SC-200 study guide: How to Pass the Microsoft Security Operations Analyst Exam

In Security · · Updated

SC-200 Security Operations Analyst Microsoft Sentinel Defender XDR Certifications KQL

This SC-200 study guide covers the Microsoft Certified: Security Operations Analyst Associate exam as of the skills measured on 28 July 2026.

The exam tests whether you can manage a security operations environment, respond to incidents and hunt for threats with Kusto Query Language (KQL) in Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview and Microsoft Defender for Cloud. Book the paper and see official resources on the SC-200 certification page.

SC-200 (Associate) Badge

Key takeaways

What is the SC-200 certification?

The SC-200 exam earns you the Microsoft Certified: Security Operations Analyst Associate certification. Microsoft says candidates monitor, identify, investigate and respond to threats in multi-cloud and on-premises environments, hunt with KQL and automate responses.

The English skills measured took effect on 28 July 2026. The earlier four-area outline (including a separate “configure protections and detections” group) no longer describes the live exam. Review the current list on the official SC-200 study guide before you book.

Who needs the SC-200?

Security operations analysts who work in a SOC, triage alerts, investigate incidents and respond to threats in Microsoft environments. Microsoft’s audience profile also expects you to collaborate with business and security leadership on security standards and awareness.

As a candidate you should already be familiar with:

There is no required prior certification. Microsoft recommends that you train and get hands-on experience before you take the exam.

SC-200 is one of the associate certifications Microsoft has listed as a prerequisite path for SC-100 Cybersecurity Architect Expert, alongside SC-300 and the Azure security engineer credential. SC-200 itself is not a formal prerequisite for SC-300.

Self-directed learning or instructor-led training?

Microsoft’s study guide tells you to train and get hands-on experience, and it points to self-paced learning paths and the instructor-led course. The free SC-200T00 course on Microsoft Learn is listed as four days and maps to the Security Operations Analyst role.

Self-study is viable if you already work in the Defender XDR and Sentinel portals. If your experience is concentrated in one product, the instructor-led labs cover the same stack the skills measured names: Defender for Endpoint, Defender XDR, Sentinel and Security Copilot.

Is e-learning from third parties worth it?

Third-party video courses are optional supplements. Microsoft also publishes the free Practice Assessment on Learn, created by the same team that develops the exam, and it lists MeasureUp practice tests on the exam resources.

The Kusto Detective Agency is a Microsoft gamified KQL workshop you can use to practise query patterns before you sit the paper.

What skills does the SC-200 test, and what is the weighting?

The exam is scenario-based and aligned to the official skills measured. Most questions cover generally available features; Microsoft says preview features may appear if they are commonly used.

As of 28 July 2026 the domains and approximate weights are:

Domain Weight
Manage a security operations environment 40–45%
Respond to security incidents 35–40%
Perform threat hunting 20–25%

Manage a security operations environment is now the heaviest area. It covers automation in Defender XDR and Sentinel (notifications, tuning, suppression, correlation, automated investigation and response, automatic attack disruption), Defender for Endpoint advanced features, ASR rules, device groups and automation levels, Sentinel roles, workbooks, SOC optimization recommendations, and data retention across the Analytics, Data lake and XDR tiers. Ingestion includes Windows Security Events via AMA, Windows Event Forwarding, Syslog and CEF via AMA, Azure activity, threat indicators and custom log tables. Detections include custom Advanced Hunting rules, Sentinel analytics rules (scheduled, near-real time, threat intelligence and machine learning), anomalies and MITRE ATT&CK coverage.

Respond to security incidents covers investigation and remediation across Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, Entra ID compromised identities, Defender for Identity and Sentinel. It also names agentic AI (including embedded Security Copilot), multi-stage and lateral-movement attacks, case management, Defender for Endpoint device timelines, live response and investigation packages, and Microsoft 365 activity via Purview Audit, Content search in eDiscovery and Microsoft Graph activity logs.

Perform threat hunting is the smallest domain by weight. In Defender XDR you identify the correct table, use KQL, create Advanced Hunting queries, interpret threat analytics, create hunting graphs (including blast radius) and analyse entity relationships with Sentinel Graph. In Sentinel you create and monitor hunting queries, manage KQL jobs in the Data lake, manage Summary rule tables and hunt with Notebooks, including a connection to the Sentinel MCP Server.

How hard is the SC-200?

The SC-200 is scenario-driven. You are given a configuration state, a requirement or an active incident and asked for the correct action or the root cause. It is not a definitions paper.

KQL runs through Advanced Hunting and Sentinel hunting. You do not need to author long queries from memory, but you do need to identify tables, read a query and recognise what operators such as where, summarize, join and has_any do. Hunting graphs and Sentinel Graph are now on the outline as well.

What types of questions will you get?

Microsoft certification exams use case studies, drag-and-drop, hotspot and dropdown items, and problem-solution series. On a series item you cannot go back once you have answered. The official SC-200 page states that you have 100 minutes and that you may have interactive components.

You can try the question types in Microsoft’s exam sandbox before you book.

The pass mark is 700 out of 1000.

Does the exam come with instructor-led training?

No. You book the exam separately through Pearson VUE at pearsonvue.com/microsoft. Training and the exam are separate across Microsoft certifications.

