- Security operations analyst toolkit across Defender XDR and Sentinel.
- Map of SC-200 skills measured as of 28 July 2026.
- How this course differs from SC-900 and where an optional primer fits.
- Exam logistics: passing score 700/1000, Pearson VUE, Microsoft Learn renewal.
Microsoft Security Operations Analyst (SC-200)
Microsoft SC-200 Security Operations Analyst Certification Training Course
Triage incidents, hunt threats, and engineer detections with Microsoft Defender XDR, Microsoft Sentinel, and KQL. That’s the Security Operations Analyst Associate (SC-200) work.
Course focus: Microsoft Defender XDR and Defender for Endpoint automation, Microsoft Sentinel SIEM configuration and data ingestion, analytics and custom detections, incident response across Defender and Microsoft 365, and threat hunting with KQL, Sentinel Graph, and notebooks.
Course Overview
Reduce organizational risk with Microsoft security operations, not SC-900 vocabulary alone.
Accumentum’s Microsoft SC-200 Security Operations Analyst Certification Training Course prepares security operations analysts to monitor, investigate, and respond to threats using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections.
This course is not SC-900. SC-900 is an optional security, compliance, and identity fundamentals primer only. Start here when you are ready to configure SOC tooling, respond to incidents, and hunt with KQL.
Course Objectives
What you will be able to configure, investigate, and hunt.
01
Configure the SOC environment
Defender XDR and Sentinel automation, roles, workbooks, retention, connectors, and detections (40 to 45%).
02
Respond to incidents
Investigate and remediate across Defender XDR, Defender for Endpoint, Entra ID, Purview, Defender for Cloud Apps, and Sentinel (35 to 40%).
03
Hunt with KQL
Advanced Hunting, Sentinel hunting queries, Sentinel Graph, KQL jobs in Data lake, summary rule tables, and notebooks (20 to 25%).
04
Public exam map
Skills measured as of 28 July 2026 with public logistics only, with no invented question counts.
Who Should Attend
- Security operations analysts who triage, respond, hunt, and engineer detections.
- SOC analysts and defenders expanding into Microsoft Defender XDR and Microsoft Sentinel.
- People with SC-900 or equivalent Microsoft security familiarity who are ready for analyst work.
- Learners still on security vocabulary should postpone SC-200 and use SC-900 as an optional primer only.
Prerequisites
- Familiarity with Microsoft security, compliance, and identity solutions is recommended. SC-900 is not this course.
- Familiarity with Microsoft 365, Azure cloud services, and Windows, Linux, or mobile operating systems supports readiness.
- This training is for security operations analysts, not for SC-900 beginners.
- Hands-on practice with Defender XDR, Sentinel, and KQL supports SC-200 exam readiness.
Pathway Map
Nine modules mapped to Microsoft SC-200 skills as of 28 July 2026.
Skills measured: manage a security operations environment 40 to 45%, respond to security incidents 35 to 40%, and perform threat hunting 20 to 25%.
1
Toolkit and exam map
2
Defender XDR and Endpoint automation
3
Microsoft Sentinel SIEM and platform
4
Ingest data and configure detections
5
Respond in Microsoft Defender XDR
6
Defender for Endpoint response
7
Investigate Microsoft 365 activities
8
Threat hunting with Defender XDR
9
Threat hunting with Sentinel platform
Course Content
- Configure email and alert notifications, tuning, suppression, and correlation in Microsoft Defender XDR.
- Microsoft Defender for Endpoint advanced features, rule settings, custom data collection, and ASR policies.
- Automated investigation and response, automatic attack disruption, device groups, permissions, and automation levels.
- SOC environment skill area 40 to 45% begins here.
- Specify Microsoft Sentinel roles.
- Manage data retention across Analytics, Data lake, and XDR tiers.
- Create and configure workbooks. Apply SOC optimization recommendations.
- Create automation rules and playbooks in Microsoft Sentinel.
- Select and configure connectors: Windows Security Events via AMA, WEF, Syslog/CEF via AMA, Azure Policy and diagnostic settings.
