SC-200 Study Guide: How to Pass the Microsoft Security Operations Analyst Exam
A practical SC-200 study guide for Level 1 SOC analysts — what the exam actually tests, the study materials worth your time, an 8-week plan, and the KQL you need before exam day.
If you’re heading into a Level 1 SOC role — or trying to land one — the SC-200 is one of the most job-relevant certifications you can earn. It isn’t a theory exam. It asks you to do the same things a Tier-1 analyst does on shift: pick up an incident in Microsoft Defender XDR, figure out what happened, decide what to contain, and write a KQL query to check whether it’s happening anywhere else.
This SC-200 study guide is built around the exam as it stands right now, including Microsoft’s 2026 changes that a lot of older guides still miss. I’m working through the same material myself, so everything below is the approach I’d actually follow — not a copy of the exam outline with extra adjectives.
01What is SC-200 — and who is it for?
SC-200 is the exam for the Microsoft Certified: Security Operations Analyst Associate certification. It’s an intermediate, role-based exam aimed at people who monitor, investigate and respond to threats using Microsoft’s security stack.
The tools you’ll be tested on are the ones many enterprise SOCs run every day:
- Microsoft Defender XDR — the unified incident queue that pulls together Defender for Endpoint, Office 365, Identity and Cloud Apps
- Microsoft Sentinel — the cloud SIEM/SOAR where logs land, analytics rules fire and playbooks automate response
- Microsoft Entra ID — identity risk, risky sign-ins and compromised accounts
- Microsoft Purview — audit logs, eDiscovery content search and insider-risk signals
- Microsoft Defender for Cloud — workload protection alerts for servers, storage and databases
- Kusto Query Language (KQL) — the query language that ties all of it together
It’s a strong fit if you’re a new or aspiring Tier-1 analyst, a sysadmin or help desk tech moving into security, or anyone joining an organization that runs Microsoft 365 E5 and Sentinel. You don’t need years of SOC experience, but you do need hands-on time in the portals. Reading alone won’t get you there.
02SC-200 exam at a glance
| Detail | What to know |
|---|---|
| Certification | Microsoft Certified: Security Operations Analyst Associate |
| Level | Intermediate (Associate, role-based) |
| Cost | Around US$165 — the exact price depends on the country where you take it |
| Delivery | Proctored through Pearson VUE, at a test centre or online from home |
| Question styles | Multiple choice, drag-and-drop, “yes/no” statement series, case studies — possibly interactive components |
| Microsoft Learn access | Yes — role-based exams let you open Microsoft Learn in a split screen, but the timer keeps running |
| Retakes | First retake after 24 hours; later retakes have longer waits |
| Renewal | Every 12 months via a free, unproctored online assessment on Microsoft Learn |
| Languages | English plus nine others, including French, Spanish, German and Japanese |
Tip: Microsoft recommends booking with a personal Microsoft account, not your work account. If you register with a work account and later leave that employer, your certification records can be lost.
03What changed in 2026 (read this before you buy a course)
SC-200 has been rewritten more than once, and a lot of the content online is out of date. Here’s the timeline that matters:
- Older versions split the exam by product — separate sections for Defender XDR, Sentinel and Defender for Cloud, plus a standalone “configure protections and detections” area.
- The current outline is organized by what an analyst does: manage the environment, respond to incidents, hunt for threats. Same three weights, but the objectives now name newer features — agentic AI investigation with embedded Security Copilot, Sentinel data retention tiers (Analytics, Data lake, XDR), Sentinel Graph and hunting graphs, KQL jobs in the data lake, summary rules, and hunting with notebooks connected to the Sentinel MCP Server.
- October 21, 2026: Microsoft has announced another English-language update. Its change log marks it as minor, limited to the data ingestion objectives. The weights stay the same.
What this means for you: if a course, book or practice test still talks about four domains, it was built for an older exam. It isn’t useless — KQL, Sentinel analytics rules and Defender for Endpoint investigations haven’t gone anywhere — but you’ll have gaps on Security Copilot, the data lake and Sentinel Graph. Always check the official study guide before you book.
04SC-200 skills measured
The exam is split into three skill areas. The percentages tell you where to spend your time: nearly half the marks come from setting up and running the environment, not from responding to incidents.
