SC-200 vs SC-300 vs SC-500: Choose Your Security Certification

Choose a current Microsoft security certification

For a new certification in October 2026, compare SC-200 for security operations, SC-300 for identity administration, and SC-500 for cloud and AI security engineering. AZ-500 retired on August 31, 2026; its coverage is included here only to explain the transition.

Here is the honest breakdown: they cover completely different disciplines, aimed at completely different roles. The right cert depends on whether you are a cloud engineer, a SOC analyst, or an identity architect, and in many cases, you will eventually want all three.

Updated October 1, 2026: AZ-500 is retired. Use the current Microsoft Learn skills outline for your selected exam before buying training or booking a date. Existing credentials and renewal eligibility follow Microsoft's credential retirement policy.

The One-Sentence Summary of Each

AZ-500 was the Azure infrastructure security certification. New candidates should evaluate SC-500, which covers cloud and AI security engineering.

SC-200 (Microsoft Security Operations Analyst) is for SOC analysts who investigate alerts, run threat hunts, and build detections in Microsoft Sentinel and Defender XDR.

SC-300 (Microsoft Identity and Access Administrator) is for identity architects who design and implement Entra ID: Conditional Access, PIM, app registrations, B2B, and hybrid identity.

AZ-500: historical coverage of the retired exam

Who It Is For

AZ-500 previously targeted practitioners securing Azure infrastructure. This historical summary explains its role; it is not a recommendation to book the retired exam.

For current cloud and AI security engineering, compare your responsibilities with the SC-500 study guide.

What the Exam Covers

The exam is divided into four domains:

1. Secure identity and access (15-20%): Managing Azure roles, Microsoft Entra application access, PIM for Azure resources, and managed identities. This overlaps with SC-300 but goes less deep on identity governance and more into Azure resource access.

2. Secure Networking (20–25%): Network Security Groups, Azure Firewall, DDoS Protection, Private Endpoints, VNet peering security, and WAF configuration. This is the most Azure-specific domain.

3. Secure Compute, Storage, and Databases (20–25%): Disk encryption, Storage Account security (SAS tokens, firewalls, versioning), container security (ACR, AKS pod policies), and SQL/Cosmos DB encryption.

4. Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (30-35%): Defender for Cloud posture and workload protection, Microsoft Sentinel basics, Key Vault monitoring, and Log Analytics. Note: Sentinel content here is much lighter than SC-200.

Difficulty

The retired AZ-500 exam emphasized practical Azure configuration. Do not use its old outline as the current SC-500 syllabus.

Recommended prerequisites: at least 6 months of hands-on Azure work. AZ-104 (Azure Administrator) first is strongly recommended but not required.

The historical passing score was 700/1000. No verified first-attempt pass-rate data is provided here.

AZ-500 has retired: evaluate SC-500 instead

AZ-500 retired on August 31, 2026. Microsoft's current Cloud and AI Security Engineer Associate certification uses SC-500.

SC-500 covers identity, access and governance; storage, database and network security; compute; and security posture across cloud, hybrid and AI-enabled environments. Use the official study guide for detailed current objectives.

Do not plan a new AZ-500 exam booking. Choose SC-500 if its cloud and AI engineering responsibilities match your work, or SC-200/SC-300 for their distinct roles.

SC-200: Microsoft Security Operations Analyst

Who It Is For

SC-200 is the exam for security operations center (SOC) analysts, incident responders, and threat hunters who work in Microsoft's security platforms. If your day involves triaging Sentinel incidents, writing KQL detection rules, investigating Defender for Endpoint alerts, or building playbooks: SC-200 validates that work.

It is also increasingly valuable for cloud security engineers who want to prove they can operate the detection and response side of the Microsoft stack, not just configure it.

What the Exam Covers

1. Manage a security operations environment (40-45%): Configure automation for Microsoft Defender XDR and Microsoft Sentinel, manage Sentinel platform settings, ingest data, configure detections, and tune alerting.

2. Respond to security incidents (35-40%): Investigate and remediate incidents across Defender XDR, Defender for Endpoint, Microsoft Sentinel, Microsoft Purview, Microsoft Entra ID, and Defender for Cloud workload protections.

3. Perform threat hunting (20-25%): Write KQL, choose the correct advanced hunting tables, use Sentinel Graph, create hunting queries, and investigate relationships between entities.

Difficulty

SC-200 is often described as the hardest of the three because KQL proficiency is effectively required, not optional. You need to be able to write queries from scratch in the exam scenario questions, not just read them.

Pass score: 700/1000. Strongly recommended: 6+ months in a SOC or working with Sentinel/Defender XDR. The SC-900 (Security Fundamentals) is a helpful but not required stepping stone.

KQL Is Not Optional

A common mistake is treating SC-200 like a conceptual exam. The case study and lab sections require you to write working KQL. At minimum, know these patterns before the exam:

// Search for suspicious process creation
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains "-EncodedCommand"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine
| order by Timestamp desc

// Failed sign-in spike
SigninLogs
| where ResultType != "0"
| summarize FailedAttempts = count() by UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedAttempts > 10

SC-300: Microsoft Identity and Access Administrator

Who It Is For

SC-300 is for identity engineers, IAM architects, and anyone who manages Microsoft Entra ID in a production environment. If your work involves designing Conditional Access policies, implementing PIM governance, configuring app registrations, or managing hybrid identity with Entra Connect: SC-300 is your exam.

It is also increasingly required for security architects who need to prove they can design zero trust identity models, not just configure the firewall.

What the Exam Covers

1. Implement and manage user identities (20–25%): Creating and managing Entra ID users, groups, external identities (B2B, B2C), bulk operations, and HR-driven provisioning.