- Ingest threat indicators. Create custom log tables.
- Custom detection rules with Advanced Hunting. Analytics rules (scheduled, NRT, TI, ML).
- MITRE ATT&CK coverage analysis and anomalies in Sentinel.
- Investigate and remediate with Defender for Office 365, Purview, Defender for Cloud, Defender for Cloud Apps, Entra ID, and Defender for Identity.
- Investigate Sentinel alerts and incidents. Use agentic AI including embedded Microsoft Security Copilot.
- Investigate multi-stage, multi-domain, and lateral-movement attacks.
- Case management for security incidents (response skill area 35 to 40%).
- Investigate device timelines.
- Live response and investigation packages.
- Evidence and entity investigation.
- Remediate incidents identified by automatic attack disruption.
- Investigate threats with Microsoft Purview Audit.
- Content search in Microsoft Purview eDiscovery.
- Investigate threats using Microsoft Graph activity logs.
- Microsoft 365 investigation patterns for SOC analysts.
- Identify the appropriate table for a KQL query. Identify threats with KQL.
- Create Advanced Hunting queries, interpret threat analytics.
- Create hunting graphs including blast radius.
- Analyze entity relationships with Sentinel Graph (hunting 20 to 25%).
- Create and monitor hunting queries.
- Create and manage KQL jobs in Data lake.
- Create and manage summary rule tables for querying.
- Hunt with notebooks, including connection to the Sentinel MCP Server.
Course Features
Designed for SC-200 security operations work.
Skills-measured map
Nine modules aligned to Microsoft SC-200 skills measured as of 28 July 2026.
Analyst scope
Defender XDR, Sentinel, incident response, and KQL hunting, not SC-900 fundamentals alone.
Exam logistics
Public facts only: passing score 700/1000, Pearson VUE, renewal on Microsoft Learn. No unofficial question count.
Optional primer
SC-900 remains optional. This course is for analysts who operate Microsoft SOC tooling.
Certification Exam
Prepare for the official Microsoft SC-200 exam.
SC-200 Exam Readiness
Accumentum SC-200 training prepares learners to manage a SOC environment, respond to incidents, and hunt threats for the Security Operations Analyst Associate exam.
The Microsoft Certified: Security Operations Analyst Associate exam is SC-200. Public facts: passing score 700/1000. Delivered through Pearson VUE. Certification renewal is on Microsoft Learn. This page does not state an unofficial question count.
Skills measured as of 28 July 2026: manage a security operations environment (40 to 45%). Respond to security incidents (35 to 40%). Perform threat hunting (20 to 25%).
Skills Measured
What Microsoft says SC-200 measures.
Microsoft lists the skills measured for Exam SC-200 as of October 21, 2026. Here are all 3 domains, 9 skill groups and 54 tasks in Microsoft's own wording. Our course maps a lesson or lab to each one.