1. Manage a security operations environment
40–45%- Automation — Defender XDR notification and alert tuning, automated investigation and response (AIR), automatic attack disruption, Sentinel automation rules and playbooks
- Defender for Endpoint configuration — advanced features, device groups and automation levels, attack surface reduction (ASR) rules
- Sentinel platform — roles, workbooks, retention tiers, SOC optimization recommendations
- Data ingestion — choosing connectors, Windows Security Events via AMA with data collection rules, Windows Event Forwarding, Syslog and CEF via AMA, Azure activity logs, threat indicators, custom log tables
- Detections — custom detection rules from Advanced Hunting, Sentinel analytics rules (scheduled, NRT, threat intelligence, ML), anomalies, and MITRE ATT&CK coverage
2. Respond to security incidents
35–40%- Defender XDR incidents across Office 365, Cloud Apps, Identity, Defender for Cloud, Entra ID and Purview signals
- Complex attacks — multi-stage, multi-domain and lateral movement
- Agentic AI — investigating incidents with embedded Security Copilot
- Endpoint response — device timelines, live response, investigation packages, evidence and entity investigation
- Microsoft 365 investigations — Purview Audit, eDiscovery content search and Microsoft Graph activity logs
- Case management for tracking incidents end to end
3. Perform threat hunting
20–25%- Defender XDR Advanced Hunting — picking the right table, writing KQL, interpreting threat analytics
- Graphs — hunting graphs (including blast radius) and entity relationships with Sentinel Graph
- Sentinel hunting — hunting queries, KQL jobs in the data lake, summary rule tables, and notebooks connected to the Sentinel MCP Server
KQL runs through all three areas. You’ll see it in detection rules, in incident investigations and, obviously, in hunting — so treat it as the backbone of your prep rather than a side topic.
05How SC-200 maps to a real Level 1 SOC shift
This is what makes SC-200 different from purely theory-based certs. Almost every objective lines up with something a Tier-1 analyst does during a normal shift:
| On shift you… | On the exam it’s called… | Where it lives |
|---|---|---|
| Work the alert queue and pick up a new incident | Respond to alerts and incidents | Defender XDR incidents page |
| Check what a user or device did before and after an alert | Investigate device timelines, entity investigation | Defender for Endpoint |
| Isolate a laptop or pull an investigation package | Perform actions on the device, live response | Defender for Endpoint |
| Confirm a phishing email and find who else received it | Investigate threats with Defender for Office 365 | Defender XDR / Explorer |
| Deal with an impossible-travel or risky sign-in | Remediate compromised identities from Entra ID | Entra ID Protection |
| Check if an IOC appears anywhere else in the estate | Advanced Hunting with KQL | Defender XDR / Sentinel |
| Escalate to Tier 2 with clean notes | Case management | Defender XDR / Sentinel |
| Flag a noisy rule for tuning | Alert tuning, suppression, SOC optimization | Defender XDR / Sentinel |
When you study, keep asking yourself: “When would I do this at 3 a.m. with an incident open?” Scenario questions on the exam are written the same way, and thinking like the analyst on shift makes the right answer much easier to spot.
06Best SC-200 study materials
You can pass SC-200 using mostly free resources. Paid options help with practice and structure, but the core material comes straight from Microsoft.
Official (start here)
Microsoft Learn learning paths FREE
The self-paced version of course SC-200T00 — ten learning paths covering Defender XDR, Security Copilot, Purview, Defender for Endpoint, Defender for Cloud, KQL, and Sentinel setup, connectors, detections and hunting.
Official study guide FREE
The skills-measured list and change log. Use it as your checklist — tick off every bullet before you book.
Free Practice Assessment FREE
Written by Microsoft in the style of the real exam. Take it once early as a baseline and again in the final week.
Official lab instructions FREE
The SC-200T00A lab guides are published on GitHub by MicrosoftLearning. Follow them in your own tenant for real hands-on practice.
Exam Readiness Zone videos FREE
Microsoft’s own SC-200 prep sessions that walk through each skill area and the kind of questions to expect.
Exam sandbox FREE
Click through the real exam interface and question types before test day so nothing surprises you.
Hands-on lab environment
This is the part people skip, and it’s the part that matters most. You need a place to click around:
- Azure free account — spin up a Log Analytics workspace and enable Microsoft Sentinel. New workspaces get a free trial period; check Microsoft’s current terms before you start ingesting data.
- Microsoft 365 E5 trial — gives you Defender XDR, Defender for Endpoint and Purview to explore. Onboard a test VM and generate some alerts.
- Built-in demo content — Sentinel’s Content hub solutions include sample analytics rules, workbooks and hunting queries you can study and modify.
Watch your costs: set an Azure budget alert on day one and delete resources when you finish a lab. Log ingestion is the usual surprise bill.
KQL practice
Must Learn KQL series FREE
A long-running free blog series by Rod Trent that takes you from zero to confident with KQL, written specifically with Sentinel in mind.
Kusto Detective Agency FREE
A gamified set of KQL puzzles from Microsoft. It’s surprisingly fun and it forces you to actually write queries.
Advanced Hunting schema reference FREE
Microsoft’s docs on the Defender XDR tables. Knowing which table holds what is a skill the exam tests directly.
Your own lab tenant FREE
The best KQL teacher is a workspace with real data. Rewrite every sample query you find until you understand each line.
