Microsoft Security Certifications: SC-100, SC-200, SC-300

Microsoft retired the AZ-500 exam and the Azure Security Engineer Associate certification on 31 August 2026, and updated SC-100, SC-200 and SC-300 in October 2026, so many study plans built around the familiar four exams are now out of date. This guide sets out what Microsoft Learn itself publishes about its security certification track: SC-100, SC-200 and SC-300, the retired AZ-500, the new SC-500 cloud and AI security exam that now appears in the SC-100 prerequisites, and SC-401 for information security in Microsoft 365. It covers skills measured with weightings and their dates, formats, prerequisites, pricing, the free annual renewal and the retake rules, then gives a preparation plan and a route through the track. It is written for security operations, identity and cloud engineers and the managers who fund their training. Facts are as published on Microsoft Learn and checked on 24 October 2026; skills outlines change often, so confirm on the linked study guides before you book.

Key takeaways

AZ-500 is gone. Microsoft Learn states that the Azure Security Engineer Associate certification, its exam and its renewal assessments were retired on 31 August 2026, and that it can no longer be earned or renewed.
SC-500 now sits in its place in the expert route. The Cybersecurity Architect Expert prerequisites list the Cloud and AI Security Engineer Associate (exam SC-500) alongside SC-200 and SC-300; Microsoft's pages do not call it a direct replacement for AZ-500.
Outlines changed in October 2026. SC-100 and SC-200 skills are measured as of 21 October 2026, and SC-300 and SC-401 as of 28 October 2026; the English exam changes first and other languages follow about eight weeks later.
The passing score is 700 and pricing is local. Every study guide checked gives 700 or greater, and Microsoft prices exams by the country or region in which they are proctored.
Renewal is free and annual. Associate, expert and specialty certifications expire after a year unless you pass a free, unproctored, open-book online assessment in the six months before expiry.

Who the certification is for

Microsoft's security certifications are role-based: each one maps to a job and tests the Microsoft products used in it. They suit people who work in Microsoft-centred estates, and they are often requested by employers and partners that run Microsoft Defender, Sentinel and Entra.

Exam	Certification	Level	Best fit	Status (24 Oct 2026)
SC-200	Microsoft Certified: Security Operations Analyst Associate	Intermediate	SOC analysts, incident responders, threat hunters using Defender XDR and Sentinel	Current; outline as of 21 Oct 2026
SC-300	Microsoft Certified: Identity and Access Administrator Associate	Intermediate	Identity engineers running Entra ID, Conditional Access, governance and workload identities	Current; outline as of 28 Oct 2026
SC-500	Microsoft Certified: Cloud and AI Security Engineer Associate	Intermediate	Cloud security engineers securing Azure, hybrid and AI workloads	Current; practice assessment not yet available when checked
SC-401	Microsoft Certified: Information Security Administrator Associate	Intermediate	Data protection and compliance administrators in Microsoft 365	Current; outline as of 28 Oct 2026
SC-100	Microsoft Certified: Cybersecurity Architect Expert	Expert	Security architects designing across operations, identity, infrastructure, applications and data	Current; outline as of 21 Oct 2026
AZ-500	Microsoft Certified: Azure Security Engineer Associate	Intermediate	Was: Azure platform security engineers	Retired 31 Aug 2026; cannot be earned or renewed

Good fit: practitioners who operate Microsoft security tools daily and want evidence of product depth. See the Microsoft 365 Security Guide and the Microsoft Azure Security Guide.
Weaker fit: roles that need vendor-neutral breadth, such as governance, audit or multi-cloud architecture. See the Cybersecurity Certifications Guide.

Exam format and domains

Format

Item	What Microsoft Learn publishes
Duration	100 minutes for SC-200, SC-300 and SC-401; 120 minutes for SC-500 (from each certification page)
Delivery	Proctored through Pearson VUE, and may include interactive components; an exam sandbox demo is available
Passing score	700 or greater
Price	Based on the country or region in which the exam is proctored, subject to change and excluding taxes
Content	Mostly generally available features; Preview features may appear if commonly used
Language timing	English is updated first; localised versions follow about eight weeks later, not guaranteed
Extra time	You can request an additional 30 minutes if the exam is not offered in your preferred language
Account	Microsoft recommends registering with a personal Microsoft account, because records tied to a work or school account are lost if you leave that organisation

