covers the whole Azure estate and not only its security. Our AZ-104 guide covers that prerequisite.
The vendor-neutral expert practitioner exam, formerly CASP+. SecurityX has up to 90 questions in 165 minutes, including performance-based items. Nothing is required to sit it, though CompTIA recommends 10 years in IT with 5 in security. It's DoD 8140 approved at the advanced level, a mapping Microsoft doesn't claim for SC-100. See our SecurityX guide.
SC-100 is the expert tier of Microsoft's security path. You reach it through one of three associate certifications, and from there the path branches into vendor-neutral architecture or broader cloud credentials. If you're earlier in the path, our SC-900 guide covers the fundamentals tier.
Earn one of three
Design the strategy
Two questions to answer before you commit: can you earn it, and should you pursue SC-100 specifically. Here's a straight answer to both.
SC-300, SC-200, or SC-500, plus the SC-100 exam.
Microsoft awards the Cybersecurity Architect Expert only to candidates who pass SC-100 and also hold one of the three qualifying associate certifications. Pick the associate exam closest to your daily work. Microsoft sets no minimum number of years, but its audience profile expects hands-on experience across identity and access, platform protection, security operations, data and AI security, application security, and hybrid and multicloud infrastructure, with expert skills in at least one of them.
Open book, but the clock keeps running.
You can open Microsoft Learn during the exam, but Microsoft adds no time for it, and looking up every question will run you out of minutes. What decides most items is reading the requirements and constraints closely. Take the free SC-100 practice assessment on Microsoft Learn, click through the exam sandbox, and read the MCRA, MCSB, and Zero Trust guidance the first domain is built on before you book a date.
SC-100 is a credential for people already doing senior security work, so it backs a move into design roles rather than opening an entry-level door. These are the roles whose daily work matches the SC-100 objectives.
Owns the security design across identity, infrastructure, applications, and data, and turns a strategy into controls the engineering teams can build. This is the role the SC-100 audience profile describes most directly.
Designs posture management and workload protection for Azure, hybrid, and multicloud estates with Defender for Cloud, Azure Arc, and landing zones. The infrastructure domain, worth 25 to 30 percent of the exam, is this job on paper.
Designs Microsoft Entra ID for hybrid and multicloud access, external identities, Conditional Access, and privileged access with PIM and the enterprise access model. A natural step for an SC-300 holder who already runs Entra ID day to day.
Designs detection and response with Defender XDR and Microsoft Sentinel, sets the logging strategy, automates response, and measures coverage against MITRE ATT&CK. It is the design-level move up from the SC-200 analyst seat.
Assesses a client's Microsoft security estate, recommends a Zero Trust roadmap, and designs the target architecture. For consultants and Microsoft partner staff, an expert credential on a Microsoft Learn transcript is a design claim a client can verify.
Translates regulatory requirements into security controls with Microsoft Purview, Azure Policy, and the regulatory compliance views in Defender for Cloud. SC-100 tests that translation directly in its second domain.
The closest comparisons for SC-100 are Microsoft's other expert-level architect credential and two vendor-neutral architecture exams. Here is how the four line up.
| SC-100 | Azure Solutions Architect Expert (AZ-305) | CISSP-ISSAP | CompTIA SecurityX (CAS-005) | |
|---|---|---|---|---|
| Issuer | Microsoft | Microsoft | ISC2 | CompTIA |
| Level | Expert | Expert | Advanced, standalone | Expert, vendor-neutral |
| Focus | Security architecture with Microsoft products and frameworks | Azure infrastructure solution design | Vendor-neutral security architecture | Advanced security architecture and engineering |
| Domains | 4 | 4 | 4 | 4 |
| Prerequisites | One of SC-300, SC-200, or SC-500 | Azure Administrator Associate (AZ-104) | Active CISSP plus 2 yrs, or 7 yrs without CISSP | None (10 years recommended) |
| Exam | 100 min (120 with labs), count not published | 100 min (120 with labs), count not published | 125 items, 3 hrs | Up to 90 items, 165 min |
| Passing Score | 700 of 1000 | 700 of 1000 | 700 of 1000 | Pass/fail (no scaled score) |
| Cost (US) | $165 | $165 | $599 | About $544 |
| Validity | 1 year, free renewal | 1 year, free renewal | 3 years, 60 CPEs (140 without CISSP) | 3 years, 75 CEUs |
| DoD 8140 | No mapping claimed | No mapping claimed | Approved | Approved (Advanced) |
| Best For | Security architects in Microsoft environments | Azure solution architects | Vendor-neutral security architects | Senior security architects and engineers |
Pricing varies by region and taxes. Microsoft claims no DoD 8140 mapping for SC-100 or AZ-305, so their recognition is market-driven. Exam lengths for both follow Microsoft's published rule for expert exams (100 minutes, or 120 when an exam form contains labs), and AZ-305 facts are from Microsoft Learn. ISSAP facts are from our ISSAP guide and SecurityX facts are from our SecurityX guide.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our Cybersecurity Architect Expert boot camp is four days of live, instructor-led Microsoft authorized training, in person or online. It covers all four SC-100 domains with Official Microsoft Courseware, hosted practice labs, practice questions mapped to the domains, and exam prep review sessions. Your $165 SC-100 exam voucher and an exam retake are included.
