SC-200 (Microsoft Certified: Security Operations Analyst Associate)
SC-200 is the exam for the Microsoft security operations analyst role: triaging alerts, responding to incidents, hunting for threats, and engineering detections. It uses Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud, and threat hunting is done in KQL.
Exam Details
Proctored exam booked through Pearson VUE and scored on a scale of 1 to 1,000. Some questions may be interactive.
Price for exams proctored in the United States. Microsoft sets exam prices by the country or region of proctoring, and the listed price excludes taxes and promotional offers.
Requirements and Renewal
Prerequisites
None required. Microsoft recommends familiarity with Microsoft security, compliance, and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux, and mobile operating systems.
Renewal
Renew every 12 months by passing a free, unproctored online assessment on Microsoft Learn during the six-month window before expiry.
Current Version
SC-200.
Exam Domains
3 domains| Domain |
|---|
| Manage a security operations environment (40-45%) |
| Respond to security incidents (35-40%) |
| Perform threat hunting (20-25%) |
Certification Lists
Tools Covered by SC-200
Microsoft Sentinel
CommercialCloud-native SIEM and SOAR running on Azure with per-GB analytics pricing.
Microsoft Purview
CommercialUnified data governance, information protection, and DLP across Microsoft 365, Azure, and multicloud estates.
Microsoft Entra ID
FreemiumMicrosoft cloud identity platform, formerly Azure AD, covering workforce, workload, and customer identities.
Related Tool Categories
Frequently Asked Questions
What is the SC-200 certificate?→
Passing Exam SC-200 earns the Microsoft Certified: Security Operations Analyst Associate certification.
Is SC-200 entry level?→
Microsoft rates the certification at the intermediate level. It has no required prerequisite, but the audience profile assumes familiarity with Microsoft 365, Azure, and Microsoft security tooling.
Which is better, AZ-500 or SC-200?→
AZ-500 is no longer an option: Microsoft retired the Azure Security Engineer Associate certification, its exam, and its renewal assessments on August 31, 2026. Microsoft names SC-500 as its replacement, while SC-200 focuses on security operations rather than securing Azure resources.
How long is the SC-200 exam and what is the pass mark?→
Candidates have 100 minutes. A scaled score of 700 or greater is required to pass.
How do I renew SC-200?→
Associate certifications expire after 12 months. Holders renew at no cost by passing an online assessment on Microsoft Learn before the expiry date.
Sources
- Microsoft Certified: Security Operations Analyst Associate
- Study guide for Exam SC-200: Microsoft Security Operations Analyst
- Microsoft Certification Renewal
- Microsoft Certified: Azure Security Engineer Associate (retired)
- Microsoft Skills Hub Blog: The AI job boom is here. Are you ready to showcase your skills?
Exam details are checked against official Microsoft pages. Fees, exam versions, and renewal rules change; confirm with Microsoft before registering. SC-200 is a trademark of its owner. This site is not affiliated with or endorsed by Microsoft.