SC-200
Microsoft Certified: Security Operations Analyst Associate
The SC-200 is Microsoft's role-based certification for Security Operations – with clear focus on its own product ecosystem (Microsoft Sentinel, Defender XDR, Security Copilot). It is not a vendor-neutral SOC certificate, but specifically validates the ability to detect and respond to threats in Azure and M365 environments. For teams already heavily invested in Microsoft technologies, it is very practical and relevant to the job market. Outside this stack, it loses significant weight. The exam will be updated on April 16, 2026 – candidates should review the current Study Guide.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Exam format
40–60 questions (multiple-choice + case studies), 120 minutes. Proctored via Pearson VUE. Passing score: 700/1000.
24-hour wait after first fail; 14 days between attempts 2-4. Max 5 attempts per 12-month window.
› Recertification
Valid for 1 year. Free online renewal exam on Microsoft Learn.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
› Prerequisites
No formal prerequisites. Recommended: Experience with Microsoft Sentinel, Defender, and KQL.
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
› Careers that commonly pursue this cert
Monitor, detect, and respond to security threats in a Security Operations Center. The front line of cyber defense.
Build detection rules, tune SIEM systems, and hunt for threats that evade automated defenses.
A hybrid role growing out of the realisation that SOCs need engineers who understand cloud-native telemetry, IAM-first threat models, and how to instrument AWS/Azure/GCP for detection.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.