The SC-100 exam in detail, how the prerequisite list changed in 2026, the Zero Trust theory the exam builds on, and how to study from Microsoft's own outline.
A domain-by-domain read of the October 21, 2026 outline, how SC-100 questions turn on constraints like cost and administrative effort, and which associate prerequisite suits your background.
What retired with the Azure Security Engineer exam, what the Cloud and AI Security Engineer credential covers instead, and how much of SC-500 is about AI. SC-500 is now one of the three SC-100 prerequisites.
The vendor-neutral model under Microsoft's Zero Trust adoption framework. Useful background for the first SC-100 domain, which expects designs that align with Zero Trust.
Which certifications teach Zero Trust in depth, Microsoft and vendor-neutral, and why deployment experience still counts for more than the badge.
The Microsoft lineup after the 2026 retirements, from fundamentals through associate and expert, and how the yearly renewal model changes which credentials are worth chasing.
The Microsoft credentials getting the most attention this year, what each one costs, and the retirements, AZ-500 among them, that left many ranking lists out of date.
How to study from an official outline. Microsoft publishes its version as a study guide with a change log, which is how you spot what moved in the October 21, 2026 SC-100 update.
The SC-100 exam is organized into four domains, each carrying its own weight. Security operations, identity, and compliance (domain 2) and infrastructure (domain 3) are the heaviest at 25 to 30 percent each. Click any domain for what it covers.
Strategy and frameworks. It opens with a resiliency strategy for ransomware and other attacks: business continuity and disaster recovery with secure backup and restore for hybrid and multicloud estates, ransomware mitigation that puts BCDR and privileged access first, and security updates. Designs then have to align with the Microsoft Cybersecurity Reference Architectures (MCRA), the Microsoft Cloud Security Benchmark (MCSB), and the Zero Trust adoption framework, including AI solutions aligned to the MCSB and a strategy for secure AI adoption. The domain closes with security and governance under the Cloud Adoption Framework and the Azure Well-Architected Framework, Azure landing zones, and a DevSecOps process.
The widest domain. Security operations covers XDR and SIEM detection and response, centralized logging and auditing with Microsoft Purview Audit, SOAR with Microsoft Sentinel and Defender XDR, incident response and threat hunting workflows, and detection coverage measured against MITRE ATT&CK for Enterprise, Mobile, and ICS. Identity covers Microsoft Entra ID in hybrid and multicloud environments, agent identities with Microsoft Entra Agent ID, external identities, Conditional Access and continuous access evaluation, AD DS hardening, and secrets, keys, and certificates. Privileged access (the enterprise access model, PIM, entitlement management, access reviews, and privileged workstations) and regulatory compliance with Purview, Azure Policy, and Defender for Cloud round it out.
Posture management first: Microsoft Defender for Cloud and the MCSB, Microsoft Secure Score, cloud workload protection, Azure Arc for hybrid and multicloud, Defender External Attack Surface Management, and Microsoft Security Exposure Management attack paths and initiatives. Endpoint requirements follow for servers, clients, mobile devices, IoT, and OT and ICS environments through Microsoft Defender for IoT, plus security baselines and Windows LAPS. It finishes with baselines for SaaS, PaaS, and IaaS, requirements for web, container, and orchestration workloads, Azure AI services security, and network security and Security Service Edge with Microsoft Entra Internet Access and Private Access.
Microsoft 365 posture and Secure Score, Defender for Office 365, Defender for Cloud Apps, Intune, Purview data security, and the data security and compliance controls in Microsoft 365 Copilot. Application security covers threat modeling for business-critical apps, a full lifecycle application security strategy, workload identities, API management, and Azure Web Application Firewall. Data security covers discovery and classification, encryption at rest and in transit with Azure Key Vault, data used in AI workloads, Azure SQL, Synapse Analytics, Cosmos DB, and Azure Storage, and Defender for Storage and Defender for Databases.
Domains and weights reflect the Microsoft SC-100 skills-measured outline that takes effect October 21, 2026 for the English exam. Localized versions follow about eight weeks later. The change log marks minor changes to two skill groups, Design solutions for security operations and Evaluate solutions for securing Microsoft 365, and no change to the audience profile. Microsoft refreshes exams periodically, so confirm the current outline on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the Microsoft Cybersecurity Architect Expert certification.
The Microsoft Certified: Cybersecurity Architect Expert is Microsoft's expert-level security certification. You earn it by passing exam SC-100: Microsoft Cybersecurity Architect and holding one of three associate certifications (SC-300, SC-200, or SC-500). The exam tests whether you can design security strategy and architecture across Zero Trust, security operations, identity, compliance, infrastructure, applications, and data in hybrid and multicloud environments. Its questions ask what you would recommend, while the associate exams cover the configuration work.
