HanuxLearning
Loading…
Have a voucher code? Redeem it and reserve your seat
Grab your voucher →HanuxLearning
Loading…
Training and Exam prep - the job-role certification for detecting and responding to threats with Microsoft Defender and Sentinel.
Group Enrollment with Friends or Colleagues | Get a quote
Microsoft Security Operations Analyst (SC-200) is Microsoft's job-role certification for security operations. It proves you can detect, investigate, hunt and respond to threats using Microsoft Defender XDR (across endpoints, identities, email and cloud apps), Microsoft Defender for Cloud, and Microsoft Sentinel - Microsoft's cloud SIEM/SOAR - including writing queries in Kusto Query Language (KQL). The exam has about 40 to 60 questions and can include case studies. It is graded on a scaled score: you need 700 on a scale of 1 to 1000 to pass. Because scoring is weighted, 700 does not mean 70% of questions correct. The exam costs about US$165 (varies by region) and is delivered through Pearson VUE. There is no formal prerequisite, but Microsoft recommends experience with security operations and Microsoft security technologies.
Security operations centre (SOC) roles are in high demand as organisations face constant threats. SC-200 proves you can detect and respond to attacks with Microsoft Defender and Sentinel, supports SOC analyst and incident responder roles, and completes a Microsoft security career alongside identity (SC-300) and information protection (SC-401). As a job-role credential it carries real weight with employers - and Microsoft's free annual renewal keeps it current at no ongoing cost.
Source: Glassdoor
Source: Indeed
Annual Salary
Source: Glassdoor
Hiring Companies
Source: Indeed
Batch starting from:
SC-200 has no formal prerequisite, but it is an Associate-level, hands-on certification. It is ideal for: - SC-900 graduates specialising in security operations - SOC analysts and incident responders - IT and security staff using Microsoft Defender and Sentinel - Anyone moving into threat detection and response Microsoft recommends experience with security operations and Microsoft security technologies. If you are new to security, start with SC-900.
How to earn it:
1. Prepare with an SC-200 exam-prep course (self-paced, with labs) - that is what we provide.
2. Register through Microsoft Learn and schedule the exam through Pearson VUE - online with remote proctoring, or at a test centre.
3. Pass the exam: about 40-60 quest...
The Microsoft Security Operations Analyst (SC-200) certification validates your ability to investigate, detect, respond to, and manage cybersecurity threats across Microsoft security environments. The exam assesses your knowledge of Microsoft Defender solutions, Microsoft Sentinel, threat detection, incident response, security monitoring, and the investigation of security alerts and incidents. Understanding the exam structure and certification requirements can help you plan your preparation effectively and build confidence before the assessment. This section explains the exam pattern, question format, duration, certification requirements, and other important details you should know before taking the Microsoft Security Operations Analyst (SC-200) exam.
Exam details verified on 12 August 2026. Microsoft uses a scaled score (700/1000 to pass), which is not the same as 70% correct. SC-200 is a role-based Associate certification: valid for one year and renewed free through a short online assessment on Microsoft Learn (not lifetime like the Fundamentals). You register through Microsoft Learn; the exam is delivered through Pearson VUE. Confirm current details at learn.microsoft.com (search "SC-200").
SC-200 is ideal for: - SC-900 graduates specialising in security operations - SOC analysts and incident responders - IT and security staff using Microsoft Defender and Sentinel Security operations experience is recommended. If you are new to security, start with SC-900. SC-200 is one of three Microsoft security-role Associate certifications - with Identity & Access Administrator (SC-300) and Information Security Administrator (SC-401).
