SC-200 prerequisites: what to know first
SC-200 has no mandatory prerequisite certification: Microsoft’s exam and certification pages list none. What it does state is that candidates should be familiar with Microsoft security, compliance and identity solutions, Microsoft 365, Azure cloud services, AI agents and Copilots, and Windows, Linux and mobile operating systems. This guide turns that list into a self-check.
The official familiarity list
| Area | What it means in practice |
|---|---|
| Security, compliance and identity solutions | Know what Defender, Entra, Purview and Sentinel are for |
| Microsoft 365 | Mailboxes, SharePoint, Teams, and the admin and audit model |
| Azure cloud services | Subscriptions, resource groups, Log Analytics workspaces, Logic Apps |
| AI agents and Copilots | What Security Copilot and agents can do and where they fit in an investigation |
| Windows, Linux and mobile operating systems | Processes, logs, services, and what suspicious activity looks like |
Skills worth having before you start
Security basics. Attack stages, common techniques such as phishing, credential theft and lateral movement, and the MITRE ATT&CK vocabulary. If these are new, the SC-900 exam is a gentle first step, though it is not required.
Identity. How sign-ins, tokens, MFA and risk signals work, because identities are the usual first target. The SC-300 exam goes deeper if you want it.
Operating systems. What normal looks like on a Windows device (processes, services, Event Log) and a Linux server (Syslog, authentication logs), so you can spot abnormal.
Cloud basics. Enough Azure to create a workspace, understand role-based access and read a Logic Apps workflow.
Query thinking. You do not need programming experience, but you do need to be comfortable with filtering and grouping data. KQL reads like a pipeline of steps, and the KQL guide covers the essentials.
Self-check
You are probably ready to start the study plan if you can:
- explain what an alert, an incident and a detection are, and how they differ;
- describe what a SIEM does that an endpoint tool does not;
- find a sign-in log entry for a user in Entra ID;
- read a short filter-and-count query and say what it returns.
If you cannot, add a week or two of fundamentals first.
Where SC-200 fits
SC-200 is an associate-level role-based exam. It is a sensible next step after SC-900, and it complements SC-500 for people who also build security controls, and SC-401 for those working with Purview and information protection. For a comparison with the engineer exam, see SC-200 vs SC-500. To decide whether it is worth your time, read is SC-200 worth it?.
Use a Microsoft 365 trial tenant and an Azure subscription to practise, and set a budget alert before you onboard Sentinel.