Microsoft Certified: Security Operations Analyst Associate
Security Operations Analyst is Microsoft's exam for the person watching the alerts: triage, investigation, hunting and response across Defender and Sentinel.
One hundred minutes. Nothing gates it, and the certificate lasts a year.
Exam facts
- Exam code
- SC-200
- Level
- Associate
- Field
- Cybersecurity
- Duration
- 100 minutes
- Questions
- about 40 to 60, including case studies and drag-and-drop items; labs possible
- Passing score
- 700 of 1,000 (scaled)
- Languages
- English, German, French, Spanish, Italian, Portuguese, Japanese, Korean, ChineseThe badges group regional variants: Chinese (Simplified and Traditional) count as one language here, so the vendor lists ten exam editions where this page shows nine.
- Price
- 165 USD (read 8 September 2026)
- Validity
- 1 year, renewable
- Exam delivery
- Pearson VUE (test centre or online proctored); students through Certiport
Prerequisites: No required certification. Microsoft expects familiarity with Microsoft 365 and Azure services, Windows, Linux and mobile operating systems, and the Microsoft security, compliance and identity products.
Renewal: Free yearly renewal through an online assessment on Microsoft Learn, available from six months before expiry
Source: exam page at Microsoft · Price: Priced by the country where the exam is proctored: 165 USD in the United States, 126 EUR in Germany and Austria (Microsoft Learn country selector, read 2026-09-08)
How to prepare
1. The vendor's free learning path
Microsoft publishes the exam objectives and a learning path free of charge — the authoritative source for scope and weighting. Open the learning path (opens in a new tab)
2. A practice test in the exam format
MeasureUp sells a practice test for SC-200 with questions in the exam format, an explanation for every answer and a timed mode; the price shows in your currency on the shop page. Affiliate link.
Practice test for SC-200 at MeasureUp (opens in a new tab)Book the exam
Delivered by Pearson VUE (test centre or online proctored); students through Certiport. Schedule with Microsoft (opens in a new tab)
Affiliate disclosure: the practice-test link above is affiliate links — buying through them may earn us a commission at no extra cost to you. The vendor's learning path and booking links carry no commission.
Threat mitigation carries the heaviest weighting, with detection engineering and the rest of the platform sharing the remainder. That balance is honest about the job: analysts spend far more time deciding whether an alert matters than they do building new ones. Questions describe an incident already in progress, give you the signal available, and ask what to do next, which is a much better simulation of the work than most vendor papers manage.
The query language is worth learning properly
Hunting questions assume familiarity with Microsoft's query language rather than the ability to write it from memory. Candidates who can read a query, say what it would return and spot why it misses something consistently outperform those who memorised operators. Half an hour a day in a trial workspace against sample data is the most efficient preparation available for this paper.
The exam does assume a working environment. Automation rules, playbooks, incident grouping and the difference between suppressing noise and hiding a problem all appear, and none of them reads convincingly to somebody who has only watched a demonstration. That is also why it is a poor first security certificate: it is aimed at the analyst seat rather than at the route into it.
The paper in numbers
| What | SC-200 |
|---|---|
| Time | 100 minutes |
| Questions | About 40 to 60, with case studies and drag-and-drop items; labs possible |
| Pass mark | 700 of 1,000 |
| Languages | Nine, including German |
| Validity | Twelve months |
| Renewal | Free online assessment, open from six months before expiry |
| Delivery | Pearson VUE |
How the marks are weighted
- 40 to 45 percent on mitigating and responding to threats: the incident is live and the question is what you do next.
- 35 to 40 percent on configuring protections and detections, which is where the query language and the detection rules live.
- 20 to 25 percent on managing the operations environment itself: the workspace, the connectors, the automation, and who may touch them.
- Case studies describe an organisation across several questions, so misreading the setup costs marks more than once.
Twelve months of validity looks harsh next to the three years the vendor-neutral analyst certificate offers, and it is offset by the renewal: a free online assessment on Microsoft Learn, available from six months before expiry, taken at your desk. Miss the window and the certificate lapses and the exam has to be sat again at full price, so the practical discipline is a calendar entry rather than a study plan. Nothing gates entry; Microsoft expects familiarity with Microsoft 365 and Azure, with Windows, Linux and mobile operating systems, and with its security, compliance and identity products, which is a description of somebody already in the seat.
No prep course in our catalogue matched this exam
Our last sweep of the English course pool turned up nothing current for Sentinel or Defender at this level, so the preparation path on this page runs through Microsoft's free learning path and a practice test in the exam's format. We would rather say that than link a course that teaches something adjacent.
What a question looks like
Written by us in the exam's style. It is not a real question from any question bank, and we do not publish those.
