Skip to content
CertGPS

Microsoft Security Operations Analyst Associate

Tests SOC analyst work in Microsoft Defender XDR and Sentinel, from detection rules and incident response to KQL threat hunting

IntermediateMicrosoft

The exam

Exam cost
$165
Study time
2-4 months
Passing score
700 (scale of 1–1,000)
Valid for
1 year

Before you book

  • None required
  • Recommended: familiarity with Microsoft security, compliance and identity products, Microsoft 365 and Azure
  • Recommended: familiarity with Windows, Linux and mobile operating systems, and with AI agents and Copilots

What it covers

Security domains

Skills

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. Microsoft Security Operations Analyst Associate

    You are here

  2. Microsoft Cloud and AI Security Engineer Associate

    Intermediate

    Next step. Moves from responding to alerts to configuring the Azure controls that raise them

Study guide

Last updated

SC-200 Study Guide: Microsoft Security Operations Analyst After the October 2026 Update

SC-200 earns the Microsoft Certified: Security Operations Analyst Associate and tests the daily work of an analyst in a Microsoft security operations center (SOC): tuning Defender XDR and Microsoft Sentinel, working incidents, and hunting with Kusto Query Language (KQL). The English exam changes on October 21, 2026. Microsoft rates the change as minor, mostly in how data gets into Sentinel, but if you book after that date, study from the new skills list.

Who it suits, and who can skip it

It fits a SOC analyst, incident responder or detection engineer whose organization runs Defender XDR and Sentinel, and a Microsoft 365 or Azure administrator who has started owning alerts. Microsoft expects familiarity with its security, compliance and identity products, Microsoft 365, Azure, Windows, Linux and mobile operating systems, and AI agents and Copilots. It's a good second or third certification, a year or two into security work.

Skip it if your SOC runs Splunk, Google Security Operations or another non-Microsoft SIEM. CySA+ tests the same analyst skills without tying you to one vendor, and GCIH goes deeper on incident handling. If your work is configuring controls rather than responding to them, SC-500 is the Microsoft exam for that.

The exam at a glance

SC-200
CertificationMicrosoft Certified: Security Operations Analyst Associate
Next updateEnglish version updated October 21, 2026
Time100 minutes; Microsoft says the exam may include interactive components
QuestionsNot published for this exam
Passing score700 on a 1–1,000 scale
Price$165 in the United States; varies by country
DeliveryProctored, scheduled through Pearson VUE
PrerequisitesNone
ValidityOne year; renew free with an online assessment

What the three skill areas cover

  • Manage a security operations environment: 40–45%
  • Respond to security incidents: 35–40%
  • Perform threat hunting: 20–25%

The first area is the biggest by a distance and the one candidates tend to underestimate, because most of it is configuration. It covers Defender for Endpoint advanced features, attack surface reduction rules and device groups, alert tuning and suppression in Defender XDR, automatic attack disruption, Sentinel roles, workbooks and SOC optimization, and data ingestion. That last part is where the October update lands. You'll need to know Windows Security Events via the Azure Monitor Agent with data collection rules, Windows Event Forwarding, Syslog and Common Event Format through the agent, Azure activity logs via Azure Policy, threat indicators and custom log tables. Detection engineering also sits here: custom detection rules from Advanced Hunting, scheduled and near-real-time analytics rules, and mapping coverage to MITRE ATT&CK.

Response spans more products than the exam's name suggests. Beyond Defender for Endpoint, you investigate alerts from Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud workload protections, Microsoft Entra ID and Microsoft Purview. You also search Purview Audit, eDiscovery content search and Microsoft Graph activity logs, and run investigations with the Security Copilot embedded in the portal.

Hunting is the smallest area but the most current. Beyond writing Advanced Hunting queries, Microsoft lists Sentinel Graph, hunting graphs with blast radius, KQL jobs and summary rules in the Sentinel data lake, and notebooks connected to the Sentinel MCP Server. Data retention across analytics, data lake and XDR tiers appears in the first area too, so the data lake is worth a full study session of its own.

A plan that starts with KQL

KQL runs through all three areas, so learn it first. Microsoft's KQL tutorials on Learn cover the operators, and Kusto Detective Agency, a set of KQL investigation puzzles, gives you practice on real-sized data. Aim to write a join across two tables and a summarize-by-time-bin query without looking anything up.

Then build a lab. Microsoft gives the first 31 days of Sentinel free, up to 10 GB a day of Analytics-tier ingestion, on a new Log Analytics workspace. Use that month deliberately:

  1. Week one: connect Windows and Linux virtual machines through the Azure Monitor Agent with data collection rules, and add Azure activity logs.
  2. Week two: write three scheduled analytics rules and one near-real-time rule, map them to ATT&CK, then trigger them.
  3. Week three: build an automation rule and a playbook that tags and assigns incidents.
  4. Week four: hunt across what you've collected and save the queries as hunting queries.

Defender XDR is harder to reach without a business tenant. If your employer runs it, ask for read access to a test device group. Otherwise, cover those objectives through Microsoft Learn's SC-200 modules and the documentation.

Microsoft's free practice assessment and the exam sandbox show the question style. There's also a four-day instructor-led course, SC-200T00-A. We'd give the first skill area about 40% of your time, matching its weight, and resist the urge to spend most of it on hunting because it's the most interesting part.

After you pass

The certification expires after a year. Renewal costs nothing: an unproctored, open-book assessment on Microsoft Learn that you can take during the six months before expiry, as often as needed, and passing extends you by a year. If you fail the exam itself, you can retake after 24 hours, then wait 14 days between later attempts, with at most five tries in 12 months. You can't resit an exam you've passed while the certification is current.

Next steps:

  • CySA+ to back the Microsoft credential with a vendor-neutral one.
  • GCIH for deeper incident handling.
  • Microsoft's Cybersecurity Architect Expert, through SC-100, which accepts SC-200 as its prerequisite.

Our view

SC-200 is one of the more practical Microsoft exams. The skills list reads like an analyst's week, and the free annual renewal keeps holders current as the products change. The weakness is that the exam is tied to Microsoft's console names and licensing tiers, which change often, and without access to Defender XDR much of your preparation is reading. For an analyst in a Microsoft shop, $165 is easy to justify. For a SOC on another SIEM, it proves the wrong tools.

Sources