SC-100
Exam SC-100: Microsoft Cybersecurity Architect
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
SC-100, Microsoft Cybersecurity Architect, is the single exam required for the Microsoft Certified: Cybersecurity Architect Expert credential - but it is not the only requirement. Candidates must first hold at least one associate-level certification from the security, compliance, and identity portfolio: Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate. The exam targets experienced practitioners who already implement or administer identity and access, platform protection, security operations, data and AI security, application security, and hybrid or multicloud infrastructure, with expert depth in at least one of those areas. It measures four skill areas: aligning solutions with security best practices and priorities (20–25%), designing security operations, identity, and compliance capabilities (25–30%), designing infrastructure security (25–30%), and designing application and data security (20–25%). Expect scenario-based design items rather than recall drills: you will be asked to choose an architecture and justify trade-offs across Zero Trust, governance/risk/compliance, and security posture management. Preparation paths include the official study guide, self-paced and instructor-led Microsoft Learn training, the practice assessment on AI Skills Navigator, and the exam sandbox demo to familiarize yourself with the interface. The English version was updated October 21, 2026; localized versions follow roughly eight weeks later.
What you'll study
About SC-100 preparation
What score do I need to pass SC-100?
Microsoft states a passing score of 700. Scores are scaled, so the exam does not report a simple percentage of correct answers, and hard questions may be weighted differently from easy ones. Aim well above the threshold on practice material rather than treating 700 as a comfortable target.
Do I need other certifications before I can earn the Cybersecurity Architect Expert credential?
Yes. To become a Microsoft Certified: Cybersecurity Architect Expert, you must earn at least one of the following first: Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate. The certification page lists prerequisites as 3 certifications, with SC-100 as the required exam.
How difficult is SC-100 and who is it really for?
It is an expert-level architect exam. Microsoft recommends prior experience implementing or administering identity and access, platform protection, security operations, data and AI security, application security, and hybrid/multicloud infrastructure, plus expert depth in at least one area. Microsoft's course guidance strongly encourages passing an associate certification such as AZ-500, SC-200, or SC-300 first.
What is the exam format, and how many questions are there?
The published exam page does not list item counts, question types, or a seat-time figure, so treat any specific number you see elsewhere with suspicion. Microsoft offers an exam sandbox demo so you can experience the interface and question interaction styles before test day. Check the current exam page for any updated format details.
How should I sequence my study for SC-100?
Start with the study guide to map the four measured skill areas, then work the domain where you are weakest rather than the one you enjoy most. Build scenarios you can defend end to end - Zero Trust, governance/risk/compliance, SecOps, and data and application protection - then take the practice assessment on AI Skills Navigator and review every miss.
Where can I find retake and scheduling policies?
Microsoft points candidates to its exam policies and FAQs page, linked from the SC-100 exam resources section, for policy questions. Pricing is based on the country or region in which the exam is proctored, so confirm the exact amount with the exam provider before registering rather than relying on a figure you saw in a forum.
Should I register with a personal or a work account?
Microsoft strongly recommends registering for an exam with a personal MSA account. If you register with an organizational work or school account, your exam records will be lost if you leave that organization, and Microsoft states they will be unrecoverable.
What languages is SC-100 offered in?
The exam is available in English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese (Brazil), Chinese (Traditional), and Italian. The English version was updated October 21, 2026, and localized versions are updated approximately eight weeks after that date - though Microsoft notes that schedule may occasionally slip.
Does the certification expire, and how do I renew it?
Microsoft role-based and specialty certifications expire unless renewed. You renew at no cost by passing an online assessment on Microsoft Learn. SC-100 itself has no retirement date listed, so the exam is not scheduled to be withdrawn.
Why is my practice score high but my real exam failing?
A common failure mode is memorizing product facts instead of designing solutions. Architect items ask you to weigh trade-offs between competing requirements, so drill on justifying a design and identifying what a given control does not cover. Also verify you are studying the post-October 21, 2026 skill outline, since older material may describe retired objectives.