SC-200 for SOC analysts on Microsoft tools: what it tests and how to train

By Alexander Shick · Updated November 5, 2026

The analyst Microsoft has in mind

Microsoft describes the SC-200 candidate as a security operations analyst “who reduces organizational risk by performing triage, responding to incidents, hunting for threats, and engineering detections.” The work runs through Microsoft Defender XDR, Microsoft Sentinel, Entra ID, Purview and Defender for Cloud, with hunting done in KQL. Passing shows you can operate those tools in a security operations role; it is a product credential, so its value tracks how much of your employer's stack is Microsoft.

Experience Microsoft expects, and the exam itself

There is no formal prerequisite: no earlier exam or set years of experience is required to book SC-200. Separately, Microsoft says candidates should be familiar with Microsoft security, compliance and identity solutions, Microsoft 365, Azure cloud services, AI agents and Copilots, and Windows, Linux and mobile operating systems. The exam is proctored, lasts 100 minutes, can include interactive components, and passes at 700. Role-based exams like this one let you open Microsoft Learn during the test, though not enough time to look up every answer. The skills outline dated October 21, 2026 has three areas:

Microsoft's change log for the October 2026 outline marks the edits as minor, including to data ingestion into the Sentinel SIEM and platform. SC-200 also counts toward Microsoft's Cybersecurity Architect Expert certification (exam SC-100): Microsoft requires at least one of three associate certifications first, and Security Operations Analyst is one of them.

Training for SC-200: free paths, practice and SC-200T00

Microsoft's official course, SC-200T00 (Defend against cyberthreats with Microsoft's security operations platform), is four days and covers Defender XDR, Defender for Endpoint, Defender for Cloud, Purview, KQL and Sentinel. Its learning paths are free and self-paced on Microsoft Learn. Microsoft also offers free SC-200 exam prep videos, an exam sandbox, and a Practice Assessment: the newer version runs on AI Skills Navigator and needs a sign-in, while the legacy Microsoft Learn version is no longer updated. The free route works when you can practise in a real or trial Microsoft 365 and Azure tenant. A live class suits people who need an instructor-run lab environment; New Horizons lists lab access for up to 90 days where available.

What SC-200 costs with and without a class

Extra costs: a failed attempt means paying the full $165 again after a 24-hour wait, with a limit of five attempts in 12 months. Exam Replay bundles a voucher with one retake; Microsoft's offer page did not show its price when we read it. If you practise in your own Azure subscription, check Microsoft's pricing for any service you turn on and delete resources when you finish. Renewal itself is free.

Comparing SC-200 classes

• Voucher. Learning Tree says its $3,140 tuition includes the exam voucher. New Horizons sells it as a $165 add-on. ONLC's page does not mention one.
• Current product names. ONLC's course description still refers to Microsoft 365 Defender, the older name for Defender XDR; ask whether its labs follow the current SC-200T00 course.
• Lab access after class. New Horizons lists recordings and lab environments for up to 90 days where available. Ask the others how long you keep a Sentinel lab.
• Registration date. ONLC lists a $1,995 fee and next dates from December 7, 2026; it showed a $2,195 late price on its November 9 class, so ask whether a late price applies to the date you book.

Keeping SC-200 current

SC-200 expires 12 months after you earn it. Within a six-month window before expiry you can take a free, unproctored, open-book renewal assessment on Microsoft Learn as many times as you need; passing extends the certification by one year. Microsoft publishes a free module collection for the SC-200 renewal.

For security operations teams

For a team standardizing on Sentinel and Defender XDR, a private SC-200T00 class lets everyone use the same lab tenant and queries. Ask whether your Microsoft agreement includes training days or vouchers, and whether a provider can run the labs against a tenant configured like yours.

SC-200 questions

How much is the SC-200 exam?

$165 in the US as of November 2026.

Do I need SC-900 before SC-200?

No. Microsoft lists no prerequisite exam.

How long does SC-200 last?

12 months; the online renewal assessment is free.

Is SC-200 only about Sentinel?

No. Sentinel is central, but the exam also covers Defender XDR, Defender for Cloud, Entra ID and Purview, with hunting in KQL.

Next step

For help comparing SC-200 classes for yourself or a security team, send a short request.

Ask for help choosing SC-200 training