Microsoft updates the English version of SC-100 on October 21, 2026. The four domains and their weights stay the same, and the audience profile is unchanged. The change log marks minor changes in two skill groups: designing solutions for security operations, and evaluating solutions for securing Microsoft 365. Localized versions follow about eight weeks after the English exam. This page describes the October 21, 2026 outline.
You need one of three associate certifications: Microsoft Certified: Identity and Access Administrator Associate (SC-300), Security Operations Analyst Associate (SC-200), or Cloud and AI Security Engineer Associate (SC-500). Azure Security Engineer Associate (AZ-500) is not on the current list, and that exam retired on August 31, 2026. Microsoft also expects experience implementing or administering identity, platform protection, security operations, data and AI security, application security, and hybrid and multicloud infrastructure, with expert skills in at least one. If you're new to Microsoft security, start with SC-900.
The four domains are Design solutions that align with security best practices and priorities (20 to 25 percent), Design security operations, identity, and compliance capabilities (25 to 30 percent), Design security solutions for infrastructure (25 to 30 percent), and Design security solutions for applications and data (20 to 25 percent). The two middle domains carry the most weight, 50 to 60 percent of the exam between them.
Microsoft doesn't publish a question count or a fixed format for SC-100. Its general guidance is that most certification exams have 40 to 60 questions, and that expert exams run 100 minutes, or 120 minutes when the exam form contains labs, with 20 more minutes of seat time for instructions and the candidate agreement. Microsoft doesn't list which exams contain labs, so check the time shown when you register. The exam sandbox on Microsoft Learn shows question types such as case studies in the real exam interface.
You need 700 on a scale of 1 to 1,000. It's a scaled score, so 700 doesn't mean 70 percent correct. Microsoft bases the passing line on the skills needed and the difficulty of the questions. There's no penalty for guessing, and some unscored questions may appear, so answer every question.
SC-100 costs $165 USD in the United States. The price varies by the country or region where you test and doesn't include taxes. You schedule it through Pearson VUE, online or at a test center. Training Camp's Cybersecurity Architect Expert boot camp includes the $165 exam voucher and an exam retake in the program fee.
Microsoft doesn't claim a DoD 8140 mapping for SC-100, so don't count on it to satisfy a cyber-coded position requirement on its own. Its value is with employers, Microsoft partners, and consultancies that design and run security on Entra ID, Defender, Sentinel, Purview, and Azure. If you need an 8140-approved architecture credential, CISSP-ISSAP and CompTIA SecurityX are both approved. See the full DoD 8140 work role paths.
Yes. Microsoft expert certifications are valid for one year. You renew for free by passing an unproctored, open-book assessment on Microsoft Learn, which opens six months before your expiration date, with no limit on attempts. Your expert certification won't expire just because your associate prerequisite does, but each certification has to be renewed separately.
SC-100 backs senior roles rather than entry-level ones. It fits cybersecurity architect, cloud security architect, identity architect, security operations architect, security consultant, and GRC or compliance architect roles, especially in organizations built on Microsoft security tools. It tells an employer you've passed an exam that tests design across identity, security operations, infrastructure, applications, and data, not the configuration of a single product.
They cover the same job from different angles. SC-100 is a $165 Microsoft exam about designing security with Microsoft's products and frameworks. It requires an SC-300, SC-200, or SC-500 associate certification and renews free every year. ISSAP is a vendor-neutral ISC2 exam of 125 items in 3 hours that costs $599, requires an active CISSP plus 2 years or 7 years of experience without one, and is DoD 8140 approved. If your organization runs on Microsoft security, SC-100 maps to your daily work. If you need a vendor-neutral or government-recognized architecture credential, take ISSAP. Some architects hold both.
It's an expert-level exam, and the difficulty is judgment more than recall. The objectives are written around designing and evaluating, so expect scenarios where several answers look reasonable and the stated requirements decide which one is right. The outline also spans the whole Microsoft security stack, which means a candidate who knows identity or security operations well still has to design for infrastructure, applications, and data. Read Microsoft's reference architectures and Zero Trust guidance, spend time in a real tenant, and take the free practice assessment before you sit.
For security engineers and architects who already hold SC-200, SC-300, or SC-500 and design security for Microsoft environments, yes. It's Microsoft's only expert-level security certification, it costs $165, it renews free every year, and its October 21, 2026 outline covers current topics such as secure AI adoption, Microsoft Entra Agent ID, and Microsoft Security Exposure Management. It's a weaker fit if you don't yet hold a qualifying associate certification, if your work is vendor-neutral or mostly outside Microsoft, or if you need a credential that is DoD 8140 approved.
If you're weighing the certification, choosing which associate prerequisite to take first, or arranging training for a security team, tell us where you are and we'll help you map out the right path.