Optional paid extras
Instructor-led SC-200T00 PAID
The official four-day course through a Microsoft training partner. Useful if your employer is paying or you learn better in a classroom.
Official practice tests PAID
Timed, full-length practice exams from Microsoft’s practice test partner — good for building stamina in the final two weeks.
Exam Ref SC-200 book PAID
Helpful for structured reading, but books lag behind exam updates. Check it against the current skills list.
Exam Replay PAID
An exam voucher bundled with a retake. Worth it if you’re nervous about a first attempt.
Avoid exam dumps. Beyond breaking Microsoft’s candidate agreement (which can get your certifications revoked), dumps are often wrong for the current version — and they leave you useless in an actual SOC. The whole point of this cert is being able to do the job.
078-week SC-200 study plan
This plan assumes 1–1.5 hours on weekdays and a longer lab session on weekends. If you already work in a Microsoft environment, you can compress it to five or six weeks.
WEEK 1Baseline and lab setup
Take the free Practice Assessment cold to see where you stand. Create your Azure and Microsoft 365 E5 trial, set a budget alert, and start the Defender XDR learning path.
WEEK 2Defender XDR and Defender for Endpoint
Onboard a test VM. Walk through the incidents page, device timeline, live response, ASR rules, device groups and automation levels. Trigger a test alert and investigate it end to end.
WEEK 3Identity, email and cloud apps
Defender for Office 365, Defender for Identity, Defender for Cloud Apps and Entra ID risky users. Add the Security Copilot learning path and practice investigating an incident with it.
WEEK 4KQL foundations
Complete the KQL learning path. Write queries every day: where, project, extend, summarize, join, render. Start the Must Learn KQL series or Kusto Detective Agency.
WEEK 5Sentinel setup and data ingestion
Workspace roles, retention tiers, connectors, Windows Security Events via AMA with data collection rules, Syslog/CEF via AMA, threat intelligence, custom tables. This is heavily weighted, so don’t rush it.
WEEK 6Detections and automation
Build scheduled and NRT analytics rules, automation rules and a simple playbook. Create a custom detection in Defender XDR. Check your MITRE ATT&CK coverage and SOC optimization recommendations.
WEEK 7Threat hunting and Purview
Hunting queries, hunting graphs, Sentinel Graph, KQL jobs and summary rules in the data lake, notebooks. Then Purview Audit, eDiscovery content search and Graph activity logs.
WEEK 8Review and exam
Retake the Practice Assessment and a timed full-length test. Re-lab anything below 80%. Try the exam sandbox, practice finding pages on Microsoft Learn quickly, then book your exam.
08KQL you must know for SC-200
You don’t need to be a KQL wizard, but you do need to read a query and know what it returns, spot the wrong operator, and pick the right table. These operators show up constantly:
| Operator | What it does |
|---|---|
where | Filters rows (always filter on time first for speed) |
project / extend | Picks columns / adds calculated columns |
summarize … by | Aggregates — counts, sets, distinct values per group |
join | Combines two tables on a shared column |
has vs contains | has matches whole terms and is faster; contains matches any substring |
ago() | Relative time, e.g. ago(24h) or ago(7d) |
render | Turns results into a chart |
// Users with 10+ failed sign-ins in the last 24 hours SigninLogs | where TimeGenerated > ago(24h) | where ResultType != "0" | summarize FailedAttempts = count(), SourceIPs = make_set(IPAddress) by UserPrincipalName | where FailedAttempts >= 10 | order by FailedAttempts desc
// Encoded PowerShell commands on endpoints in the last 7 days DeviceProcessEvents | where Timestamp > ago(7d) | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine contains "-enc" | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
// Top 10 sender domains behind phishing detections this week EmailEvents | where Timestamp > ago(7d) | where ThreatTypes has "Phish" | summarize Emails = count() by SenderFromDomain | top 10 by Emails
Easy marks: Defender XDR Advanced Hunting tables use Timestamp, while Sentinel tables use TimeGenerated. Also learn the core Defender table families — Device*, Email*, Identity*, CloudAppEvents and Alert* — and what each one holds.
09How to pass SC-200 on exam day
- Use Microsoft Learn as a safety net, not a crutch. You can open it during the exam, but the clock doesn’t stop. Save it for one or two questions where you need to confirm a specific setting or feature name.
- Practice searching Learn beforehand. Know roughly where the Sentinel, Defender XDR and KQL docs live, so a lookup takes 60 seconds instead of five minutes.
- Read the last line of each question first. Scenario questions are long. Knowing whether they want “the first step,” “the least effort” or “the lowest cost” changes the answer.
- Watch for the case study. Once you leave some sections you can’t go back, so answer everything in a section before moving on.
- Flag and move. Don’t burn five minutes on one KQL question. Mark it, keep going, and come back with fresh eyes.
