- Security operations analyst toolkit across Defender XDR and Sentinel.
- Map of SC-200 skills measured as of 28 July 2026.
- How this course differs from SC-900 and where an optional primer fits.
- Exam logistics: passing score 700/1000, Pearson VUE, Microsoft Learn renewal.
Microsoft Security Operations Analyst (SC-200)
Microsoft SC-200 Security Operations Analyst Certification Training Course
Triage incidents, hunt threats, and engineer detections with Microsoft Defender XDR, Microsoft Sentinel, and KQL — the Security Operations Analyst Associate (SC-200) work.
Course focus: Microsoft Defender XDR and Defender for Endpoint automation, Microsoft Sentinel SIEM configuration and data ingestion, analytics and custom detections, incident response across Defender and Microsoft 365, and threat hunting with KQL, Sentinel Graph, and notebooks.
Course Overview
Reduce organizational risk with Microsoft security operations — not SC-900 vocabulary alone.
Accumentum’s Microsoft SC-200 Security Operations Analyst Certification Training Course prepares security operations analysts to monitor, investigate, and respond to threats using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections.
This course is not SC-900. SC-900 is an optional security, compliance, and identity fundamentals primer only. Start here when you are ready to configure SOC tooling, respond to incidents, and hunt with KQL.
Course Objectives
What you will be able to configure, investigate, and hunt.
01
Configure the SOC environment
Defender XDR and Sentinel automation, roles, workbooks, retention, connectors, and detections (40–45%).
02
Respond to incidents
Investigate and remediate across Defender XDR, Defender for Endpoint, Entra ID, Purview, Defender for Cloud Apps, and Sentinel (35–40%).
03
Hunt with KQL
Advanced Hunting, Sentinel hunting queries, Sentinel Graph, KQL jobs in Data lake, summary rule tables, and notebooks (20–25%).
04
Public exam map
Skills measured as of 28 July 2026 with public logistics only — no invented question counts.
Who Should Attend
- Security operations analysts who triage, respond, hunt, and engineer detections.
- SOC analysts and defenders expanding into Microsoft Defender XDR and Microsoft Sentinel.
- People with SC-900 or equivalent Microsoft security familiarity who are ready for analyst work.
- Learners still on security vocabulary should postpone SC-200 and use SC-900 as an optional primer only.
Prerequisites
- Familiarity with Microsoft security, compliance, and identity solutions is recommended; SC-900 is not this course.
- Familiarity with Microsoft 365, Azure cloud services, and Windows, Linux, or mobile operating systems supports readiness.
- This training is for security operations analysts, not for SC-900 beginners.
- Hands-on practice with Defender XDR, Sentinel, and KQL supports SC-200 exam readiness.
Pathway Map
Nine modules mapped to Microsoft SC-200 skills as of 28 July 2026.
Skills measured: manage a security operations environment 40–45%; respond to security incidents 35–40%; perform threat hunting 20–25%.
1
Toolkit and exam map
2
Defender XDR and Endpoint automation
3
Microsoft Sentinel SIEM and platform
4
Ingest data and configure detections
5
Respond in Microsoft Defender XDR
6
Defender for Endpoint response
7
Investigate Microsoft 365 activities
8
Threat hunting with Defender XDR
9
Threat hunting with Sentinel platform
Course Content
- Configure email and alert notifications, tuning, suppression, and correlation in Microsoft Defender XDR.
- Microsoft Defender for Endpoint advanced features, rule settings, custom data collection, and ASR policies.
- Automated investigation and response, automatic attack disruption, device groups, permissions, and automation levels.
- SOC environment skill area 40–45% begins here.
- Specify Microsoft Sentinel roles.
- Manage data retention across Analytics, Data lake, and XDR tiers.
- Create and configure workbooks; apply SOC optimization recommendations.
- Create automation rules and playbooks in Microsoft Sentinel.
- Select and configure connectors: Windows Security Events via AMA, WEF, Syslog/CEF via AMA, Azure Policy and diagnostic settings.
- Ingest threat indicators; create custom log tables.
