The short version
Take SC-200 if you work in a SOC and spend your days with alerts, incidents, and KQL in Defender XDR and Microsoft Sentinel. Take SC-401 if you manage how data is classified, labeled, protected, and retained in Microsoft 365 with Microsoft Purview. If your job covers both, start with the one that matches your daily work, then add the other. Both are intermediate associate exams, both take 100 minutes, and neither lists a required earlier exam. This comparison uses Microsoft Learn pages checked on October 22, 2026.
Side-by-side table
| Item | SC-200 | SC-401 |
|---|---|---|
| Full name | Microsoft Security Operations Analyst | Administering Information Security in Microsoft 365 |
| Credential | Security Operations Analyst Associate | Information Security Administrator Associate |
| Level | Intermediate | Intermediate |
| Role | Security operations analyst | Administrator |
| Main tools | Defender XDR, Microsoft Sentinel, Entra ID, Purview, Defender for Cloud | Microsoft Purview, Microsoft 365, Defender for Cloud Apps |
| Time | 100 minutes | 100 minutes |
| Passing score | 700 on a scale of 1 to 1,000 | 700 on a scale of 1 to 1,000 |
| Number of questions | Not published | Not published |
| Domains | 40-45%, 35-40%, 20-25% | 30-35% each |
| Languages | 10 | 7 |
| Skills outline version | As of October 21, 2026 | As of October 28, 2026 |
| Renewal | Every 12 months, free | Same Microsoft rule for associate credentials |
What each exam covers
SC-200 has three domains: manage a security operations environment (40-45%), respond to security incidents (35-40%), and perform threat hunting (20-25%). It is about detecting and responding. You configure automation and data ingestion, work incidents across the Defender products, and write KQL.
SC-401 has three equal domains of 30-35% each: implement information protection, implement data loss prevention and retention, and manage risks, alerts, and activities. It is about preventing data from leaking and being able to prove what happened. You work with sensitive info types, sensitivity labels, DLP policies, retention, Insider Risk Management, audit, eDiscovery, and the controls for data used by AI services.
Where they overlap
- Both use Microsoft Purview, but for different jobs. SC-200 uses Purview Audit and eDiscovery content search to investigate threats. SC-401 builds and tunes the audit, DLP, retention, and insider risk controls themselves.
- Both touch alerts in the Microsoft Defender portal. SC-200 spends most of its time there. SC-401 includes responding to Purview alerts in Defender XDR.
- Both expect Microsoft 365 and Entra ID knowledge, and both ask scenario questions.
Where they differ
- KQL: SC-200 expects real fluency. SC-401 does not list KQL as a skill area.
- Policy design: SC-401 asks you to design and configure policies and understand rule precedence. SC-200 asks you to investigate and respond.
- Work style: SC-200 suits someone who triages and hunts. SC-401 suits someone who sets rules with governance and compliance teams.
- Data protection depth: sensitivity labels, exact data match, and retention belong to SC-401, not SC-200.
How to choose
- Look at your last month of work. If you opened an incident queue, start with SC-200. If you edited labels, DLP rules, or retention policies, start with SC-401.
- Look at your next job. SOC analyst, detection engineer, or threat hunter points to SC-200. Information protection admin, compliance engineer, or data security role points to SC-401.
- Check your skills. Weak at KQL and never used Sentinel means SC-200 will take longer. Never configured Purview means SC-401 will.
- Take both if you work in a small security team where one person covers incidents and data protection. Order matters little, since neither requires the other.
If you are brand new to Microsoft security, neither exam is a gentle start. The fundamentals exam SC-900 covers the concepts, though Microsoft does not require it for either.
Time and renewal
Plan the same rhythm for both. Each credential expires after 12 months unless renewed through a free online assessment during a six-month window. Holding both means two renewals a year. See SC-200 renewal and retakes for the rules, which apply the same way to associate credentials.
Also note timing. The English SC-200 update took effect on October 21, 2026. The SC-401 update takes effect on October 28, 2026. If you are studying for SC-401 this week, make sure your material matches the outline for your exam date.
More guides for SC-200
- SC-200 Exam Format, Scoring and Retakes
- SC-200 Study Plan: 4-Week and 8-Week
- SC-200 Domains Explained
- SC-200 Sample Questions With Answers
- SC-200 Prerequisites and Skills Check
- Is SC-200 Worth It? An Honest Look
- SC-200 Cheat Sheet: Key Facts to Review
Next step
Read the SC-200 overview and the SC-401 overview to compare the domains in more detail. Then check yourself with the practice sets for SC-200 or SC-401. They are original practice exams and do not replace Microsoft’s learning material.
Frequently asked questions
Which is harder?
It depends on your background. SC-200 is heavier on KQL and incident work, SC-401 on policy detail. See is SC-200 hard?.
Do I need SC-200 before SC-401?
No. Microsoft lists no required earlier exam for either.
Can I study for both at once?
You can, but the topics are different enough that most people do better one after the other.
Which is the better choice for a SOC job?
SC-200 matches the work. SC-401 is the better match for data protection roles.