- Think least privilege and automation. When two answers both work, Microsoft usually wants the one that grants the fewest permissions or automates the task.
- Test online? Prep your room. Clear desk, one monitor, stable connection and your ID ready. Run the system test the day before.
10Common SC-200 mistakes to avoid
- Studying from an old four-domain guide and missing Security Copilot, the data lake and Sentinel Graph entirely.
- Watching videos without touching the portals. Questions often ask where a setting lives or what happens after you click it.
- Treating the “manage” domain lightly. Connectors, data collection rules and retention tiers feel dry, but they’re worth the most marks.
- Skipping Purview. Audit, eDiscovery content search and Graph activity logs are on the outline and catch people out.
- Memorizing KQL instead of writing it. You need to spot why a query is wrong, which only comes from writing lots of them.
- Booking too late or too early. Book when you’re scoring 80%+ on practice tests consistently — a date on the calendar keeps you honest.
11Is SC-200 worth it for a Level 1 SOC analyst?
For most people aiming at Tier-1 work in a Microsoft shop, yes. It proves you can work in the exact consoles your employer uses, and the prep itself turns into on-the-job skill. The renewal is free every year, which also keeps you current as Microsoft ships new features.
A few honest caveats:
- It’s vendor-specific. If your target employers run Splunk or CrowdStrike, a vendor-neutral cert like CompTIA CySA+ covers the concepts more broadly. The two actually pair well — CySA+ for the “why,” SC-200 for the “how” in Microsoft tools.
- It isn’t entry-level fundamentals. If Azure and Microsoft 365 are completely new to you, SC-900 is a gentler first step.
- Hands-on still wins. The certificate gets you noticed; being able to walk through an investigation in the interview gets you hired.
Key Takeaways
- SC-200 has three skill areas: manage the environment (40–45%), respond to incidents (35–40%) and hunt for threats (20–25%).
- Use the current outline — 2026 added Security Copilot, Sentinel data lake tiers, Sentinel Graph and KQL jobs. A minor update lands October 21, 2026.
- Microsoft Learn, the free Practice Assessment and the official GitHub labs cover almost everything you need.
- Build a lab. Hands-on time in Defender XDR and Sentinel is what separates a pass from a near-miss.
- KQL runs through every domain — write queries daily, don’t just read them.
- You need 700 to pass, you get 100 minutes, and Microsoft Learn is available during the exam (the timer keeps running).
12Frequently asked questions
Is SC-200 hard?
It’s intermediate. The concepts aren’t extreme, but the questions are scenario-based and cover a lot of products. People with hands-on time in Defender XDR and Sentinel find it very manageable; people who only watched videos usually struggle with the configuration and KQL questions.
How long does it take to study for SC-200?
Most people need six to ten weeks at about an hour a day. If you already work in a Microsoft security environment, four to five weeks can be enough. Use the free Practice Assessment to decide.
Can I pass SC-200 with no SOC experience?
Yes, if you build a lab. A Microsoft 365 E5 trial plus an Azure free account with Sentinel lets you practice the same investigations a Tier-1 analyst does. The exam rewards hands-on familiarity more than job titles.
Do I need to know KQL for SC-200?
Yes. KQL appears in all three skill areas. You won’t write long queries from scratch, but you must read queries, choose the right table and operator, and spot what a query returns.
Is SC-200 open book?
Partly. Role-based Microsoft exams, including SC-200, let you open Microsoft Learn in a split screen during the exam. You can’t use other sites, and the exam timer keeps running while you search.
Should I take SC-900 before SC-200?
It isn’t required. SC-900 is useful if Microsoft security, compliance and identity concepts are brand new to you. If you already have IT or security experience, you can go straight to SC-200.
How do I renew SC-200?
The certification is valid for 12 months. You renew it for free by passing an online assessment on Microsoft Learn, which you can take within six months before it expires.
The bottom line
SC-200 rewards people who have actually sat in the consoles. Follow the current study guide, build a small lab, write KQL every day, and treat every objective as a task you’d do on a real shift. Do that for eight weeks and you won’t just pass the exam — you’ll walk into your first SOC role already knowing your way around.
Keep reading · From IlmBytesTech
More cybersecurity guides
References
- Study guide for Exam SC-200: Microsoft Security Operations Analyst — Microsoft Learn
- Microsoft Certified: Security Operations Analyst Associate — Microsoft Learn
- Course SC-200T00: Defend against cyberthreats with Microsoft’s security operations platform — Microsoft Learn
- Exam duration and exam experience — Microsoft Learn
- Exam retake policy — Microsoft Learn
- SC-200T00A lab instructions — MicrosoftLearning on GitHub
Atif @atifmem
Atif writes practical, plain-language guides on cybersecurity, Linux, and networking — turning complex security topics into something anyone can follow. Read more on IlmBytesTech.