Microsoft security certification path
Start with SC-900 only if you are new to security or to Microsoft’s cloud. Then pick the role exam that matches your daily work: SC-300 for identity, SC-200 for security operations, SC-401 for data protection or SC-500 for cloud and AI workload security. There is no single ladder, because these are four different jobs.
The five exams side by side
| Exam | Role it tests | Duration | Take it if |
|---|---|---|---|
| SC-900 | Fundamentals of security, compliance and identity | 45 minutes | You are new, or you work next to security |
| SC-300 | Identity and Access Administrator | 100 minutes | You run Microsoft Entra: Conditional Access, PIM, app registrations, governance |
| SC-200 | Security Operations Analyst | 100 minutes | You work in a SOC with Defender XDR, Sentinel and KQL |
| SC-401 | Information Security Administrator | 100 minutes | You manage sensitivity labels, DLP, retention and insider risk in Purview |
| SC-500 | Cloud and AI Security Engineer | 120 minutes | You secure Azure workloads, networks, containers and AI services |
Durations come from Microsoft’s exam pages. Microsoft does not publish question counts for any of them, and prices are set per country.
Is SC-900 required?
No exam page we checked names SC-900 as a prerequisite for the role exams. It is useful preparation for the vocabulary (Zero Trust, shared responsibility, the Microsoft security product families) and it is the cheapest way to find out whether you enjoy the field. If you already work with Entra, Defender or Purview, skip it. The SC-900 vs AZ-900 guide helps if you are unsure which fundamentals exam fits you.
Which role exam first
Identity is your job: SC-300. It is the exam most administrators already half know. Conditional Access, authentication methods, workload identities and privileged access carry most of the weight.
You triage alerts: SC-200. Threat hunting with KQL and responding to incidents in Defender XDR and Sentinel are the core. SC-200 vs SC-500 explains how it differs from the engineering exam.
You protect data: SC-401. All three domains sit at roughly a third each: information protection, DLP and retention, and risk management. SC-401 vs SC-200 compares it with the operations exam.
You build and secure Azure: SC-500. It replaces the retired AZ-500 and adds AI security objectives. It is broader and harder to prepare for, because few third-party materials exist yet. SC-500 vs AZ-500 covers what changed.
Combining exams
Many security roles end up with two of these. Identity plus operations (SC-300 and SC-200) is a common pair, and SC-401 pairs naturally with either. If you administer Azure as well, the Azure administrator and architect path is the other half of the picture.
Check the outline before you book
Microsoft refreshes these outlines often. SC-200 and SC-300 both have English outline changes scheduled for late October 2026, and the localised versions follow weeks later. The exam changes tracker lists what has moved, and each guide tells you which outline it follows.
New to security? Security career start certifications compares SC-900 with Security+ as a first step.