Configure automation for Microsoft Defender XDR and Microsoft Sentinel
Part of Manage a security operations environment (40 to 45%)
- Configure email notifications in Microsoft Defender XDR, including incidents, actions, and threat analytics
- Configure alert notifications in Microsoft Defender XDR, including tuning, suppression, and correlation
- Configure Microsoft Defender for Endpoint advanced features
- Configure rules settings in Microsoft Defender for Endpoint
- Configure custom data collection in Microsoft Defender for Endpoint
- Configure security policies for Microsoft Defender for Endpoint, including attack surface reduction (ASR) rules
- Manage automated investigation and response capabilities in Microsoft Defender XDR
- Configure automatic attack disruption in Microsoft Defender XDR
- Configure and manage device groups, permissions, and automation levels in Microsoft Defender for Endpoint
- Create and configure automation rules in Microsoft Sentinel
- Create and configure Microsoft Sentinel playbooks
Configure the Microsoft Sentinel SIEM and platform
Part of Manage a security operations environment (40 to 45%)
- Specify Microsoft Sentinel roles
- Manage data retention for XDR and Microsoft Sentinel tables, including Analytics, Data lake, and XDR tiers
- Create and configure Microsoft Sentinel workbooks
- Optimize the Microsoft Sentinel platform, including SOC optimization recommendations
Ingest data into the Microsoft Sentinel SIEM and platform
Part of Manage a security operations environment (40 to 45%)
- Select data connectors based on data source requirements, including Windows logs and security events
- Configure collection of Windows Security events by using Windows Security Events via AMA, including data collection rules
- Plan and configure collection of Windows Security events by using Windows Event Forwarding (WEF)
- Plan and configure Syslog via AMA and Common Event Format (CEF) via AMA connectors
- Configure collection of Azure activity logs by using Azure Policy and resource diagnostic settings
- Ingest threat indicators into Microsoft Sentinel
- Create custom log tables in the workspace to store ingested data
Configure detections
Part of Manage a security operations environment (40 to 45%)
- Create custom detection rules by using Advanced Hunting in Microsoft Defender XDR
- Manage custom detection rules in Microsoft Defender XDR
- Configure and manage analytics rules in Microsoft Sentinel SIEM, including scheduled, near-real time (NRT), threat intelligence, and machine learning
- Analyze attack vector coverage by using the MITRE ATT&CK matrix
- Configure anomalies in Microsoft Sentinel
Respond to alerts and incidents in Microsoft Defender XDR
Part of Respond to security incidents (35 to 40%)
- Investigate and remediate threats by using Microsoft Defender for Office 365, including automatic attack disruption
- Investigate and remediate threats or compromised entities identified by Microsoft Purview
- Investigate and remediate alerts and incidents identified by Microsoft Defender for Cloud workload protections
- Investigate and remediate security risks identified by Microsoft Defender for Cloud Apps
- Investigate and remediate compromised identities that are identified by Microsoft Entra ID
- Investigate and remediate security alerts from Microsoft Defender for Identity
- Investigate and remediate alerts and incidents identified by Microsoft Sentinel
- Investigate incidents by using agentic AI, including embedded Microsoft Security Copilot
- Investigate complex attacks, such as multi-stage, multi-domain, and lateral movement
- Manage security incidents by using case management
Respond to alerts and incidents in Microsoft Defender for Endpoint
Part of Respond to security incidents (35 to 40%)
- Investigate device timelines
- Perform actions on the device, including live response and collecting investigation packages
- Perform evidence and entity investigation
- Investigate and remediate incidents identified by automatic attack disruption
Investigate Microsoft 365 activities to identify threats
Part of Respond to security incidents (35 to 40%)
- Investigate threats by using Microsoft Purview Audit
- Investigate threats by using Content search in Microsoft Purview eDiscovery
- Investigate threats by using Microsoft Graph activity logs
Detect threats by using Microsoft Defender XDR
Part of Perform threat hunting (20 to 25%)
- Identify the appropriate table to use in a KQL query
- Identify threats by using Kusto Query Language (KQL)
- Create Advanced Hunting queries
- Interpret threat analytics in Microsoft Defender XDR
- Create hunting graphs, including blast radius
- Analyze relationships between entities by using Sentinel Graph
Detect threats by using the Microsoft Sentinel platform
Part of Perform threat hunting (20 to 25%)
- Create and monitor hunting queries
- Create and manage KQL jobs in Data lake
- Create and manage Summary rule tables for querying
- Hunt for threats by using Notebooks, including connection to the Sentinel MCP Server
Study Plan
Turning the SC-200 outline into a plan.
Managing a security operations environment is the largest domain at 40 to 45 percent, so we start there. You connect data sources, configure Defender XDR and Sentinel, and build analytics rules and automation.
Responding to incidents comes next. We work real incident queues, investigate across endpoints, identities, email and cloud apps, and practice containment and remediation steps.
Then we spend time on threat hunting with KQL. You write queries, use hunting tools in Defender and Sentinel, and turn what you find into detections.
The final week is review. We go back through the skills outline, rerun the labs you found hardest, and use the exam sandbox.
