Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the Microsoft Certified: Security Operations Analyst Associate, Microsoft’s credential for SOC work in Defender XDR and Sentinel, as of October 2026. This guide covers the SC-200 exam on the skills outline in effect from October 21, 2026, the three domains and their weights, the exam length and passing score, the $165 fee, free annual renewal, DoD 8140 status, and the roles it fits.
The Microsoft Certified: Security Operations Analyst Associate, earned through exam SC-200, is Microsoft’s role-based certification for the people who work a security operations center on Microsoft tools. It shows you can run Microsoft Defender XDR and Microsoft Sentinel day to day, from tuning detections and working incidents to hunting with Kusto Query Language (KQL).
This is an associate exam, so it tests doing rather than describing. Microsoft’s audience profile is an analyst who reduces risk through triage, incident response, threat hunting, and detection engineering in multi-cloud and on-premises environments, using Defender XDR, Sentinel, Microsoft Entra ID, Microsoft Purview, and Defender for Cloud workload protections. Expect questions about which data connector to use for Windows Security events, when an automation rule beats a playbook, which KQL table holds the evidence, and what to do with an identity Defender for Identity has flagged.
SC-200 has no prerequisites, though Microsoft recommends familiarity with its security tools, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux, and mobile operating systems. It is issued and maintained by Microsoft and stays valid for 12 months, after which you renew it free online. The English exam moved to a new skills outline on October 21, 2026, and this page describes that version: three domains, with a minor change to the Sentinel data ingestion skills.
Defender XDR and Sentinel automation, Defender for Endpoint settings, Sentinel configuration, data ingestion, and detections. The largest domain at 40 to 45%.
Incidents across the Defender products, Entra ID, Purview, and Sentinel, plus Security Copilot, device response, and Microsoft 365 investigations. 35 to 40%.
KQL and Advanced Hunting in Defender XDR, Sentinel hunting queries, Data lake KQL jobs, summary rules, and notebooks. 20 to 25%.
Four things that make the Security Operations Analyst Associate the working credential for analysts in a Microsoft security stack.
SC-200 is written around the tools a Microsoft-based SOC actually runs: Defender XDR for endpoint, email, identity, and cloud app signals, Sentinel as the SIEM, Defender for Cloud workload protections, and Purview and Entra ID for the data and identity side. Passing it tells a hiring manager you can operate that stack from the console.
Up to 45 percent of the exam sits in managing the security operations environment, which includes analytics rules, custom detections, and data connectors. Threat hunting gets its own 20 to 25 percent domain built on KQL. If your experience is mostly the incident queue, plan extra study time for the configuration questions.
Where SC-900 checks that you know what Defender and Sentinel are for, SC-200 hands you the configuration screen and the open incident. If you are starting from zero, our SC-900 guide covers the fundamentals exam that sits below it.
SC-200 is not a DoD 8140 credential. Microsoft does not appear on the qualification matrix, so it will not satisfy a cyber-coded position on its own. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the job market and from Microsoft’s own ladder. SOC teams and Microsoft partners that run Defender and Sentinel ask for it, and it is one of three associate certifications that satisfy the prerequisite for the SC-100 Cybersecurity Architect Expert.
The certification and the SC-200 exam as of October 2026, on the skills outline in effect from October 21, 2026.
SC-200 opens three directions: up to Microsoft’s expert security exam, sideways into a vendor-neutral analyst credential, or over to the engineering side of Microsoft security.
The expert step. SC-100 requires one of three associate certifications, and SC-200 is one of them, alongside SC-300 and SC-500. The exam moves from running tools to designing security strategy across identity, data, AI, applications, infrastructure, and security operations. Our SC-100 exam guide walks through the outline and the prerequisite rules.
The vendor-neutral analyst credential. CySA+ covers security operations, vulnerability management, incident response, and reporting without tying them to one vendor’s tools, and it sits on the DoD 8140 matrix. If your next job might be a government SOC or a non-Microsoft stack, this is the one that travels. See our CySA+ guide.
The engineering move. SC-500 replaced AZ-500 on August 31, 2026 and covers implementing security controls for identities, data, applications, infrastructure, and AI workloads across Azure and hybrid environments. It suits an analyst who wants to fix the misconfigurations the SOC keeps finding instead of only reporting them.
