The short version
Plan on roughly 40 to 80 hours in total if you already touch Microsoft security tools at work, and more if you are new to them. That is an estimate, not a Microsoft figure, and your background changes it a lot. The 4-week plan below suits people who work in or near a SOC. The 8-week plan suits everyone else.
Before you start
Open the Microsoft Learn SC-200 study guide and keep it beside you. This plan follows the version titled “Skills measured as of October 21, 2026”. Set up a lab if you can: a trial or developer tenant with Defender XDR and an Azure subscription with a Microsoft Sentinel workspace. SC-200 is a hands-on exam, and ten minutes in a portal beats an hour of reading. Sentinel costs money once you ingest data, so check the pricing before you turn things on and turn them off afterwards.
Keep one running document with three columns: the feature, the task it solves, and the neighbor people confuse it with. Examples include automation rules versus playbooks, a custom detection rule versus a Sentinel analytics rule, and join versus union. Our how to study guide covers spacing and note-taking.
The 4-week plan (about 10 to 15 hours per week)
Week 1: Manage the environment, part one. Defender XDR notifications and alert tuning, Defender for Endpoint settings, attack surface reduction (ASR) rules, device groups, automated investigation and response, and automatic attack disruption. Then Sentinel roles and retention across Analytics, Data lake, and XDR tiers. Lab: create a device group and an ASR rule in audit mode.
Week 2: Manage the environment, part two. Data connectors, Windows Security Events via AMA, data collection rules, Syslog and CEF, Azure activity logs, threat indicators, custom tables. Then detections: custom detection rules, Sentinel analytics rule types, MITRE ATT&CK coverage, anomalies. Finish with automation rules and playbooks. After this week, take your first practice set and note which domain is weakest.
Week 3: Respond to incidents. Work through incidents across Defender for Office 365, Defender for Cloud, Defender for Cloud Apps, Defender for Identity, Entra ID, Purview, and Sentinel. Add Defender for Endpoint device timelines, live response, and investigation packages. Finish with Purview Audit, eDiscovery content search, and Microsoft Graph activity logs.
Week 4: Hunt, then review. Spend the first half on KQL and advanced hunting tables, threat analytics, and hunting graphs, and the second half on Sentinel hunting queries, KQL jobs, summary rules, and notebooks. Reserve the last two or three sessions for the practice sets and your weak spots.
The 8-week plan (about 5 to 8 hours per week)
| Week | Focus |
|---|---|
| 1 | Orientation: Defender portal, Sentinel workspace, the roles involved; start learning KQL basics (where, project, summarize) |
| 2 | Defender XDR and Defender for Endpoint configuration: notifications, alert tuning, ASR rules, device groups, automation levels |
| 3 | Sentinel platform and data: roles, retention tiers, connectors, data collection rules, custom tables |
| 4 | Detections and automation: custom detections, analytics rules, ATT&CK coverage, automation rules, playbooks |
| 5 | Incident response across Defender products, Entra ID, Purview, and Sentinel; attack disruption and Security Copilot |
| 6 | Defender for Endpoint response actions and Microsoft 365 investigation: Audit, eDiscovery, Graph activity logs |
| 7 | Threat hunting: advanced hunting, table choice, threat analytics, hunting graphs, Sentinel hunting, KQL jobs, notebooks |
| 8 | Full review and timed practice sets |
How to use practice exams
Take one early, as a baseline, and expect a low score. The point is to find the weak domains. Then study, and use later sets to measure progress rather than to memorize answers. For every question, read the explanation of the wrong options too, because SC-200 questions often hinge on a neighboring feature.
Our five SC-200 sets of 100 questions are meant to be used in order: concepts first, then scenarios, trade-offs, details, and a full-length run at the end. Keep a tally of your score per domain. Aim to score consistently above your own target, with a margin, on the last two sets before you book. Practice scores tell you about readiness, but they cannot predict your result.
The last 3 days
- Three days out: retake your weakest domain’s questions and fix gaps with Microsoft Learn pages, not new topics.
- Two days out: do one timed set in a single sitting. Practice reading long scenarios quickly.
- The day before: light review of your confusion table, a look at the exam day guide, and an early night. Try the Microsoft exam sandbox if you have not seen the interface.
Watch the date
The English exam changes on October 21, 2026. If you study from older videos or notes, compare them with the current study guide, because product names and features move quickly in this area.
More guides for SC-200
- SC-200 Exam Format, Scoring and Retakes
- SC-200 Sample Questions With Answers
- Is the SC-200 Exam Hard?
- SC-200 Prerequisites and Skills Check
- SC-200 Renewal and Retakes Explained
- Is SC-200 Worth It? An Honest Look
- SC-200 Cheat Sheet: Key Facts to Review
- SC-200 vs SC-401: Which First?
Next step
See what each domain demands in domains explained. To build your baseline, try the SC-200 practice tests.
Frequently asked questions
How many hours do I need?
It varies. A rough range is 40 to 80 hours for people who already use Defender or Sentinel, and well beyond that for beginners.
Do I need a lab?
Strongly recommended. The exam asks which setting, role, table, or action fits a situation, and that knowledge sticks when you have clicked through it.
Should I learn KQL first?
Start early and practice a little every week, because it appears in hunting, detections, and data ingestion.