An alert fires repeatedly for a service account performing bulk file access at night. The behaviour is expected and documented. The team wants to stop the noise without losing visibility if the same account is used differently later. What should be configured?
Disabling the rule and excluding the account both silence the alert, and both discard exactly the visibility the second requirement asks to keep. The answer turns on knowing which mechanism narrows an alert by condition rather than by identity. It is a question about operating a detection estate, not about security theory.
What it costs to get and to keep
| Item | Amount | Note |
|---|---|---|
| Exam fee | 165 USD | United States price; Microsoft charges by the country of proctoring (read 12 September 2026) |
| Exam fee, Germany and Austria | 126 EUR | read from the Microsoft Learn country selector (read 8 September 2026) |
| Annual renewal | not published | free, unproctored, on Microsoft Learn, and available only in the six months before expiry (read 12 September 2026) |
| Renewal after lapsing | 165 USD | the full proctored exam again once the window closes (read 12 September 2026) |
How much preparation, from where you are
- You triage alerts in a Microsoft-based team
- This is your job written down. The gaps tend to be the products your licence does not cover, and detection engineering if somebody else owns the rules.
- You work in security operations on other tooling
- The discipline transfers completely and the product surface does not. A trial tenant with sample data is worth more than any course, because the exam asks where things live as much as what to do.
- You are trying to enter security
- Not yet. This paper assumes an analyst seat you do not have, and the questions are written for people who have already closed a false positive badly.
What passing this does not prove
- Whether you can conduct an investigation end to end under real pressure.
- Anything about the business decisions that follow a confirmed incident.
- Security outside Microsoft's estate, which is most of a real attack surface.
- Whether the detections you tuned still catch what they were built for.
Against the alternatives
- CS0-004 — CompTIA CySA+
- Vendor-neutral and broader, covering the analyst discipline without assuming a toolchain. Take that one to prove the skill, this one to prove the platform.
- SC-900 — Microsoft Certified: Security, Compliance, and Identity Fundamentals
- The vocabulary tier below, and not required. Skip it if you already work in security; it introduces products rather than teaching you to use them.
- SC-300 — Microsoft Certified: Identity and Access Administrator Associate
- Identity rather than operations, and the natural pair for anyone whose incidents keep turning out to be account compromise, which is most of them.
SC-200 — quick answers
Can I pass without access to the products?
It is possible and it is a bad plan. Too many questions describe a console, a blade or an incident view, and reading about those leaves you translating rather than recognising. Microsoft offers trial tenants precisely so candidates can practise, and a few evenings in one changes the difficulty of this exam considerably.
How much query language do I need?
Enough to read fluently and reason about results. You are not asked to compose complex queries from scratch, but you are asked what a given one returns and why it might miss something, which is a comprehension skill rather than a memory one.
Is it a good first security certificate?
No. It assumes the seat rather than preparing you for it. A vendor-neutral entry certificate gives a hiring filter something to match on and teaches the underlying discipline; come back to this once you are inside a Microsoft-based team.
What happens if I miss the renewal window?
The certificate expires and the free assessment is no longer available for it. Getting it back means sitting the full exam again at the full fee. The window opens half a year ahead of expiry, which is generous, and the assessment is short and open-book, so the only real failure mode is forgetting.
Does it help outside Microsoft-based teams?
Less than the vendor-neutral analyst certificate would. The investigative habits transfer; the product knowledge does not, and the exam is mostly product knowledge applied to incidents. If your next employer runs a different stack, expect to explain what you learned rather than have the badge do it.
What comes next
- Microsoft · SC-900Microsoft Certified: Security, Compliance, and Identity Fundamentals
- Microsoft · SC-300Microsoft Certified: Identity and Access Administrator Associate
- Microsoft · MS-102Microsoft 365 Certified: Administrator Expert
- CompTIA · CS0-004CompTIA CySA+
- CompTIA · PT0-003CompTIA PenTest+
- ISC2 · CISSPCertified Information Systems Security Professional (CISSP)
- ISACA · CISMCertified Information Security Manager (CISM)
Concepts this exam draws on
Glossary entries with the reason each one matters for SC-200.
- SSL/TLS
Threat detection includes certificate and transport-security anomalies.
- SIEM
The exam is built around Microsoft's SIEM and the query language that interrogates it.
- Incident Response
Managing incidents in the platform is a named skill area.
- IDS/IPS
Detection rules, analytics and their tuning are the configure-protections skill area.
- SOC
The paper is written for the analyst seat.
- Phishing
Email and identity alerts are the most common cases the exam presents.
- Ransomware
Multi-stage incidents across endpoints and identity are examined as investigations.
Last reviewed 12 September 2026 · Getting Digital