Skills measured and weightings

Exam	Skills measured as of	Skill areas and weightings
SC-200	21 October 2026	Manage a security operations environment 40-45%; Respond to security incidents 35-40%; Perform threat hunting 20-25%
SC-300	28 October 2026	Implement and manage user identities 20-25%; Implement authentication and access management 25-30%; Plan and implement workload identities 20-25%; Plan and automate identity governance 20-25%
SC-500	Not stated on the study guide (page last updated May 2026)	Manage identity, access, and governance 20-25%; Secure storage, databases, and networking 25-30%; Secure compute 20-25%; Manage and monitor security posture 20-25%
SC-401	28 October 2026	Implement information protection 30-35%; Implement data loss prevention and retention 30-35%; Manage risks, alerts, and activities 30-35%
SC-100	21 October 2026	Design solutions that align with security best practices and priorities 20-25%; Design security operations, identity, and compliance capabilities 25-30%; Design security solutions for infrastructure 25-30%; Design security solutions for applications and data 20-25%
AZ-500 (retired)	22 January 2026	Secure identity and access 15-20%; Secure networking 20-25%; Secure compute, storage, and databases 20-25%; Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel 30-35%

What each exam actually covers

SC-200: automation for Microsoft Defender XDR and Microsoft Sentinel, configuring and ingesting data into the Sentinel SIEM and platform, detections, responding to incidents in Defender XDR and Defender for Endpoint, investigating Microsoft 365 activity, and hunting in both Defender XDR and Sentinel. The October 2026 change was minor and limited to data ingestion. See the Microsoft Sentinel Guide and the KQL for Threat Hunting Guide.
SC-300: Entra tenants, external and hybrid identities, authentication, Conditional Access, Entra ID Protection, Global Secure Access, workload identities and app registrations, Defender for Cloud Apps, entitlement management, access reviews, privileged access and identity logs and workbooks. See the Conditional Access Guide and the Privileged Identity Management (PIM) Guide.
SC-500: Entra ID and Azure Key Vault for access, secrets and keys, governance for compliance, storage, database and network security, security for AI, servers and application platform services, Defender for Cloud posture, Sentinel event collection and Microsoft Security Copilot. Its scope covers much of the old AZ-500 and adds AI. See the Azure OpenAI and Azure AI Foundry Security Guide.
SC-100: design against the Microsoft Cybersecurity Reference Architectures, the Microsoft Cloud Security Benchmark, the Cloud Adoption Framework and the Azure Well-Architected Framework, ransomware resiliency, security operations, identity, privileged access, compliance, multicloud posture, endpoints, SaaS, PaaS and IaaS, Security Service Edge, Microsoft 365, applications and data.

Where identity fits: SC-300 has a full skill area, 20-25%, on workload identities: managed identities, service principals, app registrations and enterprise application consent. These non-human identities are where many Entra incidents start, as in the Storm-1283 OAuth apps abuse, where hijacked app identities ran cryptomining in Azure. See the Entra ID Applications and Consent Guide and the Azure RBAC and Service Principals Guide.

How the track maps to NIST CSF 2.0

This mapping is ours, not Microsoft's.

Exam	NIST CSF 2.0 outcomes most exercised
SC-200	DE.CM-01 and DE.CM-09 monitoring; DE.AE-02 analysis of adverse events; RS.AN-03 incident analysis and root cause
SC-300	PR.AA-01 identities and credentials managed; PR.AA-05 least privilege and separation of duties
SC-500	PR.AA-05; PR.DS-01 data at rest; PR.IR-01 networks protected; PR.PS-01 configuration management
SC-401	PR.DS-01 and PR.DS-02 data at rest and in transit
SC-100	GV.OC-03 legal and regulatory requirements, plus design across all of the above

Prerequisites and experience

Associate exams: SC-200, SC-300, SC-401 and SC-500 have no formal prerequisites.
SC-200 recommended familiarity: Microsoft security, compliance and identity solutions, Microsoft 365, Azure, AI agents and Copilots, and Windows, Linux and mobile operating systems.
SC-300 recommended familiarity: Azure, Microsoft 365 services, Active Directory Domain Services, PowerShell and Kusto Query Language.
SC-500 recommended experience: administering Azure and hybrid compute, network and storage, strong familiarity with Entra ID and familiarity with Microsoft 365 administration.
SC-100 prerequisite: to receive the Cybersecurity Architect Expert certification you must also hold at least one of the Identity and Access Administrator Associate, Security Operations Analyst Associate or Cloud and AI Security Engineer Associate. AZ-500 no longer appears in that list, so check how your existing credentials count before you plan the expert route.

