Microsoft Security Certification Path: SC-900 to SC-300

The Microsoft security certification path starts with SC-900 (fundamentals, $99). It then splits into role-based associate exams at $165 each: SC-200 for security operations, SC-300 for identity, SC-401 for information protection and AZ-500 for Azure infrastructure security. It ends at SC-100, the Cybersecurity Architect expert certification. You don’t need all of them. Most people need SC-900 and one associate exam that matches their job.

Most people need SC-900 and the one associate exam that matches the job, not the whole ladder.

The Path at a Glance

Level	Exam	Certification	US price	Who it’s for
Fundamentals	SC-900	Security, Compliance, and Identity Fundamentals	$99	Anyone new to Microsoft security, including non-technical roles
Associate	SC-200	Security Operations Analyst	$165	SOC analysts, incident responders, threat hunters
Associate	SC-300	Identity and Access Administrator	$165	Identity admins, Entra ID owners
Associate	SC-401	Information Security Administrator	$165	Data protection and compliance admins (Purview)
Associate	AZ-500	Azure Security Engineer	$165	Engineers securing Azure workloads
Expert	SC-100	Cybersecurity Architect	$165	Security architects (requires an associate cert)

Prices are US list prices and vary by country. Microsoft is also rolling out SC-500 as the AI-era successor to AZ-500. If Azure workload security is your track, check which exam is current before you start.

SC-900: The Starting Point

SC-900 covers security, compliance and identity concepts across Microsoft’s cloud: Zero Trust, Microsoft Entra ID, Defender and Purview. It explains what each product is for rather than how to configure it, and it never expires.

Take it if you are new to Microsoft security, or you work alongside security teams as a project manager, analyst, salesperson or customer-facing engineer and need the vocabulary. Skip it if you already administer Entra ID or Defender every day. Go straight to the associate exam.

It plays the same role in security that AZ-900 plays in Azure. See our guide to AZ-900 in 2026 if you are deciding between the two.

SC-200: Security Operations Analyst

SC-200 is for people who triage alerts and investigate incidents. It covers Microsoft Defender XDR (endpoints, identities, email and cloud apps), Microsoft Sentinel as the SIEM, Defender for Cloud, and threat hunting with KQL (Kusto Query Language).

• Format: roughly 40 to 60 questions, about 100 minutes, 700/1,000 to pass. Includes case studies.
• Hardest part: KQL. If you can’t write a query that joins sign-in logs to device events, practice that first.
• Best for: SOC tier 1 to 2 analysts, sysadmins moving into security, and anyone running Sentinel.

SC-300: Identity and Access Administrator

SC-300 covers Microsoft Entra ID (formerly Azure AD) end to end: user and group lifecycle, hybrid identity with on-premises Active Directory, authentication methods and MFA, Conditional Access, Privileged Identity Management, access reviews and app registrations.

Identity is now the main security boundary for most organizations, which is why SC-300 is one of the most requested associate security certifications. If your organization has had a credential-theft incident, this is the certification closest to preventing the next one.

Take the exam that matches the work you already do.

SC-200 vs SC-300: Which First?

If your day is mostly…	Take
Watching alerts, investigating incidents, writing detections	SC-200
Managing users, MFA, Conditional Access, SSO and privileged access	SC-300
Labeling data, DLP policies, eDiscovery, insider risk	SC-401
Securing Azure subscriptions, networks, Key Vault and workloads	AZ-500 (or its successor)
Designing the overall security strategy	One of the above, then SC-100

SC-100 is a design exam. You also need a qualifying associate cert to earn the expert credential.

SC-100: Cybersecurity Architect Expert

SC-100 is a design exam. It tests Zero Trust strategy, security operations design, identity and data strategy, and how to apply frameworks such as the Microsoft Cybersecurity Reference Architectures. To earn the expert certification, you must also hold one of the qualifying associate certifications, such as SC-200, SC-300, SC-401 or AZ-500.

Renewal

Associate and expert certifications are valid for one year. You renew them for free by passing an online assessment on Microsoft Learn in the six months before expiry. Fundamentals certifications such as SC-900 don’t expire.

How StormWind Studios Approaches Microsoft Security

StormWind teaches the full path live: SC-900 Security, Compliance and Identity Fundamentals, SC-200 Security Operations Analyst, SC-300 Identity and Access Administrator and SC-100 Cybersecurity Architect. Instructors are working security practitioners who teach from real Sentinel and Entra tenants, not slides.

If you are comparing vendor-neutral and Microsoft options, our guide to the best cybersecurity certifications in 2026 shows where the SC exams fit alongside CISSP, CISM and Security+.

Frequently Asked Questions

What is the Microsoft security certification path?
SC-900 (fundamentals), then one or more role-based associate exams (SC-200, SC-300, SC-401 or AZ-500), then SC-100 (Cybersecurity Architect Expert).

How much do Microsoft security exams cost?
In the US, SC-900 is $99 and associate and expert exams such as SC-200, SC-300 and SC-100 are $165. Prices vary by country.

Should I take SC-200 or SC-300 first?
Take the one that matches your job. SC-200 is for security operations and incident response. SC-300 is for identity and access management.

Do I need SC-900 before SC-200?
No, there are no prerequisites. SC-900 is useful if you are new to Microsoft security.

How do I renew a Microsoft security certification?
Associate and expert certifications renew every year through a free online assessment on Microsoft Learn. SC-900 doesn’t expire.

Is SC-200 hard?
It’s an intermediate exam. The most common difficulty is hands-on KQL querying in Sentinel and Defender, so lab time matters more than reading.