SC-200 sits at the associate tier of Microsoft’s role-based path. It builds on security fundamentals, and from there the path leads to the SC-100 expert exam, a second Microsoft associate, or vendor-neutral analyst credentials.
Helpful groundwork, not required
The security operations credential
Two questions to answer before you commit: can you sit it, and should you pursue SC-200 specifically. Here’s a straight answer to both.
No prerequisites and no required experience.
SC-200 has no prerequisite certification. You register through Pearson VUE, pay the $165 US fee, and sit a 100-minute exam at a test center or online. Microsoft does expect familiarity with Microsoft 365, Azure, and its security tools, and the questions are written for someone who has used them.
An associate exam tests what you can configure.
Expect scenarios about data connectors, automation rules, playbooks, and KQL, not definitions. If you have never built an analytics rule or run an Advanced Hunting query, get time in a trial tenant before you book. Microsoft’s free practice assessment and the exam sandbox, both linked from the SC-200 certification page, show the question style and the interface.
SC-200 is a working analyst’s credential. These are the roles where the skills it tests get used every day, in SOCs that run on Defender XDR and Sentinel.
Works the alert queue in Microsoft Defender XDR and Sentinel, triages incidents, and escalates the ones that are real. SC-200 covers the investigation and response skills a Tier 1 or Tier 2 analyst uses on every shift.
Contains and cleans up confirmed attacks, from a compromised identity flagged by Microsoft Entra ID to a laptop that needs live response in Defender for Endpoint. The Respond to security incidents domain reads like this job description.
Looks for the attackers the alerts missed, using KQL in Advanced Hunting, Sentinel hunting queries, notebooks, and the Sentinel data lake. SC-200 gives hunting its own domain at 20 to 25 percent of the exam.
Writes and tunes the rules that create alerts in the first place: Sentinel analytics rules, Defender XDR custom detections, and MITRE ATT&CK coverage reviews. That work sits inside the heaviest SC-200 domain, next to automation and data ingestion.
Builds and runs Microsoft Sentinel itself, from data connectors on the Azure Monitor Agent and data collection rules to retention tiers, workbooks, and SOC optimization recommendations. Every one of those tasks is a named SC-200 objective.
Deploys and operates Defender and Sentinel for clients at a managed security provider or Microsoft partner. SC-200 shows a client you can stand the stack up and then work incidents in it.
SC-200 is most often weighed against the Microsoft fundamentals exam below it and the two CompTIA credentials that cover similar ground without the Microsoft product names. Here is how the four line up.
| SC-200 | Security, Compliance, and Identity Fundamentals (SC-900) | CompTIA Security+ (SY0-701) | CompTIA CySA+ (CS0-004) | |
|---|---|---|---|---|
| Issuer | Microsoft | Microsoft | CompTIA | CompTIA |
| Level | Associate (role-based) | Fundamentals | Entry to intermediate, vendor-neutral | Intermediate, vendor-neutral |
| Focus | Security operations in Defender XDR and Sentinel | Microsoft security, compliance, and identity concepts | General security concepts and operations | Threat detection and response (blue team) |
| Domains | 3 | 4 | 5 | 4 |
| Prerequisites | None | None | None (Network+ and 2 years recommended) | None (about 4 years recommended) |
| Exam | 100 min, count not published | 45 min, count not published | Up to 90 questions, 90 min | Up to 85 questions, 165 min |
| Passing Score | 700 of 1000 | 700 of 1000 | 750 of 900 | 750 of 900 |
| Cost (US) | $165 | $99 | About $439 | $439 |
| Validity | 1 year, free renewal assessment | Does not expire | 3 years, renews with CEUs | 3 years, 60 CEUs |
| DoD 8140 | Not listed | Not listed | Listed | Listed |
| Best For | Analysts in a Microsoft-based SOC | First security credential in a Microsoft shop | Vendor-neutral security and government roles | Vendor-neutral SOC analysts and DoD cyber roles |
Pricing varies by region and taxes. No Microsoft certification appears on the DoD 8140 qualification matrix, so their recognition is market-driven. SC-900 facts are from our SC-900 guide, Security+ facts from our Security+ guide, and CySA+ facts from our CySA+ guide.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
As a Microsoft training partner, we run a four-day Security Operations Analyst boot camp, live online or in person, that covers all three SC-200 domains with Microsoft Official Courseware, a Microsoft Official Practice Test, and 24/7 online practice labs. Your $165 exam voucher and a free retake are included, you can test on site at our Pearson VUE testing center, and 180 days of one-on-one coaching follow the class.
