The short version
SC-200 is Microsoft’s associate-level exam for people who work in a security operations center (SOC). It tests whether you can set up Microsoft Defender XDR and Microsoft Sentinel, respond to incidents, and hunt for threats with KQL. This guide follows the study guide that Microsoft lists as “Skills measured as of October 21, 2026”.
What the exam is
The exam is called Microsoft Security Operations Analyst. Passing it earns the Microsoft Certified: Security Operations Analyst Associate credential, which Microsoft labels as intermediate level. The role it describes is practical. A security operations analyst triages alerts, investigates incidents, hunts for threats, and builds the detections and automation that make the next incident easier to handle.
That makes SC-200 very different from a vocabulary exam. Expect questions that start with a situation and ask what you would do or which setting you would change. A device looks compromised and you need to contain it. A log source must arrive in the right table. A query returns too much noise. You are expected to know which tool, role, table or setting fits the job.
Who it is for
Microsoft describes the candidate as a security operations analyst who reduces risk by triaging, responding to incidents, hunting for threats, and engineering detections, across multi-cloud and on-premises environments. The tools named in that profile are Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections. You should also be familiar with Microsoft security, compliance, and identity solutions, Microsoft 365, Azure cloud services, AI agents and Copilots, and Windows, Linux, and mobile operating systems.
The prerequisites page explains what that means in practice and how to check your own skills.
Format at a glance
| Item | What Microsoft says |
|---|---|
| Exam code | SC-200 |
| Level | Intermediate (associate certification) |
| Time | 100 minutes to complete the exam |
| Passing score | 700 or higher on a scale of 1 to 1,000 |
| Delivery | Proctored, scheduled through Pearson VUE |
| Languages | 10, including English, Spanish, French, and Portuguese (Brazil) |
| Number of questions | Not published for this exam; Microsoft says most exams have 40 to 60 |
| Renewal | Every 12 months, through a free online assessment |
Details on scoring, question types, and retakes are on the exam format page.
The three domains and their weightings
| Domain | Weighting |
|---|---|
| Manage a security operations environment | 40-45% |
| Respond to security incidents | 35-40% |
| Perform threat hunting | 20-25% |
Manage a security operations environment
The largest domain is about building and tuning the SOC’s tooling. It covers automation in Defender XDR and Sentinel (automation rules and playbooks), Sentinel roles, data retention across Analytics, Data lake, and XDR tiers, workbooks, data connectors and data collection rules, and detections such as custom detection rules and Sentinel analytics rules.
Respond to security incidents
This domain is about working real incidents. You investigate and remediate alerts from Defender for Office 365, Defender for Cloud, Defender for Cloud Apps, Defender for Identity, Microsoft Entra ID, Purview, and Sentinel. It also covers Defender for Endpoint device timelines and live response, and investigating Microsoft 365 activity with Purview Audit, eDiscovery content search, and Microsoft Graph activity logs.
Perform threat hunting
The smallest domain is still the one that trips up many candidates. It covers choosing the right table, writing Kusto Query Language (KQL) in advanced hunting, threat analytics, hunting graphs, and, on the Sentinel side, hunting queries, KQL jobs in the data lake, summary rules, and notebooks.
Official source
For the vendor’s own page, see the Microsoft Learn SC-200 study guide. It is the final authority if anything here differs.
More guides for SC-200
- SC-200 Study Plan: 4-Week and 8-Week
- SC-200 Sample Questions With Answers
- Is the SC-200 Exam Hard?
- SC-200 Renewal and Retakes Explained
- Is SC-200 Worth It? An Honest Look
- SC-200 Cheat Sheet: Key Facts to Review
- SC-200 vs SC-401: Which First?
Next step
Read the domains explained page to see where your time should go. When you want to check yourself, our SC-200 practice tests are original practice sets built around these three domains.
Frequently asked questions
Does SC-200 expire?
Yes. Microsoft associate certifications must be renewed every 12 months. You renew by passing a free, unproctored online assessment on Microsoft Learn during the renewal window, so you do not retake the full exam.
Is the exam changing soon?
Microsoft says the English version of the exam and certification is updated on October 21, 2026. Localized versions follow about eight weeks later. Study from the version of the skills outline that matches the date and language of your exam.
Do I need KQL experience?
Yes, at least working knowledge. KQL appears in hunting, detections, and data questions. The domains explained page lists what to practice.