ExamSprintLab

SC-200 study plan: pass in 4 weeks

Updated October 9, 2026

Four weeks is realistic for SC-200 if you already work with Microsoft 365 security or Azure and study 8–10 hours a week. Start with KQL, because it runs through all three domains; then build the Sentinel and Defender XDR environment; then practise detections and automation; and finish with incident response and review. Without any security operations experience, double the timeline and consider SC-900 first.

Before you start

  • Read the official skills outline once, end to end. It lists every objective and is the document the exam is written against.
  • Set up a lab. A Microsoft 365 trial tenant and an Azure subscription are enough. Create a Log Analytics workspace, onboard Microsoft Sentinel to it, and set a budget alert so ingestion does not surprise you.
  • Take the free Microsoft practice assessment cold. The score does not matter yet; the per-domain breakdown does.
  • Bookmark the KQL reference. You will use it every day for four weeks.

Week 1: KQL and hunting (20–25%, but it underpins everything)

Goal: read and write queries without looking up the syntax.

  • Core operators: where, project, extend, summarize, count, distinct, top, order by, take, join, union, let, parse, bin and time filters with ago().
  • Choosing the table: in Defender XDR advanced hunting, know what lives in DeviceProcessEvents, DeviceNetworkEvents, DeviceLogonEvents, EmailEvents, IdentityLogonEvents and CloudAppEvents. In Sentinel, know SecurityEvent, SigninLogs, AzureActivity, Syslog, CommonSecurityLog and ThreatIntelligenceIndicator.
  • Hunting tools: advanced hunting queries, threat analytics, hunting graphs and the blast radius view, Sentinel Graph for entity relationships.

Lab: write queries that find failed sign-ins followed by a success from the same IP, rare process names per device, and the top senders of blocked mail.

Week 2: Sentinel platform and data ingestion (part of 40–45%)

Goal: get data in, keep it for the right time, and give people the right access.

  • Roles: Sentinel Reader, Responder, Contributor and Automation Contributor, and what each can do.
  • Retention and tiers: analytics, data lake and XDR tiers; when to keep data in each.
  • Connectors: Windows Security Events via AMA and data collection rules, Windows Event Forwarding, Syslog and CEF via AMA, Azure activity logs with Azure Policy and diagnostic settings, threat indicators, and custom log tables.
  • Platform: workbooks and SOC optimization recommendations.

Lab: connect a Windows VM through AMA with a data collection rule that filters events, send Syslog from a Linux VM, and build a workbook showing sign-in failures.

Week 3: detections and automation (rest of 40–45%)

Goal: make the platform detect and respond on its own.

  • Detections: custom detection rules from advanced hunting, Sentinel analytics rules (scheduled, NRT, threat intelligence, machine learning), anomalies, and ATT&CK coverage.
  • Defender XDR automation: email and alert notifications, tuning and suppression, automated investigation and response, automatic attack disruption.
  • Defender for Endpoint: advanced features, device groups, permissions, automation levels, ASR rules.
  • Sentinel automation: automation rules (what they do versus playbooks) and playbooks built on Logic Apps.

Lab: an NRT rule that creates an incident, an automation rule that assigns and tags it, and a playbook that posts it to a channel.

Week 4: incident response (35–40%) and review

Goal: work an incident from alert to closure.

  • Across the products: Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Purview, Entra ID and Sentinel alerts; multi-stage and lateral-movement incidents; case management; investigation with Security Copilot and agentic AI.
  • Endpoint response: device timelines, live response, investigation packages, evidence and entities.
  • Microsoft 365 investigation: Purview Audit, eDiscovery content search, Graph activity logs.

Review: take the free 20-question practice test mid-week, then repeat the official practice assessment. Spend the last days on your lowest-scoring domain, using its guide in this section.

If you already work in a SOC

Compress weeks 3 and 4. Analysts usually know incident handling well but have gaps in configuration objectives: AMA data collection rules, retention tiers, Windows Event Forwarding, custom tables, summary rules and KQL jobs. Spend the saved time there, and on KQL if you mostly use the portal’s built-in views.

How to know you are ready

  • You can write a KQL query from a sentence such as “devices that ran PowerShell with an encoded command in the last day”.
  • You can say which table holds a given signal without looking.
  • You can explain the difference between an automation rule and a playbook, and between an analytics rule and a custom detection.
  • You score 80% or more on realistic practice questions twice in a row, on different question sets.

Then book it. See the exam format for the mechanics and the exam day guide for the day itself.