SC-200 vs SC-500: analyst or engineer?
Choose SC-200 if your job is watching, investigating and responding: triaging incidents in Defender XDR, writing detections in Sentinel and hunting with KQL. Choose SC-500 if your job is building the protections in the first place: securing identities, storage, networks and compute in Azure and hybrid environments, including AI workloads. Neither is a prerequisite for the other, and many security careers use both.
The two exams side by side
| SC-200 | SC-500 | |
|---|---|---|
| Exam title | Microsoft Security Operations Analyst | Implementing End-to-End Security Controls for Cloud and AI Workloads |
| Certification | Security Operations Analyst Associate | Cloud and AI Security Engineer Associate |
| Level | Associate (intermediate) | Associate (intermediate) |
| Duration | 100 minutes | 120 minutes |
| Passing score | 700 | 700 |
| Role | Security operations analyst | Security engineer |
| Core tools | Defender XDR, Sentinel, KQL | Entra, Defender for Cloud, Azure networking, storage and compute security |
| Renewal | Free, every 12 months | Free, annually |
Domains compared
| SC-200 | Weight | SC-500 | Weight |
|---|---|---|---|
| Manage a security operations environment | 40–45% | Manage identity, access, and governance | 20–25% |
| Respond to security incidents | 35–40% | Secure storage, databases, and networking | 25–30% |
| Perform threat hunting | 20–25% | Secure compute | 20–25% |
| Manage and monitor security posture | 20–25% |
SC-200 is lopsided towards two areas; SC-500 is almost flat. That changes how you revise: on SC-200 you can concentrate on the big two plus KQL, while SC-500 punishes any blind spot.
Same topic, different question
Defender for Cloud. SC-500 asks how to configure posture management and protections on workloads. SC-200 asks what to do when a Defender for Cloud workload protection raises an alert that is part of an incident.
Identity. SC-500 asks how to design access and governance so risky access cannot happen. SC-200 asks how to investigate and remediate a compromised identity flagged by Entra ID or Defender for Identity.
Logging and monitoring. SC-500 asks how to turn on the right logs. SC-200 asks how to ingest them into Sentinel, write an analytics rule over them and respond when it fires.
What SC-200 has that SC-500 does not
- KQL as a core skill, used for advanced hunting, custom detection rules and Sentinel hunting queries.
- Sentinel administration: data connectors, retention tiers, automation rules and playbooks, workbooks.
- Hands-on incident work: device timelines, live response, investigation packages, Purview Audit and eDiscovery content search.
What SC-500 has that SC-200 does not
SC-500 goes deep on preventive controls: private networking for storage and databases, securing compute, and managing identity and governance, plus the security of AI workloads. These are the areas an analyst meets as the context of an alert rather than as a configuration task.
Which one is harder?
Opinions split, and it depends on your background. SC-500 is wider and longer. SC-200 is narrower but needs fluent KQL and practical familiarity with two consoles. See is SC-200 hard? for the detail, and the SC-500 section for the engineer exam.
Other Microsoft security exams
SC-900 is the fundamentals exam covering security, compliance and identity concepts, a good first step if the vocabulary is new. SC-300 is the identity and access administrator exam, close to the identity side of incident response. SC-401 is the information security administrator exam, centred on Microsoft Purview, which overlaps with the Purview and insider risk parts of SC-200.
A sensible order
- If you are new to security, start with SC-900.
- Take SC-200 if your target role is SOC analyst or threat hunter.
- Add SC-500 if you also build or review cloud security controls.
If you are still deciding whether the analyst route is right, read is SC-200 worth it?.