Register
Microsoft ·

What Is Microsoft SC-200 Security Operations Analyst?

Prepare for Exam SC-200: manage a Microsoft SOC environment, respond to incidents, and hunt threats with Defender XDR, Sentinel, and KQL.

View Accumentum courseFree ReadyScore™PathPay® options
Certification PathKey

Overview

Microsoft SC-200 Security Operations Analyst is a Microsoft credential. Prepare for Exam SC-200: manage a Microsoft SOC environment, respond to incidents, and hunt threats with Defender XDR, Sentinel, and KQL. This PathKey™ guide summarizes the domains, format, cost signals, eligibility, and renewal pattern so you can decide before you book. Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the Microsoft exam. Microsoft sets exam content, fees, and policies.

Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the Microsoft exam. Microsoft sets exam content, fees, and policies.

Who it is for

  • Security operations analysts who triage, respond, hunt, and engineer detections.
  • SOC analysts and defenders expanding into Microsoft Defender XDR and Microsoft Sentinel.
  • People with SC-900 or equivalent Microsoft security familiarity who are ready for analyst work.

Exam domains

Weights follow the official outline.

  1. 01

    Toolkit and exam map

    Security operations analyst toolkit across Defender XDR and Sentinel, Map of SC-200 skills measured as of 28 July 2026, and How this course differs from SC-900 and where an optional primer fits.

  2. 02

    Defender XDR and Endpoint automation

    Configure email and alert notifications, tuning, suppression, and correlation in Microsoft Defender XDR, Microsoft Defender for Endpoint advanced features, rule settings, custom data collection, and ASR policies, and Automated investigation and response, automatic attack disruption, device groups, permissions, and automation levels.

  3. 03

    Microsoft Sentinel SIEM and platform

    Specify Microsoft Sentinel roles, Manage data retention across Analytics, Data lake, and XDR tiers, and Create and configure workbooks. Apply SOC optimization recommendations.

  4. 04

    Ingest data and configure detections

    Select and configure connectors: Windows Security Events via AMA, WEF, Syslog/CEF via AMA, Azure Policy and diagnostic settings, Ingest threat indicators. Create custom log tables, and Custom detection rules with Advanced Hunting. Analytics rules (scheduled, NRT, TI, ML).

  5. 05

    Respond in Microsoft Defender XDR

    Investigate and remediate with Defender for Office 365, Purview, Defender for Cloud, Defender for Cloud Apps, Entra ID, and Defender for Identity, Investigate Sentinel alerts and incidents. Use agentic AI including embedded Microsoft Security Copilot, and Investigate multi-stage, multi-domain, and lateral-movement attacks.

  6. 06

    Defender for Endpoint response

    Investigate device timelines, Live response and investigation packages, and Evidence and entity investigation.

  7. 07

    Investigate Microsoft 365 activities

    Investigate threats with Microsoft Purview Audit, Content search in Microsoft Purview eDiscovery, and Investigate threats using Microsoft Graph activity logs.

  8. 08

    Threat hunting with Defender XDR

    Identify the appropriate table for a KQL query. Identify threats with KQL, Create Advanced Hunting queries, interpret threat analytics, and Create hunting graphs including blast radius.

  9. 09

    Threat hunting with Sentinel platform

    Create and monitor hunting queries, Create and manage KQL jobs in Data lake, and Create and manage summary rule tables for querying.

Exam format and cost

Questions
Confirm on the vendor site
Duration
Confirm on the vendor site
Format
Confirm question format on the vendor outline
Passing score
700
Cost
Confirm the current exam fee on the vendor site before you register
Delivery
Pearson VUE test center or online where the vendor offers it
Languages
Confirm available languages on the vendor site

Experience and eligibility

Familiarity with Microsoft security, compliance, and identity solutions is recommended. SC-900 is not this course. Familiarity with Microsoft 365, Azure cloud services, and Windows, Linux, or mobile operating systems supports readiness.

Renewal

Renewal rules for Microsoft SC-200 Security Operations Analyst are set by Microsoft. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.

Roles this credential fits

  • Microsoft Defender XDR and Defender for Endpoint automation, Microsoft Sentinel SIEM configuration and data ingestion, analytics and custom detections, incident response across Defender and Microsoft 365, and threat hunting with KQL, Sentinel Graph, and notebooks.
  • Security Operations
  • Teams standardizing on this credential for hiring or compliance

Microsoft SC-200 Security Operations Analyst questions

Is Microsoft SC-200 Security Operations Analyst worth it?

Microsoft SC-200 Security Operations Analyst is worth it when employers or contracts in your market ask for Microsoft proof, or when the domains match work you already do or want next. Common roles include Microsoft Defender XDR and Defender for Endpoint automation, Microsoft Sentinel SIEM configuration and data ingestion, analytics and custom detections, incident response across Defender and Microsoft 365, and threat hunting with KQL, Sentinel Graph, and notebooks., Security Operations, and Teams standardizing on this credential for hiring or compliance. Read the roles and domains on this page, then decide against your timeline and budget.

How hard is Microsoft SC-200 Security Operations Analyst?

You get Confirm on the vendor site in Confirm on the vendor site. Format: Confirm question format on the vendor outline. Passing score: 700. Delivery: Pearson VUE test center or online where the vendor offers it. Familiarity with Microsoft security, compliance, and identity solutions is recommended. People who pass usually mix domain study with timed practice, not reading alone.

Does Microsoft SC-200 Security Operations Analyst expire?

Renewal rules for Microsoft SC-200 Security Operations Analyst are set by Microsoft. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.

How does Accumentum help with Microsoft SC-200 Security Operations Analyst?

We offer Expert-led training mapped to the Microsoft SC-200 Security Operations Analyst domains, PathPay® payment options, PathPass™ practice where the exam is in our catalog, and military funding support where you qualify. We are an Army CA and Air Force COOL Approved Vendor. Our pass rate across Accumentum certification attempts since August 2022 is 98.8% (2,412 certified of about 2,441 attempts).

How much does the Microsoft SC-200 Security Operations Analyst exam cost?

Published pricing for Microsoft SC-200 Security Operations Analyst: Confirm the current exam fee on the vendor site before you register. Vendors change voucher prices without notice, so confirm on the official store before you buy. PathPay® can spread Accumentum course tuition when you train with us.

What are the Microsoft SC-200 Security Operations Analyst prerequisites?

Familiarity with Microsoft security, compliance, and identity solutions is recommended. SC-900 is not this course. Familiarity with Microsoft 365, Azure cloud services, and Windows, Linux, or mobile operating systems supports readiness.

What should I take after Microsoft SC-200 Security Operations Analyst?

After Microsoft SC-200 Security Operations Analyst, pick the next credential that matches the job you want, not a generic ladder. Use the roles on this page and neighboring PathKey™ guides from the same vendor to plan the sequence. If you need a readiness check first, start with ReadyScore™ when we offer one for this exam.

Official sources

Always confirm fees, dates, and eligibility on the vendor site before you register. Vendors change outlines and prices without notice.