Microsoft security certification refers to the role-based validation of skills across Microsoft Defender, Microsoft Sentinel, Microsoft Entra and Microsoft Purview, where security operations, identity, endpoint protection and compliance tooling are now consolidated.
The SC certification family is Microsoft’s role-based path for security, compliance and identity skills. In 2026, the most useful way to understand the tracks is not as four isolated exams, but as four views of the same operating environment: fundamentals, security operations, identity administration and information protection.
Published: 2026. Last updated: 2026. This update reflects current Microsoft product naming, including Microsoft Entra ID, Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Identity, Defender for Cloud and Microsoft Purview. Microsoft Learn should still be checked before booking any exam because exam objectives and product interfaces can change over time.
Why Microsoft changed the security certification path
Microsoft’s earlier security certifications covered important ground, but they were broad. The Microsoft 365 Security Administrator Associate path spanned compliance, eDiscovery, DLP, endpoint management, identity controls and threat protection. The Microsoft Azure Security Engineer Associate path focused more heavily on Azure infrastructure security, network controls, platform protection, workload security and identity-related controls.
Those areas remain relevant, but Microsoft security work has become more specialised. A security operations analyst spends much of the day in incidents, alerts, hunting queries and response workflows. An identity administrator works with Conditional Access, privileged access, lifecycle controls and application access. A compliance or information protection practitioner works with sensitivity labels, data loss prevention, retention and insider risk signals. Microsoft Learn reflects this split by mapping the SC exams to distinct roles rather than treating security as a single broad discipline.
The product changes matter because exam preparation based on old names can become confusing quickly. Azure Sentinel is now Microsoft Sentinel. Azure Active Directory is now Microsoft Entra ID. Microsoft 365 Defender is commonly discussed through Microsoft Defender XDR, and formerly separate endpoint and identity protection tools are now part of a more integrated Defender experience. The practical skill is no longer memorising old product boundaries; it is understanding how an identity signal, endpoint alert, cloud workload issue or data event moves across the Microsoft security stack.
The SC tracks at a glance
The SC family gives Microsoft a clearer structure for security learning. SC-900 introduces the concepts and product families. SC-200 is aimed at security operations. SC-300 focuses on identity and access administration. SC-400 addresses information protection and compliance administration. Microsoft Learn describes each exam through role tasks and measured skills, which makes the role mapping more useful than a simple product list.
| Certification |
Primary role focus |
Typical work covered |
| SC-900: Security, Compliance and Identity Fundamentals |
Foundational understanding |
Core concepts across Microsoft security, compliance, identity and cloud services. |
| SC-200: Microsoft Security Operations Analyst |
Security operations |
Incident investigation, threat hunting, KQL, Microsoft Sentinel, Defender XDR and response workflows. |
| SC-300: Microsoft Identity and Access Administrator |
Identity and access |
Microsoft Entra ID, Conditional Access, privileged identity, application access and hybrid identity concepts. |
| SC-400: Microsoft Information Protection Administrator |
Information protection |
Sensitivity labels, DLP, retention, records management and Microsoft Purview compliance capabilities. |
This is also why SC-900 is useful but not mandatory for everyone. A non-security administrator, project lead or training manager may benefit from the shared vocabulary before moving deeper. A practising SOC analyst, identity administrator or compliance specialist can often start directly with the role-aligned exam that matches daily work, while using Microsoft Learn fundamentals content to fill gaps as needed.
SC-900: the foundation for security, compliance and identity language
SC-900: Security, Compliance and Identity Fundamentals is designed for people who need to understand the Microsoft security ecosystem before specialising. It covers the language of identity, access management, threat protection, compliance and cloud responsibility models at a level suitable for business, technical and early-career audiences.
The value of SC-900 is context. It helps a learner understand why Entra ID matters to security operations, why Purview matters to governance, and why Defender and Sentinel are often discussed together. From a practical perspective, it reduces the chance that later study becomes a product-name memorisation exercise rather than a coherent view of how Microsoft security controls work together.
Choosing between SC-200, SC-300, SC-400 and AZ-500
The clearest decision point is the work the person is expected to perform. SC-200 fits analysts who investigate alerts and incidents. SC-300 fits administrators who design and maintain identity controls. SC-400 fits practitioners responsible for protecting, classifying and governing information. AZ-500 sits alongside the SC track as an Azure infrastructure security path, not as a replacement for the SC certifications.