What SOC work looks like hour to hour, how the Microsoft security ladder changed in 2026, and what to sit after SC-200.
An hour-by-hour look at SOC work, from the shift handoff to alert triage in a SIEM like Microsoft Sentinel and endpoint digging in tools like Defender for Endpoint, plus how the Tier 1, 2, and 3 analyst levels split the load.
The expert exam SC-200 qualifies you for. Covers the October 21, 2026 SC-100 update, the $165 fee, the 700 passing score, and which of the three associate prerequisites maps to which part of the outline.
The ten Microsoft certifications people are sitting this year, with US fees and the best fit for each. For anyone who already works in a SOC, the article calls SC-200 the safer bet.
How the Azure Security Engineer exam retired and what the Cloud and AI Security Engineer credential covers. Worth reading if you are weighing SC-500 as the engineering step after SC-200.
Why CySA+ is the usual next step for people heading into security operations, and what Security+ leaves you unprepared for the first time you face a live alert queue.
The current Microsoft lineup after the 2026 retirements, including the security track that runs from SC-900 through SC-200, SC-300, and SC-401 up to the SC-100 expert exam.
ID rules, online proctoring, and retake waiting periods compared across vendors, including Microsoft’s 24-hour and 14-day retake rules and the Pearson VUE case number its waiver process requires.
The SC-200 exam is organized into three domains, each carrying its own weight. Managing the security operations environment is the heaviest at 40 to 45 percent, so configuration and detection engineering carry more weight than incident response. Click any domain for what it covers.
The heaviest domain, in four parts. Automation covers email and alert notifications in Microsoft Defender XDR (including tuning, suppression, and correlation), Defender for Endpoint advanced features, rules, custom data collection, attack surface reduction rules, device groups and automation levels, automated investigation and response, automatic attack disruption, and Microsoft Sentinel automation rules and playbooks. Platform work covers Sentinel roles, data retention across the Analytics, Data lake, and XDR tiers, workbooks, and SOC optimization. Ingestion covers picking data connectors, Windows Security Events via AMA with data collection rules, Windows Event Forwarding, Syslog and CEF via AMA, Azure activity logs through Azure Policy and diagnostic settings, threat indicators, and custom log tables. Detections close it out: custom detection rules in Advanced Hunting, Sentinel analytics rules (scheduled, near-real-time, threat intelligence, and machine learning), MITRE ATT&CK coverage, and anomalies.
Working incidents to closure. In Defender XDR you investigate and remediate threats raised by Defender for Office 365, Microsoft Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Microsoft Entra ID, Defender for Identity, and Sentinel, use agentic AI including embedded Microsoft Security Copilot, untangle multi-stage and lateral movement attacks, and manage cases. In Defender for Endpoint you read device timelines, run live response, collect investigation packages, investigate evidence and entities, and handle incidents from automatic attack disruption. The domain ends with Microsoft 365 activity, using Purview Audit, Content search in Purview eDiscovery, and Microsoft Graph activity logs.
Proactive hunting with Kusto Query Language (KQL). In Defender XDR that means choosing the right table, writing Advanced Hunting queries, reading threat analytics, building hunting graphs including blast radius, and tracing entity relationships with Sentinel Graph. On the Sentinel platform it means creating and monitoring hunting queries, running KQL jobs in the Data lake, building summary rule tables, and hunting in notebooks, including a connection to the Sentinel MCP Server.
Domains and weights reflect the Microsoft SC-200 skills-measured outline in effect from October 21, 2026 for the English exam. The change log lists one minor change, to the Sentinel data ingestion skills, and no change to the audience profile. Localized versions follow about eight weeks after English, and Microsoft refreshes exams periodically, so confirm the current outline on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the Microsoft Security Operations Analyst Associate certification.
The Microsoft Certified: Security Operations Analyst Associate, earned by passing exam SC-200, is Microsoft’s role-based certification for security operations work. It covers configuring and running Microsoft Defender XDR and Microsoft Sentinel, responding to incidents across the Defender products, Microsoft Entra ID, and Microsoft Purview, and hunting for threats with Kusto Query Language (KQL). It’s an associate exam, so the questions are scenarios that ask what you would configure or do next.