Exam Policies
What to know before you book SC-200.
SC-200 leads to Microsoft Certified: Security Operations Analyst Associate. Microsoft requires a score of 700 or greater to pass.
Microsoft notes that the bullets under each skill show how a skill is assessed, and related topics may also be covered. Most questions cover features that are generally available, but the exam can include Preview features if they are commonly used.
Before test day you can try the exam sandbox to see the exam interface. If you use assistive devices or need extra time, Microsoft lets you request an accommodation. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Microsoft associate certifications expire annually. You renew by passing a free online assessment on Microsoft Learn, and we show you how to keep SC-200 current.
Career Outlook
Where SC-200 can take you.
SC-200 is built for SOC work. Job posts that ask for it use titles like SOC analyst, security operations analyst, incident responder, threat hunter and detection engineer. The work is triaging alerts, investigating and responding to incidents in Microsoft Defender XDR and Microsoft Sentinel, writing KQL, and hunting for threats before they turn into incidents.
For a sense of pay, BLS puts the May 2025 median annual wage for information security analysts at $129,180. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. A median is the midpoint, so half earned more and half earned less, and your own pay will depend on location, experience and employer. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for SC-200 training.
Accumentum is an Army CA and Air Force COOL Approved Vendor. If you're serving, start with your education center and read our Army CA and Air Force COOL pages for the steps. We'll help you line up the course with your request.
Paying on your own? Our funding page covers every way to pay, and PathPay lists the courses that qualify for monthly plans.
Our funding page has every other option, and you can always talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
SC-200 Security Operations Analyst training with Accumentum: scope, audience, skills measured, and public exam facts.
No. This is SC-200 Security Operations Analyst Associate training. SC-900 is not this course. SC-900 is an optional primer only.
Security operations analysts. SOC defenders expanding into Defender XDR and Sentinel. And people with SC-900 or equivalent. Postpone if you are still on security vocabulary.
Configure Defender XDR and Sentinel automation, ingest data and detections, respond across Defender and Microsoft 365, and hunt with KQL, Sentinel Graph, Data lake jobs, and notebooks.
Nine modules: toolkit and exam map, Defender automation, Sentinel platform, ingest and detections, Defender XDR incidents, Defender for Endpoint response, Microsoft 365 investigation, hunting with Defender XDR, and hunting with Sentinel.
As of 28 July 2026: SOC environment 40 to 45%, incident response 35 to 40%, threat hunting 20 to 25%.
Exam SC-200. Passing score 700/1000. Pearson VUE. Renewal on Microsoft Learn.
No. This page uses public exam facts only and does not state an unofficial question count.
Use Accumentum registration for SC-200 training dates and enrollment support.
Microsoft requires a score of 700 or greater to pass.
Microsoft lists these domains:
- Manage a security operations environment, 40 to 45%
- Respond to security incidents, 35 to 40%
- Perform threat hunting, 20 to 25%
Manage a security operations environment is the largest at 40 to 45%. We give it the most lab time.
Microsoft lists 54 tasks across 9 skill groups as of October 21, 2026. Our course covers all of them.
Microsoft associate certifications expire annually. You renew by passing a free online assessment on Microsoft Learn, and we show you how to keep SC-200 current.
Yes. Microsoft offers an exam sandbox that shows you the exam interface and question types.
Accumentum is an Army CA and Air Force COOL Approved Vendor. Start with your education center, and we'll help you with the rest.
Microsoft says most questions cover generally available features, but Preview features can appear if they are commonly used.
Enrollment
Enroll in Microsoft SC-200 Security Operations Analyst Certification Training with Accumentum.
Enroll in Accumentum’s Microsoft SC-200 Security Operations Analyst Certification Training Course to prepare for the Security Operations Analyst Associate exam. For course dates and enrollment support, visit Accumentum’s registration page linked below.
Prepare for SC-200 security operations work.
Manage the SOC environment, respond to incidents, and hunt threats. Not SC-900. Optional primer only.