SC-100 study plan
SC-100 · Give each week a clear focus.
8 weeks · About 6 hours per week
Design security operations, identity, and compliance capabilities
Map the identity pillar of Domain 2 into a one-page component diagram (Entra ID, Conditional Access, PIM, identity governance, external identities, authentication strengths)
Compare and contrast PIM vs. permanent privileged assignment by writing three design decision statements with tradeoffs
Draft Conditional Access design scenarios covering guest access, device compliance, and risk-based sign-in, and justify each policy outcome
Build a 20-term glossary of Domain 2 identity vocabulary and self-quiz until you can define every term without notes
Your checkpoint
A one-page Conditional Access + PIM design diagram with at least five annotated design decisions and their rationale.
Design security operations, identity, and compliance capabilities
Design a SIEM/SOAR architecture on paper: data connectors, ingestion tiers, analytics rules, automation playbooks, and retention strategy
Sequence a full incident response lifecycle for a ransomware scenario, naming which Defender XDR workload detects, correlates, and responds at each stage
Contrast Microsoft Defender for Cloud Apps with Defender for Endpoint and Defender for Identity in terms of coverage, data sources, and response actions
Translate three regulatory obligations (e.g., data residency, retention, audit) into concrete compliance capability designs
Your checkpoint
A written ransomware response runbook of 400-600 words mapping each phase to a named Microsoft security capability and its configuration setting.
Design security solutions for infrastructure
Diagram a layered Azure network security design (DDoS Protection, Azure Firewall, NSGs, WAF, Private Endpoints) and justify each layer's placement
Design a hub-and-spoke or Virtual WAN topology and state where inspection, egress control, and logging occur
Specify a secure baseline strategy for IaaS and PaaS workloads using Defender for Cloud recommendations, regulatory standards, and Azure Policy
Plan hybrid and multicloud server protection using Azure Arc and Defender for Servers, including onboarding and monitoring requirements
Your checkpoint
A labeled network security reference diagram plus a table listing five control points, the service that enforces each, and the log source that records it.
Design security solutions for infrastructure
Design segmentation and Zero Trust enforcement for workloads: identify trust boundaries, apply least-privilege network rules, and remove implicit trust paths
Assess container and Kubernetes security requirements and select the appropriate Defender for Containers controls for build, deploy, and runtime
Evaluate PaaS data service exposure (storage, SQL, Key Vault) and design private connectivity plus identity-based access for each
Identify where infrastructure designs conflict with Domain 2 monitoring or Domain 1 priorities and document the resolution
Your checkpoint
A segmentation design doc covering four workload types, each with trust boundaries, allowed flows, and the control enforcing them.
Design solutions that align with security best practices and priorities
Apply the Zero Trust model (verify explicitly, least privilege, assume breach) to three existing designs from earlier weeks and list concrete changes
Structure a security program around defense in depth and map each layer to at least one Microsoft control
Prioritize a set of security initiatives using a risk-based scoring method and justify the ordering in writing
Draft how Cloud Adoption Framework and Well-Architected security guidance shape a landing zone security design
Your checkpoint
A prioritization matrix ranking six security initiatives by risk, cost, and dependency, with a one-paragraph justification for the top three.
Design solutions that align with security best practices and priorities & Design security solutions for applications and data
Design a secrets and key management approach covering Key Vault, managed identities, rotation, and access boundaries
Specify a data classification and sensitivity labeling scheme and describe how labels drive protection and reporting
Design a DLP and insider risk posture for a mixed cloud/SaaS environment, naming the enforcing policy for each data path
Integrate DevSecOps controls (code scanning, dependency scanning, IaC scanning, secret scanning) into a pipeline design
Your checkpoint
A data protection blueprint showing classification, labeling, encryption, and DLP enforcement for at least four data locations.
Design security solutions for applications and data
Design application identity and access (app registrations, managed identities, API permissions, consent model) for a multi-tier app
Compare securing APIs through Azure API Management, WAF, and Defender for APIs, and select controls per exposure level
Evaluate SaaS posture management with Defender for Cloud Apps: discovery, app governance, session controls, and shadow IT remediation
Assess a database and storage security design against threat detection, auditing, and encryption requirements
Your checkpoint
A threat-modeled application design for one multi-tier app covering identity, secrets, API exposure, data at rest, and detection.
Design solutions that align with security best practices and priorities & Design security operations, identity, and compliance capabilities & Design security solutions for infrastructure & Design security solutions for applications and data
Reconcile all prior deliverables into one end-to-end reference architecture with a single coherent narrative
Diagnose weak areas from timed practice and re-study only the lowest-scoring objectives
Rehearse case-study answering technique: extract requirements, map to controls, and justify tradeoffs under time pressure
Verify readiness by scoring consistently above target on timed practice across all four domains
Your checkpoint
A two-page consolidated architecture summary plus a timed 50-question practice exam scored at or above 80% with errors categorized by domain.
Milestones
Week 2: Explain from memory how identity governance, Conditional Access, and SIEM/SOAR detection interact; score at least 75% on a self-authored 30-question Domain 2 recall set.
Week 4: Produce a network and workload segmentation design unaided in under 45 minutes, naming the enforcing control and log source for every boundary.
Week 6: Given a short business scenario, rank security priorities and justify the ordering using Zero Trust and risk principles in under 20 minutes.
Week 8: Score 80% or higher on two timed 50-question full-scope practice exams taken at least 48 hours apart, with no domain below 70%.