Prepare for SC-200 by mapping your study to the English objectives dated July 28, 2026: managing a security operations environment, responding to incidents, and threat hunting. Practise the listed configuration and investigation tasks, then explain what a KQL query returns. Use the official practice assessment to identify gaps and the sandbox to learn the exam interface.
What does SC-200 cover?
SC-200 is the required exam for Microsoft Certified: Security Operations Analyst Associate. It covers triage, incident response, threat hunting, and detection engineering.
Microsoft describes the target candidate as a security operations analyst who reduces organizational risk by performing triage, responding to incidents, hunting for threats, and engineering detections. Those four verbs are a useful study lens: every topic you review should map to deciding what an alert is, acting on it, searching proactively for threats, or turning a hunt into a reusable detection.
The current profile names Microsoft Defender XDR, Sentinel, Entra ID, Purview, and Defender for Cloud workload protections. Microsoft expects familiarity with its security, compliance and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux and mobile operating systems.
The objectives below are for the English exam update. Localized versions normally follow approximately eight weeks later, and Microsoft says that schedule can vary. Check the version and available language when booking.
Sources: Microsoft Certified: Security Operations Analyst Associate - Certifications | Microsoft Learn — Certification overview and exam details; Study guide for Exam SC-200: Microsoft Security Operations Analyst | Microsoft Learn — Study guide, skills measured as of July 28, 2026
What should you study for the current exam?
The July 28, 2026 English outline has three weighted skill areas. Use its detailed objectives as your coverage checklist.
This is a condensed map of the official outline. The practice tasks are study suggestions, and the weight ranges do not prescribe exact question counts or study hours.
Read the full list for details such as Azure Monitor Agent (AMA) connectors, Common Event Format (CEF) ingestion, retention tiers, attack coverage, and Microsoft Graph activity logs. Match older learning material to current tasks and documentation before relying on it.
| Skill area | Weight | Topics and suggested practice |
|---|---|---|
| Manage a security operations environment | 40–45% | Defender XDR settings, device groups and automated response; Sentinel roles, retention, workbooks, data connectors, playbooks, automation and detections. Trace one authorized lab example from data collection to an analytics rule and response workflow. |
| Respond to security incidents | 35–40% | Investigations across Defender, Sentinel, Entra ID and Purview; endpoint timelines and live response; complex attacks, case management, Microsoft 365 activity, and agentic AI including Security Copilot. For a fictional incident, identify the evidence you would seek and where you would investigate it. |
| Perform threat hunting | 20–25% | Table selection, KQL and advanced hunting, threat analytics and graphs, Data lake KQL jobs, summary rule tables, and notebooks including the Sentinel MCP Server connection. Explain a query’s input, filters, grouped output, and limits before adapting it. |
Practice KQL: filter sign-ins and count failures
Work this original example on paper, then compare your result with the query and explanation. All five input rows are supplied.
Kusto Query Language (KQL) is part of the threat-hunting objectives. The datatable operator defines a small table inside a query; where filters its rows; summarize groups and aggregates the remaining rows.
The current outline explicitly includes choosing an appropriate table. Learn the relevant tables and columns alongside query reasoning; neither memorizing a query nor assuming that schema knowledge is unnecessary is a sound preparation shortcut.
datatable(UserName:string, Result:string)
[
"Ana", "Failure",
"Ana", "Failure",
"Bo", "Success",
"Ana", "Success",
"Bo", "Failure"
]
| where Result == "Failure"
| summarize Failures = count() by UserNameTry it
Each fictional row represents one sign-in record. Using only the five rows in the query, predict the output after filtering for Failure and counting by UserName. Then explain what happens if the where line is removed.
Show answer
The filtered query returns Ana with Failures = 2 and Bo with Failures = 1; row order is unspecified. Removing where counts all records instead: Ana = 3 and Bo = 2, even though the output column is still misleadingly named Failures.
Filtering removes the two Success rows before aggregation. summarize count() by UserName groups the remaining three rows by user. Without the filter, count() does not inspect whether a record is a failure; a column alias does not change that calculation. These counts describe only the supplied records and do not establish that either account is compromised.
Sources: Study guide for Exam SC-200: Microsoft Security Operations Analyst | Microsoft Learn — Study guide, skills measured as of July 28, 2026; datatable operator - Kusto | Microsoft Learn — datatable operator; where operator - Kusto | Microsoft Learn — where operator; summarize operator - Kusto | Microsoft Learn — summarize operator
Build a practical preparation checklist
Use a cycle of reading, practice, explanation, and gap review across all three domains.
