SC-200
Exam SC-200: Microsoft Certified: Security Operations Analyst Associate
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Microsoft Certified: Security Operations Analyst Associate credential is an intermediate-level, Azure-focused certification for security professionals who investigate, search for, and mitigate threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender. Microsoft positions the role around reducing organizational risk through triage, incident response, threat hunting, and detection engineering, working across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Defender for Cloud workload protections in multi-cloud and on-premises environments. Candidates should already be familiar with Microsoft security, compliance, and identity solutions; Microsoft 365; Azure cloud services; AI agents and Copilots; and Windows, Linux, and mobile operating systems. The exam assesses three areas: managing a security operations environment, responding to security incidents, and performing threat hunting. It is proctored, lasts 100 minutes, and may include interactive components, so build hands-on familiarity with portal workflows and KQL rather than memorizing definitions. Microsoft publishes an exam study guide and prep videos, and a practice assessment is available through AI Skills Navigator; the older Microsoft Learn practice assessment is no longer updated. Certification renewal is required every 12 months and can be completed at no cost by passing an online assessment on Microsoft Learn. Always confirm current logistics on Microsoft's official exam page before scheduling.
What you'll study
About SC-200 preparation
What format should I expect on exam day?
The exam is proctored and you have 100 minutes to complete it. Microsoft states you may have interactive components as part of the exam, so expect more than straightforward multiple-choice items. Use the free exam sandbox on Microsoft Learn to practice the question types and interface before your appointment.
How difficult is SC-200?
Microsoft rates the certification at the intermediate level. It assumes prior familiarity with Microsoft security, compliance, and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux, and mobile operating systems. Candidates without hands-on exposure to Defender XDR and Sentinel typically need substantial lab practice before attempting it.
What happens if I fail? Can I retake it?
Yes. Microsoft states you can retake a certification exam 24 hours after the first attempt, while the waiting period for subsequent retakes varies. Check the full exam retake policy on Microsoft Learn before rescheduling so you know the exact timing that applies to your situation.
How much does the exam cost?
Microsoft does not publish a single global price; the price is based on the country or region in which the exam is proctored. Check the official SC-200 exam page and your Pearson VUE scheduling flow for the amount that applies to you. Registration is strongly recommended with a personal Microsoft account.
Does the certification expire?
Yes. Microsoft role-based and specialty certifications expire unless renewed, and this one has a renewal frequency of 12 months. Renewal is free: pass an online assessment on Microsoft Learn that covers recent technology updates for the role. The page was last updated on 10/21/2026.
What should I study first?
Start with the official exam study guide to see the topics covered and any recent updates. Then work through the Microsoft Learn course and SC-200 prep videos, and practice in a trial environment so KQL hunting queries, incident triage, and automation feel routine rather than theoretical.
Which practice assessment should I use?
Microsoft recommends the new Practice Assessment experience on AI Skills Navigator, which more closely aligns with the exam experience. The legacy practice assessment on Microsoft Learn is still reachable but is no longer being updated, so treat it as a secondary resource rather than your main benchmark.
Can I take the exam in my own language?
Microsoft lists the exam in English, Japanese, Chinese (Simplified), Korean, French, German, Spanish, Portuguese (Brazil), Chinese (Traditional), and Italian. Availability can change, so confirm your preferred language when you schedule through Pearson VUE. Accommodations are also available if you need them.
Why do candidates fail on their first attempt?
A common pattern is over-relying on reading and under-practicing. The exam spans environment management, incident response, and threat hunting, and interactive components reward people who have actually clicked through Defender XDR and Sentinel. Weak KQL fluency and unfamiliarity with the exam interface are frequent, avoidable causes of failure.
Which account should I use to register?
Microsoft strongly recommends registering with a personal Microsoft account. If you register with an organizational work or school account, your exam records will be lost if you leave that organization and cannot be recovered. This is a small decision that is very difficult to undo later.