The 7 things you need to know to pass the SC-200

1. Microsoft Sentinel and Microsoft Defender

Microsoft Defender XDR correlates signals from Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps into unified incidents. That is where you investigate threats to endpoints, identities, email and cloud applications.

Microsoft Sentinel is the cloud-native SIEM and SOAR. It ingests data from a wider range of sources, including Defender XDR alerts, and it is where you build custom analytics rules, run hunting queries, manage longer-term retention and automate response with playbooks.

A requirement to hunt a suspicious process across endpoints against historical log data points at Sentinel or Advanced Hunting KQL. A requirement to investigate a live correlated alert that already joins an endpoint and an email attachment points at Defender XDR.

2. Automation rules and playbooks in Sentinel

Automation rules and playbooks both automate responses in Sentinel, and the skills measured lists both. An automation rule can assign incidents, change status, add tags or close them without a playbook. A playbook is a Logic App for actions such as a Teams notification, an external API call or isolating a device through the Defender for Endpoint connector. A playbook is called by an automation rule or from an analytics rule.

If the requirement is only to close or tag an incident from a specific rule, an automation rule is enough. If the requirement is to isolate a device and notify the SOC, that is a playbook called from an automation rule.

3. KQL is not optional

The skills measured ask you to identify the appropriate table, identify threats with KQL and create Advanced Hunting queries. Typical operators are where, summarize, project, extend, join, union, let, order by and top. Tables that appear in Microsoft’s Advanced Hunting documentation include DeviceProcessEvents, DeviceNetworkEvents, SigninLogs and SecurityEvent.

Microsoft’s first Advanced Hunting tutorial query looks for PowerShell download activity. Run the same pattern in the portal from the Advanced Hunting query language page:

union DeviceProcessEvents, DeviceNetworkEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any("WebClient",
    "DownloadFile",
    "DownloadData",
    "DownloadString",
    "WebRequest",
    "Shellcode",
    "http",
    "https")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, RemoteIPType
| top 100 by Timestamp

Pay attention to table choice, the time filter and the difference between has, contains and has_any. The current outline also expects hunting graphs (including blast radius) and Sentinel Graph relationship analysis.

4. Sentinel roles, retention tiers and SOC optimization

The heaviest domain now includes the Sentinel platform itself, not only incident work. The skills measured name Sentinel roles, workbooks, SOC optimization recommendations and data retention for XDR and Sentinel tables across the Analytics, Data lake and XDR tiers.

On-premises collection is in the same domain: Windows Security Events via AMA (with data collection rules), Windows Event Forwarding, and Syslog or CEF via AMA.

The official SC-200 learning path still includes a module on data normalisation with ASIM parsers. ASIM is not named on the 28 July 2026 skills list; Microsoft notes that related topics may still appear.

5. Data ingestion and detections

Selecting connectors, ingesting threat indicators and creating custom log tables sit under manage a security operations environment. So do custom detection rules in Defender XDR Advanced Hunting and Sentinel analytics rules: scheduled, near-real time (NRT), threat intelligence and machine learning, plus anomalies and mapping coverage to the MITRE ATT&CK matrix.

Weight study time toward this domain. It is 40–45% of the exam and is easy to under-prepare if you only practise incident investigation.

6. Defender for Endpoint automation levels directly control what automated investigation can do

The skills measured include device groups, permissions and automation levels in Defender for Endpoint. The product has five levels, from No automated response through three Semi approval modes to Full (remediate threats automatically).

At Full, automated investigation remediates without waiting for approval. With no automated response, automated investigation does not run on that device group. The Semi levels change which remediations need approval (any remediation, core OS folders, or non-temporary folders).

If the requirement is to review every proposed remediation on a group of production servers, that is a Semi level that requires approval, not Full and not No automated response.

7. Security Copilot, agentic investigation and Purview

Investigate incidents by using agentic AI, including embedded Microsoft Security Copilot, is on the current skills measured. Treat it as in-scope, not an optional extra.

The same incident domain names Microsoft Purview for compromised entities, Purview Audit, Content search in eDiscovery and Microsoft Graph activity logs. A question can move from a Defender XDR incident to an Entra identity to a Purview activity search in one scenario.

What to do after you pass

Your certification badge appears in your Microsoft Learn profile and can be shared from there. Microsoft associate certifications expire after one year. You renew with a free online assessment on Microsoft Learn during the six-month window before expiry. Microsoft describes the assessment as shorter than the original exam, unproctored and open-book, and focused on recent product updates.

SC-200 remains one of the associate paths Microsoft has listed toward SC-100. More security articles sit on the Security hub.

Frequently asked questions

Is there an official prerequisite for SC-200?

No. You can schedule SC-200 at any time. Microsoft recommends familiarity with Azure, Microsoft 365 and the core Microsoft security services, but no prior certification is required.

Does SC-200 cover only cloud, or also on-premises environments?

The audience profile is multi-cloud and on-premises. The skills measured include onboarding and collecting Windows Security events, Syslog and CEF into Sentinel, and investigating devices in Defender for Endpoint.

Is there a free practice assessment?

Yes. Microsoft provides a free Practice Assessment for SC-200 on Microsoft Learn. It is written by the same team that develops the exam. Microsoft says the questions are examples of style and difficulty, not the live exam.