SC-401 vs SC-200: which exam to take?
Take SC-401 if your job is protecting data: labels, DLP, retention, insider risk and audit in Microsoft Purview. Take SC-200 if your job is defending against attacks: triaging incidents, hunting threats and writing detections in Microsoft Defender XDR and Microsoft Sentinel. They are both Microsoft security associate exams of 100 minutes, but they sit in different parts of the Microsoft security stack and share very little content.
The two exams side by side
| SC-401 | SC-200 | |
|---|---|---|
| Certification | Information Security Administrator Associate | Security Operations Analyst Associate |
| Focus | Protect and govern sensitive data | Detect, investigate and respond to threats |
| Main tools | Microsoft Purview, Defender for Cloud Apps | Microsoft Defender XDR, Microsoft Sentinel, Defender for Cloud |
| Domains | Information protection; DLP and retention; risks, alerts and activities | Manage a security operations environment; respond to security incidents; perform threat hunting |
| Duration | 100 minutes | 100 minutes |
| Passing score | 700 | 700 |
| Languages | 7 | 10 |
| Renewal | Free, every 12 months | Free, every 12 months |
Who does what
The information security administrator decides which documents are confidential, applies encryption through sensitivity labels, writes policies that block a payroll file from being emailed out, sets retention for records and investigates risky behaviour by employees. The work is policy design and tuning.
The security operations analyst gets an alert at 3 a.m., opens the incident in Defender XDR, correlates it with Sentinel, runs a KQL hunting query and isolates a device. The work is investigation and response.
Where they meet
Some topics appear in both, from different angles:
- Alerts. SC-401 includes responding to Purview alerts in Microsoft Defender XDR; SC-200 analysts are the people who work that queue.
- Insider risk. SC-401 configures Insider Risk Management policies; SC-200 analysts may investigate the same users from a threat perspective.
- Defender for Cloud Apps. Both exams touch it: file policies and labelling in SC-401, cloud app incidents in SC-200.
- Audit logs. Purview Audit is an SC-401 objective and a common SC-200 data source.
What only SC-401 tests
Sensitive info types, exact data match, trainable classifiers, sensitivity label encryption and auto-labeling, the Information Protection client and scanner, Message Encryption, Endpoint DLP, retention labels and adaptive scopes, eDiscovery and DSPM for AI. None of this is on a SOC analyst’s day sheet.
What only SC-200 tests
KQL for hunting, Sentinel analytics rules and automation, Defender XDR incident response and device investigation. If you cannot read a KQL query, SC-200 will be difficult; SC-401 barely uses it.
Related Microsoft exams
- SC-900, Security, Compliance, and Identity Fundamentals, is the broad entry point. Its Purview content is the foundation for SC-401.
- SC-300, the Identity and Access Administrator Associate exam, covers Microsoft Entra: users, authentication, access and governance. It pairs with SC-401 when identity and data protection are one job.
- SC-200 is the security operations exam compared above.
Which first?
| If you are | Start with |
|---|---|
| New to Microsoft security | SC-900, then pick by role |
| A compliance, records or data-protection admin | SC-401 |
| A SOC analyst or incident responder | SC-200 |
| A Microsoft 365 admin who also owns identity | SC-300, then SC-401 |
There is no required order. Neither exam is a prerequisite for the other. For details on the difficulty, read is SC-401 hard?, and if you are weighing the investment, is SC-401 worth it?.