Microsoft moved the English version of SC-200 to a new skills outline on October 21, 2026. The change log on the official study guide lists one minor change, to the skills for ingesting data into the Microsoft Sentinel SIEM and platform, and no change to the audience profile. The three domains and weights on this page are the October 21, 2026 versions. Localized versions of the exam are updated about eight weeks after English.
No. As of October 2026, SC-200 is not on Microsoft’s list of exams scheduled to retire in the next 12 months, and Microsoft has not announced a replacement. That sets it apart from AZ-500, which retired on August 31, 2026 and was replaced by SC-500. Microsoft does refresh the SC-200 outline periodically, so check the study guide before you book.
No. SC-200 has no prerequisite certification and no required experience, so anyone can register. Microsoft does recommend familiarity with its security, compliance, and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux, and mobile operating systems. People who have spent real time in Defender XDR and Sentinel have a much easier exam than people who have only read about them.
The three domains are Manage a security operations environment (40 to 45 percent), Respond to security incidents (35 to 40 percent), and Perform threat hunting (20 to 25 percent). The first is the heaviest and covers automation, Sentinel configuration, data ingestion, and detection rules, so the exam rewards configuration experience as much as investigation skill.
Microsoft does not publish a question count for SC-200. Its general guidance is that most certification exams have 40 to 60 questions and that the number varies by exam. You get 100 minutes, and the exam may include interactive components. The exam sandbox on Microsoft Learn shows the question types in the same interface you will use on exam day.
You need 700 on a scale of 1 to 1,000. It’s a scaled score, so 700 does not mean 70 percent correct. Microsoft sets the passing line from the difficulty of the questions on your exam form, and some questions may be unscored, so answer every question as if it counts.
SC-200 costs $165 USD in the United States as of October 2026, the standard price for Microsoft associate and expert exams. Prices vary by country, and some regions add taxes. You schedule through Pearson VUE and test at a test center or online. Training Camp’s Security Operations Analyst boot camp includes the exam voucher and a free retake in the program fee.
No. Microsoft certifications don’t appear on the DoD 8140 qualification matrix, so SC-200 on its own won’t satisfy a cyber-coded position requirement. If you need an 8140 credential for SOC work, CompTIA CySA+ is the usual choice, and nothing stops you from holding both. SC-200’s value is with employers and Microsoft partners whose SOC runs on Defender and Sentinel. See the full DoD 8140 work role paths.
Yes. The Security Operations Analyst Associate is valid for 12 months. You renew it free by passing an unproctored, open-book renewal assessment on Microsoft Learn, which opens six months before your expiry date and takes about 45 minutes. There is no limit on renewal attempts, but if the certification lapses you have to pass SC-200 again.
SC-200 lines up with SOC analyst, incident responder, threat hunter, detection engineer, and SIEM engineer roles, plus security consulting at managed security providers and Microsoft partners. It carries the most weight where the security stack is Defender XDR and Sentinel, because the exam is built on those tools and on KQL.
It depends on your SOC. SC-200 is a 100-minute, $165 exam built on Microsoft Defender XDR, Sentinel, and KQL, and it renews free every year. CompTIA CySA+ is a vendor-neutral analyst exam of up to 85 questions in 165 minutes, it’s on the DoD 8140 matrix, and it renews every three years with 60 CEUs. If your team runs on Microsoft tools, SC-200 maps to the job. If you need a credential that HR filters and DoD roles recognize, take CySA+. You can also hold both, since they test different things: SC-200 the Microsoft tools, CySA+ the analyst method.
Much harder than SC-900, because it asks you to configure and investigate rather than describe. You need to know which data connector fits a log source, how automation rules differ from playbooks, which KQL table holds the evidence, and which Defender for Endpoint action fits a compromised device. You can open Microsoft Learn during the exam, but the clock keeps running, so it helps with a detail and not with a topic you never studied. Time in a trial tenant and Microsoft’s free practice assessment are the best preparation.
For analysts who work in, or want to join, a SOC that runs Microsoft Defender XDR and Sentinel, yes. It costs $165, renews free each year, tests the tools those teams use every day, and is one of three associate certifications that qualify you for the SC-100 Cybersecurity Architect Expert. It’s a weaker fit if your SOC runs a non-Microsoft stack or if you need a credential on the DoD 8140 matrix, where CySA+ does more for you.
If you’re weighing the certification, planning a move into a Microsoft SOC, or arranging training for a security operations team, tell us where you are and we’ll help you map out the right path.