Which security certification to take first
Take SC-900 first if you are new to security and your work or target employer uses Microsoft cloud services, take Security+ SY0-801 first if you want a vendor-neutral baseline and already work in IT, and go straight to SC-200 only if you already work with Microsoft 365 security or Azure. Nothing requires a particular order: no exam on this site lists another certification as a prerequisite for these three.
Example profiles, not real people. The scenarios below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.
The decision rule
Two questions settle it: what does your day job touch, and what does the job you want ask for? A job advert that names Defender, Sentinel or Entra points to the Microsoft exams. One that asks for a recognised general baseline points to Security+. If you cannot name either, the cheapest way to learn whether you like the field is the fundamentals exam.
| Starting point | First exam | Then |
|---|---|---|
| Non-technical, student or career changer, Microsoft environment | SC-900 | A role exam that matches the job |
| General IT, help desk or network technician | SY0-801 | A specialist or Microsoft role exam |
| No IT background at all | N10-009 for networking basics | Security+ or SC-900 |
| Already doing security operations on Microsoft tools | SC-200 | SC-300, SC-401 or SC-500 by job |
| Identity, data or Azure security job | SC-300, SC-401 or SC-500 | See the Microsoft security path |
The three first exams side by side
| SC-900 | SY0-801 (Security+) | SC-200 | |
|---|---|---|---|
| Level | Beginner, fundamentals | Entry to intermediate | Intermediate, associate |
| Length | 45 minutes | 90 minutes, maximum 90 questions | 100 minutes |
| Passing score | 700 of 1000 | 750 on a 100 to 900 scale | 700 of 1000 |
| Largest area | Microsoft security solutions, 35 to 40 percent | Security Operations, 27 percent | Manage a security operations environment, 40 to 45 percent |
| Expiry | None | Three years, continuing education | 12 months, free renewal |
| Languages | Thirteen | English on the V8 page | Ten |
SC-900 is conceptual: you match a scenario to the right concept or product. Its four areas are concepts (10 to 15 percent), Entra (25 to 30), security solutions (35 to 40) and compliance solutions (20 to 25). The difficulty comes from many similar product names, not from depth.
Security+ SY0-801 has five domains: general security concepts 16 percent, threats, vulnerabilities and attacks 24, security architecture 19, security operations 27 and program management and oversight 14. CompTIA expects the V8 launch around November 17, 2026, and SY0-701 remains available alongside it until it retires on June 11, 2027 in English. SY0-801 adds a dedicated AI objective, so older material is incomplete.
SC-200 is the hands-on analyst exam: managing a security operations environment, responding to incidents (35 to 40 percent) and threat hunting (20 to 25). You must read and write KQL. The English exam updates on October 21, 2026, and new topics such as data lake tiers and Sentinel Graph appear. The site’s SC-200 vs SC-500 guide separates analyst from engineer work.
Where the other exams fit
SC-300 covers identity and access, SC-401 covers information protection and data loss prevention, and SC-500 covers securing Azure workloads, networks and AI services. Pick one by job, not by order. CompTIA’s SecAI+ (CY0-001) is a specialist exam that assumes you already work in security, and the ISACA credentials assume governance experience, so neither is a first exam. The CompTIA path puts Network+ before Security+ for anyone starting out in IT.
Realistic constraints
Time. The SC-900 plan is four weeks at four to six hours a week, five to six weeks for a non-technical candidate and six for a student with no IT experience. The Security+ plan is four weeks at 8 to 10 hours for someone already working in IT, and the site says to double that and consider Network+ first with no IT background. The SC-200 plan is four weeks at 8 to 10 hours with relevant experience, and to double it and consider SC-900 first without security operations experience.
Language. SC-900 and SC-200 are offered in thirteen and ten languages. Security+ SY0-801 lists English only on CompTIA’s V8 page. See the language guide.
Renewal. SC-900 never expires. SC-200 renews every 12 months through a free online assessment. Security+ asks for 50 continuing education units and a $150 fee per three-year cycle, with no free yearly assessment, so the ongoing cost differs more than the exam fee.
Retakes. Microsoft allows 24 hours after a first fail and then 14 days between attempts. CompTIA allows a second attempt without waiting and requires 14 calendar days before a third, at full price each time. The retake guide compares vendors.
Price. Microsoft prices are set per country. CompTIA had not published an SY0-801 price in the pages checked, so confirm at booking and see certification costs.
Scenario: a help desk technician aiming for a security analyst role
This is an illustrative planning example. The technician resets passwords, handles endpoint tickets and works in a Microsoft 365 tenant, but has never triaged an alert or written a query.
Where the time goes: the security solutions area of SC-900, which covers the Defender, Sentinel and Purview family, then the governance and risk vocabulary of Security+ if a vendor-neutral baseline is wanted. The trap is skipping straight to SC-200 because the job title sounds right, then meeting KQL and Sentinel configuration with no foundation; the site recommends SC-900 first without security operations experience.
A reasonable planning assumption for the sequence is SC-900 at two to three weeks, as the site lists for an IT administrator, then SC-200 at eight weeks, which is the four-week plan doubled for someone without security operations experience at 8 to 10 hours a week. Security+ could be inserted if a vendor-neutral credential is required. This is a planning figure, not a promise of any result.
Where to go next
Read SC-900 vs AZ-900 if you are unsure between security and cloud fundamentals, the SY0-801 vs SY0-701 guide if you are booking before the V8 launch, and the exam changes tracker for current outline dates.