Skip to main content
Defensive / SOC → Detection EngineerListed as a primary cert for that lane. Back to pathway
Back to certifications

Microsoft · Cybersecurity

Microsoft SC-200

Investigating and responding to threats using Microsoft's security-operations tools, including Sentinel and Defender.

View certification details
Understand the subject

Investigating and responding to threats using Microsoft's security-operations tools, including Sentinel and Defender.

Apply it to the work

Useful in a Microsoft-focused SOC when you must connect alerts, query supporting evidence and decide what action is justified.

Build practical evidence

Learn basic KQL and Windows event analysis. Work through an investigation in which the first alert is only part of the story.

What you will learn to do

Understand the subject

Investigating and responding to threats using Microsoft's security-operations tools, including Sentinel and Defender.

Apply it to the work

Useful in a Microsoft-focused SOC when you must connect alerts, query supporting evidence and decide what action is justified.

Build practical evidence

Learn basic KQL and Windows event analysis. Work through an investigation in which the first alert is only part of the story.

Certification essentials

Requirements, costs and keeping it current.

Check the vendor record and ongoing commitment alongside the career guidance.

Pricing view
Market

Vendor record

Live

Live, one exam, SC-200. Microsoft lists the renewal frequency as 12 months, by free online assessment on Microsoft Learn.

Source: Microsoft · Read 17 September 2026

Sourced fields only; this does not mean every exam detail has been verified. Pricing and renewal policies have their own sources and check dates. Confirm the currency, tax and final booking total with the vendor.

Role-fit guidance is TechWaymark editorial interpretation. It is separate from the recorded vendor facts and does not measure hiring outcomes.

Costs and renewal

Exam cost
£106
Exam format
Exam format not yet verified — check the vendor's exam page
Keeping it current

Renew annually by passing a free, online Microsoft Learn assessment during the 6 months before expiry.

Renewal sources & exceptions

This applies to the earned certification, not an individual exam pass. Renewal must be completed before expiry and while its assessment remains available.

Renewal policy checked 2026-09-28. Check the linked provider policy for current fees and eligibility.

UK exam fee shown by Microsoft Learn; proctoring country sets the price. Confirm applicable taxes and current booking total; training and retakes are separate. Vendor price checked 2026-09-24. Check the vendor record before booking.

Current vendor pricing source ↗
Preparation and practical skills

Recommended prior knowledge

  • SC-900 vocabulary
  • Some KQL

Common misconceptions

  • Microsoft SC-200 may meet a named requirement; it does not guarantee shortlisting or replace documented work.

What this cert does NOT guarantee

  • Guaranteed interviews, a salary increase or proof of production experience.
Alternatives and related certifications

Where this fits

  • None required
This cert
Microsoft SC-200
  • Top of this lane

Alternative routes

No single right path. These adjacent options reach similar roles.

  • SC-100
    Common follow-on or adjacent credential, see the graph for full lineage.

Adjacent & overlapping

  • SC-100
Career outcomes and limitations

Realistic first roles

Microsoft security operations

How people actually get here

    Real-world career variations

    Timeline expectations

    1. Months 0–2Foundation reading, concepts, vocabulary.
    2. Months 2–4Hands-on labs, documented home projects.
    3. Months 4–6Practice exams, weak-area drills, exam.
    4. Post-examUse target vacancies to guide applications and projects. There is no guaranteed time to a first role.

    Study resources

    Study options

    Choose the right mix for your goals and experience. Links below go to official and third-party resources.

    Guided study

    Structured resources from established providers can help build knowledge and skills.

    Compare study options →

    Third-party providers. Commercial terms, pricing and availability apply.

    Practice environments

    Explore suitable environments for practical work. Check the tools, features and access you need.

    Compare practice resources →

    External resources. Check current costs and access requirements.

    Resources are selected for relevance. Compare access, syllabus coverage and total cost; a listing does not imply a commercial partnership.

    Compare the resources for Microsoft SC-200
    Learning pathProvider source

    Microsoft Learn. SC-200 free path

    Reading + interactive

    Free resource; confirm current access terms
    View resource
    PracticeProvider source

    Microsoft Official Practice Assessment

    Quiz

    Free resource; confirm current access terms
    View resource
    LabExternal resource

    Microsoft Sentinel training lab (GitHub)

    Hands-on

    Free resource; confirm current access terms
    View resource

    Check the current syllabus, access terms and total cost before choosing. Resource inclusion does not guarantee exam success.

    Optional home projects

    Build something you can explain.

    Ideas to explore after choosing a certification, using your own tools and keeping evidence of your work.

    Example project evidence
    Project evidence map (example)
    Investigation queries and timelineScope and inputs
    Analyst assessment with evidence gapsDecisions and reasoning
    Evidence record (example)
    EvidenceWhat to capture
    Investigation queries and timelineShow the inputs, scope and decisions behind this record. Queries state their time window and field assumptions.
    Analyst assessment with evidence gapsInclude the evidence supporting your conclusion. Correlation is not presented as proof of causation or compromise.

    Turn identity events into an investigation timeline

    A Microsoft security analyst needs to investigate related identity events without treating every alert as a separate incident.

    Vendor environment Your own tools Evidence guidance
    View project guide
    Track this certification

    Editorial route and career guidance. No separate external evidence review is recorded for this assessment.

    Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.