Preparation plan

Choose the exam by role (week 0): operations to SC-200, identity to SC-300, cloud platform to SC-500, data protection to SC-401. Plan SC-100 only once you hold or are close to one qualifying associate.
Read the study guide change log (week 1): each study guide shows what changed and on which date. Discard any course or practice test that predates the current outline; for AZ-500 material, keep only what maps to the SC-500 areas.
Build a lab tenant (week 1): use a trial or developer tenant and an Azure subscription you control. Keep it separate from production, because exam practice involves creating risky policies and test identities.
Work through the heaviest area first (weeks 2 to 4): for SC-200 that is managing the operations environment at 40-45%: connect data sources to Sentinel, write analytics rules and automation, and tune Defender XDR. For SC-300, Conditional Access and authentication at 25-30%: build policies in report-only mode before enforcing them.
Cover the remaining areas with hands-on tasks (weeks 5 to 6): for every subsection heading in the study guide, complete one task in the lab and note the portal blade, the PowerShell or Graph command, and the log that records it.
Practise under exam conditions (week 7): use the free Microsoft Learn practice assessment where offered, then timed runs at 100 or 120 minutes. Try the exam sandbox to learn the interface.
Book, and set a renewal reminder: after passing, note the expiry date and diarise the six-month renewal window.

Measuring readiness

Weighting-adjusted scores: practice scores at or above target in the two heaviest skill areas.
Lab coverage: a completed task for every subsection heading in the study guide.
Query fluency: for SC-200, you can write KQL joins and summarise operators from memory.
Change log check: your material matches the skills measured date on the study guide.

Small vs large organisations: in small organisations one person often covers SOC, identity and cloud, so SC-500 or SC-200 may be the most useful single credential. Large organisations usually split the work, and the associate exam that matches each team gives a clearer signal; SC-100 then fits architects who coordinate across them.

Cost, renewal and continuing education

Item	Rule (Microsoft Learn, checked October 2026)
Exam price	Varies by country or region; shown when you schedule
Validity	Associate, expert and specialty certifications expire annually; Fundamentals do not expire
Renewal	Free online assessment on Microsoft Learn: short, unproctored and open book, focused on recent technology updates
Renewal window	Opens six months before expiry; passing extends the certification one year from the expiry date
Renewal retakes	Unlimited before expiry: retry immediately, then wait 24 hours after the second attempt
If it expires	Earn it again by passing the required exam; there is no alternative renewal path
Retired certifications	Cannot be renewed; AZ-500 renewal assessments were retired on 31 August 2026
Exam retakes	24 hours after the first failure, then 14 days between later attempts; at most five attempts in 12 months

The annual renewal assessment tracks product change, so the cost of staying certified is a few hours a year rather than continuing education credits. The flip side is that a certification lapses quickly if you miss the window.

Common failure patterns

Studying for AZ-500 after August 2026: the exam no longer exists. Move to SC-500 and check its AI and Security Copilot content.
Using stale outlines: SC-100, SC-200 and SC-300 changed in October 2026, and non-English versions lag by about eight weeks, so material and exam language must match.
Registering with a work account: exam history tied to an organisational account is lost when you leave; use a personal Microsoft account.
Enforcing Conditional Access without report-only testing: a habit that costs marks in SC-300 and causes lockouts in production.
Treating hybrid identity as legacy: SC-300 still tests hybrid identity, and the Storm-0501 attacks show how stolen Entra Connect Sync credentials carried attackers from on-premises into the cloud.
Missing the renewal window: the free path closes at expiry, after which you pay to sit the full exam again.

Where it fits on the career path

Entry: general security grounding and Microsoft 365 or Azure administration experience. See the Cybersecurity Careers Guide.
SOC route: SC-200, then detection engineering depth. See the SOC Analyst Career Guide.
Identity route: SC-300, often followed by SC-100. See the IAM Engineer Career Guide and the Entra ID Security Guide.
Cloud route: SC-500, with a vendor-neutral credential for breadth. See the Cloud Security Engineer Career Guide and the CCSP Certification Guide.
Architecture: SC-100 on top of one associate. See the Security Architect Career Guide.

Microsoft does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates.

Practitioner checklist

Pick the associate exam that matches your role and confirm it is current on Microsoft Learn.
Open the study guide, note the skills measured date and read the change log.
Replace any AZ-500 plan with SC-500 and confirm which associates satisfy the SC-100 prerequisite.
Register with a personal Microsoft account, not a work or school account.
Build a separate lab tenant and complete one hands-on task per study guide subsection.
Start with the heaviest skill area and test Conditional Access in report-only mode.
Take the free practice assessment and the exam sandbox before booking.
Diarise the six-month renewal window and complete the free assessment well before expiry.

Microsoft Security Certifications Guide: SC-100, SC-200, SC-300 and SC-500