SC-200
Microsoft Certified: Security Operations Analyst Associate (exam SC-200) · Microsoft
SC-200 proves you can run security operations with Microsoft tools: Defender XDR, Microsoft Sentinel and the related services, from data ingestion to incident response and threat hunting. Given how many French organisations use Microsoft 365 and Azure, it is very practical for SOC analysts and MSSPs. Its strength is immediate applicability; its limit is that it is tied to one vendor’s ecosystem and has to be renewed every year.
- Exam
- About 40 to 60 questions (exact number not published) in 100 minutes, pass mark 700/1,000. Microsoft Learn can be consulted during the exam. English version updated on 21 October 2026.
- Exam price
- $165US price, excluding tax. The price depends on the country: €126 excluding VAT in France.
- Required experience
- No prerequisite. Microsoft expects familiarity with its security, compliance and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux and mobile systems.
- Validity and maintenance
- Valid 12 months. Renew for free by passing an online, unproctored assessment on Microsoft Learn, open in the six months before expiry.
- Format
- Multiple choice
Who is it for?
SOC analysts, incident responders and MSSP engineers working with Microsoft Defender and Sentinel, from junior to confirmed level.
Domains covered
- Manage a security operations environment: 40-45%
- Respond to security incidents: 35-40%
- Perform threat hunting: 20-25%
Belinda’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