Microsoft recommends training and hands-on experience. Follow its learning paths and linked documentation, and check access, licensing, permissions and potential resource costs before starting a lab.
The free practice assessment supplies examples, explanations and further reading. Microsoft says these are not real exam questions and do not reproduce the exam’s length or complexity. Use your results to choose what to study next; a practice score does not guarantee a pass.
- Mark each detailed objective as understood, practised, or still needing work.
- In an authorized lab, follow current documentation for a listed connector, detection, and automation task. Record what you configured and what evidence shows the expected result.
- For an incident scenario, state what is known, what evidence is missing, and which listed investigation surface you would use.
- Change one part of the KQL example and predict the output before checking it. Extend your practice to the tables and operations named in the current objectives.
- Review practice-assessment explanations and revisit weak topics, then use the sandbox to practise the interface.
Sources: Microsoft Certified: Security Operations Analyst Associate - Certifications | Microsoft Learn — Certification overview and exam details; Study guide for Exam SC-200: Microsoft Security Operations Analyst | Microsoft Learn — Study guide, skills measured as of July 28, 2026; Practice Assessments for Microsoft Certifications | Microsoft Learn — SC-200 practice assessment listing
What should you expect on exam day?
The SC-200 credential page currently lists 100 minutes. Confirm the appointment time and review its instructions when you register.
Microsoft distinguishes exam time from total seat time, which also covers instructions and related appointment steps. Its general policy allows different durations for role-based exams that may contain labs; it does not publish a fixed lab list. Do not infer a guaranteed lab count or question count from a practice test.
The passing score is 700 on Microsoft’s scaled 1–1,000 scale. That is not a raw 70% score. Book through the official credential page for the current price, language and accommodations information.
- Microsoft Learn access is restricted to learn.microsoft.com during role-based exams. Q&A, practice assessments and your profile are excluded, and other web domains are blocked.
- No extra exam time is provided for browsing. Practise targeted lookups, while developing enough understanding to work without researching every question.
- Five minutes for breaks are already included in the exam duration. The clock continues during a break; after starting one, you cannot return to previously viewed questions, including unanswered or flagged questions.
Sources: Microsoft Certified: Security Operations Analyst Associate - Certifications | Microsoft Learn — Certification overview and exam details; Study guide for Exam SC-200: Microsoft Security Operations Analyst | Microsoft Learn — Study guide, skills measured as of July 28, 2026; Exam duration and exam experience | Microsoft Learn — Exam duration, breaks, and Microsoft Learn access; Exam scoring and score reports | Microsoft Learn — Passing scores and scoring
How do renewal and exam retakes work?
Renewal is a separate free, open-book, unproctored assessment on Microsoft Learn. It is available during the six months before your certification expires.
Role-based certifications are initially valid for one year after all requirements are completed. Passing renewal before expiry extends the credential one year from its expiration date. Check the date in your profile; an expired credential must be re-earned through the required exam requirements.
For a failed SC-200 exam, the standard wait is 24 hours after the first attempt and 14 days between later attempts, with at most five attempts in a 12-month period from the first attempt. Renewal has its own policy: after the second unsuccessful renewal try, wait at least 24 hours between further attempts and pass before expiry.
Sources: Credential expiration policies | Microsoft Learn — Role-based certification expiry; Microsoft Certification Renewal | Microsoft Learn — Renewal process; Exam and Applied Skills assessment lab retake policies | Microsoft Learn — Exam retake policy
Sources
Facts checked:
- Microsoft Certified: Security Operations Analyst Associate - Certifications | Microsoft Learn
- Study guide for Exam SC-200: Microsoft Security Operations Analyst | Microsoft Learn
- datatable operator - Kusto | Microsoft Learn
- where operator - Kusto | Microsoft Learn
- summarize operator - Kusto | Microsoft Learn
- Exam duration and exam experience | Microsoft Learn
- Exam scoring and score reports | Microsoft Learn
- Credential expiration policies | Microsoft Learn
- Microsoft Certification Renewal | Microsoft Learn
- Exam and Applied Skills assessment lab retake policies | Microsoft Learn
- Practice Assessments for Microsoft Certifications | Microsoft Learn