- Custom detection rules with Advanced Hunting; analytics rules (scheduled, NRT, TI, ML).
- MITRE ATT&CK coverage analysis and anomalies in Sentinel.
- Investigate and remediate with Defender for Office 365, Purview, Defender for Cloud, Defender for Cloud Apps, Entra ID, and Defender for Identity.
- Investigate Sentinel alerts and incidents; use agentic AI including embedded Microsoft Security Copilot.
- Investigate multi-stage, multi-domain, and lateral-movement attacks.
- Case management for security incidents (response skill area 35–40%).
- Investigate device timelines.
- Live response and investigation packages.
- Evidence and entity investigation.
- Remediate incidents identified by automatic attack disruption.
- Investigate threats with Microsoft Purview Audit.
- Content search in Microsoft Purview eDiscovery.
- Investigate threats using Microsoft Graph activity logs.
- Microsoft 365 investigation patterns for SOC analysts.
- Identify the appropriate table for a KQL query; identify threats with KQL.
- Create Advanced Hunting queries; interpret threat analytics.
- Create hunting graphs including blast radius.
- Analyze entity relationships with Sentinel Graph (hunting 20–25%).
- Create and monitor hunting queries.
- Create and manage KQL jobs in Data lake.
- Create and manage summary rule tables for querying.
- Hunt with notebooks, including connection to the Sentinel MCP Server.
Course Features
Designed for SC-200 security operations work.
Skills-measured map
Nine modules aligned to Microsoft SC-200 skills measured as of 28 July 2026.
Analyst scope
Defender XDR, Sentinel, incident response, and KQL hunting — not SC-900 fundamentals alone.
Exam logistics
Public facts only: passing score 700/1000, Pearson VUE, renewal on Microsoft Learn. No unofficial question count.
Optional primer
SC-900 remains optional. This course is for analysts who operate Microsoft SOC tooling.
Certification Exam
Prepare for the official Microsoft SC-200 exam.
SC-200 Exam Readiness
Accumentum SC-200 training prepares learners to manage a SOC environment, respond to incidents, and hunt threats for the Security Operations Analyst Associate exam.
The Microsoft Certified: Security Operations Analyst Associate exam is SC-200. Public facts: passing score 700/1000; delivered through Pearson VUE; certification renewal is on Microsoft Learn. This page does not state an unofficial question count.
Skills measured as of 28 July 2026: manage a security operations environment (40–45%); respond to security incidents (35–40%); perform threat hunting (20–25%).
Frequently Asked Questions
SC-200 Security Operations Analyst training with Accumentum: scope, audience, skills measured, and public exam facts.
No. This is SC-200 Security Operations Analyst Associate training. SC-900 is not this course. SC-900 is an optional primer only.
Security operations analysts; SOC defenders expanding into Defender XDR and Sentinel; and people with SC-900 or equivalent. Postpone if you are still on security vocabulary.
Configure Defender XDR and Sentinel automation, ingest data and detections, respond across Defender and Microsoft 365, and hunt with KQL, Sentinel Graph, Data lake jobs, and notebooks.
Nine modules: toolkit and exam map; Defender automation; Sentinel platform; ingest and detections; Defender XDR incidents; Defender for Endpoint response; Microsoft 365 investigation; hunting with Defender XDR; hunting with Sentinel.
As of 28 July 2026: SOC environment 40–45%, incident response 35–40%, threat hunting 20–25%.
Exam SC-200. Passing score 700/1000. Pearson VUE. Renewal on Microsoft Learn.
No. This page uses public exam facts only and does not state an unofficial question count.
Use Accumentum registration for SC-200 training dates and enrollment support.
Enrollment
Enroll in Microsoft SC-200 Security Operations Analyst Certification Training with Accumentum.
Enroll in Accumentum’s Microsoft SC-200 Security Operations Analyst Certification Training Course to prepare for the Security Operations Analyst Associate exam. For course dates and enrollment support, visit Accumentum’s registration page linked below.
Prepare for SC-200 security operations work.
Manage the SOC environment, respond to incidents, and hunt threats. Not SC-900. Optional primer only.