Microsoft Applied Skills: Defend against cyberthreats with Microsoft Defender XDR
This is the free credential that looks most like a real day in a security operations centre. You get a live Microsoft Defender environment, a set of requests in an inbox, and two hours to configure it, work incidents, investigate a device and hunt for a threat with KQL.
Intermediate level, no fee shown, retake after three days, and no expiry.
Certificate facts
- Level
- Associate
- Field
- Cybersecurity
- Access
- Free
- Assessment
- Lab-based assessment
- Duration
- 120 minutes
- Questions
- performance-based lab tasks in a live Defender environment, typically 12 to 16 per Applied Skills lab
- Languages
- English
- Price
- Free (read 26 September 2026)
- Validity
- never expires
- Exam delivery
- Pearson VUE (test centre or online proctored); students through Certiport
Prerequisites: None formally. Microsoft expects experience investigating attacks on endpoints, with Defender for Endpoint and with Kusto Query Language.
Renewal: None. Microsoft Applied Skills credentials do not expire; a retired credential stays in the Active section of the transcript for two years
Source: certificate page at Microsoft · Price: No fee is shown on the credential page, which launches the lab directly after the candidate agreements are accepted; Microsoft publishes no price for Applied Skills assessments (read 2026-09-26)
How to prepare
1. The vendor's free learning path
Microsoft publishes the exam objectives and a learning path free of charge — the authoritative source for scope and weighting. Open the learning path (opens in a new tab)
2. The programme
The certificate is earned inside this programme. Its facts, price and the provider's own page are on the course page; the link there carries no commission.
Affiliate disclosure: the course link above is an affiliate link — buying through them may earn us a commission at no extra cost to you. The vendor's learning path and booking links carry no commission.
Five things an analyst does before lunch
Microsoft lists five skills for this lab, and together they describe the rhythm of a security operations centre shift. First the environment is set up so that the right alerts reach the right people. Then devices are managed through the endpoint product. Incidents are triaged and worked, an individual machine is investigated for evidence, and finally you write queries in Kusto Query Language to look for activity that no alert caught. A multiple-choice exam can ask about each of those; only a lab can ask you to do them in order, with the results of one step feeding the next.
| Skill evaluated (Microsoft) | Our plain-language reading |
|---|---|
| Configure a Defender XDR environment | Settings and alert handling set up to requirements |
| Manage devices with Defender for Endpoint | Onboarding, grouping and device-level actions |
| Manage incidents | Triage, assignment and resolution in the portal |
| Investigate an endpoint | Gathering evidence from a single machine |
| Advanced Hunting with KQL | Writing queries to find what alerts missed |
Not a beginner's credential
Microsoft rates the lab intermediate and says so plainly: candidates should already know how to gather evidence about endpoint attacks and should have used both the endpoint product and KQL. The free learning path runs close to five hours across six modules, the last of them lab exercises, and it is the minimum preparation rather than a shortcut. Someone who has only studied security in theory will find the hunting task hard, because a query that returns nothing gives no clue whether the threat is absent or the query is wrong.
Time on the clock
The credential page allows two hours. Microsoft's help pages on assessment timing give intermediate labs forty-five minutes, with some extra time on request. Treat the timer in the lab as authoritative and prepare as if you had the shorter window.
- A strong addition for anyone already working with Microsoft's security stack who wants proof that is harder to fake than a quiz.
- A practical rehearsal for the Security Operations Analyst certification, whose exam covers this product and more.
- Not a starting point if you are new to security; begin with a fundamentals exam or a free introductory course.
- Retake freely: there is no fee shown, and after a failed attempt you can try again after 72 hours.
The mechanics are the same as for every Applied Skills lab. The tasks arrive as emails inside a virtual machine, you can complete them with any tool unless an email says otherwise, with no route to save and return. Nobody watches you through a camera, but your actions in the lab are recorded, and scoring starts the moment you leave. Scoring is quick, and the report shows an overall verdict plus how you fared on each skill, never a single number. For this lab in particular, practise the hunting queries in a real or trial tenant beforehand; typing KQL from memory under a timer is where prepared candidates still lose time. Keep a short list of the tables and operators you rely on, and rehearse it until you no longer need it.
What a question looks like
Written by us in the exam's style. It is not a real question from any question bank, and we do not publish those.
The lab inbox reports that a user's laptop contacted an unfamiliar domain overnight. No alert was raised. You are asked to find every device in the tenant that contacted the same domain in the past week and to isolate any that also ran an unsigned executable. How do you approach it?
There is no incident to open, so the portal's guided views do not help. You have to write a hunting query that joins network and process events, check the result makes sense, and then act on the right devices only. A mistake in the query quietly misses a machine, which is the kind of failure a lab scores and a quiz never sees.
What it costs to get and to keep
| Item | Amount | Note |
|---|---|---|
| Assessment lab | 0 USD | no fee shown on the credential page; Microsoft publishes no price for Applied Skills assessments (read 26 September 2026) |
| Preparation | 0 USD | free Microsoft Learn path of just under five hours with lab exercises (read 26 September 2026) |
| Renewal | not published | none; Applied Skills credentials do not expire unless retired (read 26 September 2026) |
How much preparation, from where you are
- You work in a Microsoft security operations team
- The intended reader. Review the hunting material and time yourself on the lab exercises; most of the rest will be routine.
- You hold Security Fundamentals but have not used Defender
- Expect a real gap. Work through every module of the learning path, including the lab exercises, and practise KQL until simple joins feel natural.
- You work in security on other platforms
- The concepts will transfer; the portal and the query language will not. Allow time to learn both.
What passing this does not prove
- Microsoft's SIEM product and the wider analyst role, which the SC-200 exam covers.
- Security on non-Microsoft platforms.
- Communication with stakeholders during an incident.
- Your identity: there is no webcam proctoring, though lab actions are recorded.
Against the alternatives
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- The role-based analyst certification, paid, proctored and renewed each year, covering this product and the rest of Microsoft's security operations tooling. The lab is a free, focused proof of one part of that role and a sensible rehearsal before the exam.
- CompTIA Security+ (SY0-701)
- A vendor-neutral foundation that employers across platforms recognise. It teaches the concepts this lab assumes; the lab shows you can apply them in one vendor's tools.
Microsoft Applied Skills: Defend against cyberthreats with Microsoft Defender XDR — quick answers
Is the Defender XDR Applied Skills credential free?
Microsoft lists no charge for this lab anywhere we could find: its page lets you tick the agreements and start straight away. Preparation on Microsoft Learn costs nothing either.
Do I need to know KQL?
Yes. Advanced Hunting with KQL is one of the five evaluated skills, and Microsoft lists KQL experience as an expectation for candidates.
Does this count towards SC-200?
Not formally. Applied Skills and certifications are separate credentials. The lab is good practice for the part of SC-200 that covers Defender, but the exam must still be passed on its own.
What happens if I fail?
A new attempt opens three days (72 hours) after the last one. Unsuccessful tries are listed on your profile, while the transcript shows passes only.
Does it expire?
It is permanent unless Microsoft withdraws it. A withdrawn credential remains listed as active for a further two years before moving off that list.
Where this certificate sits in the field
What comes next
Concepts this certificate draws on
Glossary entries with the reason each one matters for Microsoft Applied Skills: Defend against cyberthreats with Microsoft Defender XDR.
- SOC
The five evaluated skills mirror a SOC analyst's workflow.
- Incident Management
Managing incidents in Defender XDR is evaluated.
- IDS/IPS
Hunting for undetected threats with KQL is evaluated.
Last reviewed 26 September 2026 · Getting Digital