| If the role mainly involves... |
The more relevant path is usually... |
Why |
| Investigating alerts, writing KQL, tuning incidents and responding to threats |
SC-200: Microsoft Security Operations Analyst |
The work is centred on Microsoft Sentinel, Defender XDR and operational response. |
| Managing identities, access policies, privileged roles and application access |
SC-300: Microsoft Identity and Access Administrator |
The role owns policy design and administration in Microsoft Entra ID and related identity services. |
| Applying labels, DLP, retention and information governance controls |
SC-400: Microsoft Information Protection Administrator |
The work is focused on Microsoft Purview and the lifecycle of sensitive business data. |
| Securing Azure networks, workloads, platform services and cloud infrastructure controls |
AZ-500: Microsoft Azure Security Engineer Associate |
The emphasis is Azure infrastructure security rather than SOC investigation, identity administration or compliance operations. |
The boundary between SC-200 and SC-300 is especially important in real teams. Conditional Access and sign-in logs appear in both worlds, but the responsibility is different. The SC-200 perspective is to investigate suspicious sign-ins, correlate signals and understand incident impact. The SC-300 perspective is to design, implement and maintain the access policies that reduce those risks in the first place. When those responsibilities are unclear, teams can end up tuning alerts without fixing policy design, or changing access rules without enough incident context.
AZ-500 remains valuable for professionals responsible for Azure subscriptions, network security, workload protection, key management and Defender for Cloud posture. Its overlap with identity and monitoring is useful, but the emphasis is different. An Azure security engineer may need AZ-500 to secure cloud resources, while the same organisation may still need SC-200 skills in the SOC, SC-300 skills in the identity team and SC-400 skills in governance.
What changed in the tools behind the exams
Microsoft’s security platform has moved toward connected investigation and administration experiences. Microsoft Defender XDR brings signals from endpoint, identity, email and cloud apps into a more unified investigation model. Microsoft Sentinel remains the SIEM and SOAR platform for analytics, hunting, automation and cross-source correlation. Microsoft Entra ID is the identity plane for users, devices, applications and access decisions. Microsoft Purview provides much of the compliance, data protection and governance surface tested through SC-400.
This consolidation changes what effective preparation looks like. A learner preparing for SC-200 should be comfortable moving between incidents, logs, analytic rules and KQL rather than studying each portal as an isolated product. A learner preparing for SC-300 should study current Microsoft Entra admin experiences rather than relying on screenshots or instructions written for older Azure AD portal naming. A learner preparing for SC-400 should spend time with sensitivity labels, retention settings and DLP policy behaviour, because those controls are easier to understand when their effect is observed in a tenant.
Common preparation gaps in 2026
The most common study problem is preparing from outdated terminology. Candidates may understand the concept but lose time when older names such as Azure Sentinel, Azure Defender, Azure AD, Windows Defender ATP or Azure ATP appear in older articles, videos or notes. The safer approach is to map older terminology to current Microsoft naming early, then study through current Microsoft Learn exam pages and the current admin centres wherever possible.
SC-200 also has a practical gap that cannot be solved by reading alone: KQL. Security operations work depends on being able to query, filter, join, summarise and reason about log data. The exam context may not require a person to become a full-time query engineer, but weak KQL practice makes threat hunting, incident triage and Microsoft Sentinel analytics harder than they need to be.
SC-400 has a different weak spot. Learners often recognise terms such as sensitivity labels, DLP and retention, yet have not configured them closely enough to understand policy precedence, user experience and downstream effects. SC-300 has a similar issue with Conditional Access, privileged identity and app access: the concepts look straightforward until they are applied across real users, groups, devices, applications and exceptions.
How the SC certifications work together in practice
A realistic Microsoft security workflow rarely belongs to one certification only. Consider a suspicious sign-in followed by unusual file access and data sharing. The SOC analyst uses Microsoft Sentinel and Defender XDR to investigate alerts, query logs and determine whether the activity is malicious. That work aligns strongly with SC-200.
The identity team then reviews the access path. It may adjust Conditional Access, investigate risky sign-in patterns, check privileged role activation and review app consent or application access. That work fits the SC-300 role. Meanwhile, the compliance or governance practitioner may check whether sensitive information types, labels, DLP policies or retention controls handled the exposed content appropriately, which is closer to SC-400.
This is why a shared lab can be more useful than separate study notes. A practical setup ties Microsoft Sentinel, Defender and Entra to the same tenant so that alerts, identities, devices and data events can be reviewed in context. Readynez course pages for Microsoft security training reflect the same role separation, but the important learning principle is broader: hands-on practice should follow the way incidents, access decisions and data controls interact in real operations.
Building a certification path that matches the work
The right path depends on responsibility rather than seniority. Someone moving into security from administration, governance or sales engineering may start with SC-900 to build vocabulary. A SOC analyst should usually prioritise SC-200. An identity administrator should prioritise SC-300. A compliance, records or data protection practitioner should prioritise SC-400. An Azure platform security role should consider AZ-500 alongside the relevant SC track instead of treating either route as a substitute for the other.
The key takeaway is that Microsoft’s security certifications now mirror the way security work is divided across modern teams. The strongest preparation plan combines current product names, Microsoft Learn exam objectives, hands-on portal work and role-specific practice. When structured training is useful, Readynez provides focused options such as SC-200: Microsoft Security Operations Analyst, but the first decision should always be which real job responsibility the certification is meant to support.