2. Implement authentication and access management (25–30%): MFA methods, password policies, SSPR, Conditional Access policies, authentication strengths, and Continuous Access Evaluation. This is the deepest Conditional Access coverage of any Microsoft exam.

3. Plan and implement workload identities (20-25%): Service principals, managed identities, application permissions, app registration credential hygiene, and federated identity credentials.

4. Plan and automate identity governance (20-25%): Entra ID Governance, Privileged Identity Management (PIM), access reviews, entitlement management, and lifecycle workflows. This domain tests real-world design scenarios, not just button clicks.

Difficulty

SC-300 tests identity administration and governance decisions. Difficulty depends on your Entra ID experience; compare the current skills outline with the tasks you can already perform.

Pass score: 700/1000. Recommended: 12+ months working with Entra ID in production. AZ-104 or SC-900 is a useful foundation.

SC-200 vs SC-500: Different Roles, Not Sequential Steps

People land on this page searching "SC-200 vs SC-500" expecting one to be an upgrade of the other, the way SC-500 replaces AZ-500. It is not that kind of relationship. SC-200 (Security Operations Analyst Associate) and SC-500 (Cloud and AI Security Engineer Associate) are two different jobs wearing similar-looking exam codes.

SC-200 is a detection and response exam: you live in Microsoft Sentinel and Defender XDR, write KQL, and triage incidents. SC-500 is a security engineering exam: you configure identity, storage, network, and compute controls, including the newer AI workload security surface (Microsoft Entra Agent ID, the Foundry AI Gateway, Defender for AI Service) and Sentinel posture management. One watches for attacks; the other builds the defenses SC-200 analysts end up monitoring.

Most people who need to choose between them already know which side of that line their job sits on. If you are unsure, ask: do you spend your day investigating alerts, or configuring access policies and network controls? The former is SC-200, the latter is SC-500. Plenty of security engineers eventually hold both, since a SOC analyst who understands the underlying identity and network configuration triages faster, and a security engineer who understands what SOC analysts actually see catches more real risk when designing controls.

Side-by-Side Comparison

Which One Should You Take First?

Choose SC-500 for cloud and AI security engineering

Choose SC-500 when your work involves securing cloud or hybrid infrastructure and AI-enabled workloads. Compare its current objectives with your hands-on experience before committing to a study plan.

Build Azure administration foundations as needed, then study SC-500. SC-200 and SC-300 are separate role choices, not mandatory follow-on steps.

Take SC-200 first if:

You already work in a SOC or with Microsoft Sentinel and Defender XDR. You want a certification that reflects what you actually do every day. SC-200 has the strongest salary correlation in Microsoft job postings for security analyst roles.

Suggested focus: security fundamentals if needed, then SC-200 and practical Sentinel/Defender investigation. Add cloud engineering study only if your role requires it.

Take SC-300 first if:

You are an identity administrator or work primarily in Entra ID. Your organization is implementing zero trust and you own the identity pillar. SC-300 is the credential most IAM architects get early in their Microsoft career.

Suggested path: AZ-104 or SC-900 → SC-300 → SC-200 for detection skills.

The Microsoft Security Expert Path

SC-200, SC-300 and SC-500 lead to distinct associate certifications. Select the role you need rather than collecting all three by default.

Microsoft currently lists Security Operations Analyst Associate, Identity and Access Administrator Associate, or Cloud and AI Security Engineer Associate as prerequisite options for Cybersecurity Architect Expert. That expert credential also requires SC-100. Check the official credential page before planning the prerequisites.

If you are serious about a Microsoft security career, the realistic sequence is:

1. AZ-104 (admin foundations)
2. SC-500 (cloud and AI security engineering)
3. SC-300 (identity architecture)
4. SC-200 (SOC and detection)
5. SC-100 (security architect: expert level)

Each exam builds directly on skills from the previous one. The SC-100 scenario questions explicitly test whether you can synthesize knowledge from all four domains.

Study Resources

SC-500: start with the official Microsoft Learn certification page and study guide. Older AZ-500 material can provide background, but is not a complete current exam plan.

SC-200: The Microsoft Learn SC-200 path is excellent and includes interactive Sentinel lab exercises. KQL Cafe (kqlcafe.com) is essential for KQL practice. Rod Trent's "Must Learn KQL" series covers the query patterns tested on the exam.

SC-300: Microsoft Learn SC-300 path covers all domains. The hands-on Entra ID lab exercises on the Microsoft Learning portal are more valuable than any third-party course for this exam.

For all three: use practice exams from MeasureUp (Microsoft's official partner) rather than braindumps. Braindumps are unreliable since Microsoft refreshes exam questions frequently, and the scenario-based questions cannot be memorized anyway.

Bottom Line

Choose SC-500 for cloud and AI security engineering, SC-200 for security operations, or SC-300 for identity administration. AZ-500 is historical context. Match training to your chosen current exam and job responsibilities.

Start with the one that maps to your current role, use Microsoft Learn as your primary study resource, and treat the hands-on labs as non-optional preparation.

Frequently Asked Questions

What is the difference between AZ-500, SC-200, and SC-300?

AZ-500 was the Azure infrastructure security exam and retired on August 31, 2026. SC-500 is the current cloud and AI security engineering route. SC-200 focuses on security operations, while SC-300 focuses on identity and access administration.

Has AZ-500 retired?

Yes. AZ-500 retired on August 31, 2026. New candidates should evaluate SC-500 for cloud and AI security engineering, or SC-200/SC-300 for their respective roles. Consult Microsoft Learn for current exam availability and objectives.

What is the difference between SC-200 and SC-500?

SC-200 (Security Operations Analyst Associate) certifies detection and response skills in Microsoft Sentinel and Defender XDR. SC-500 (Cloud and AI Security Engineer Associate) certifies security engineering skills across identity, storage, network, compute, and AI workload controls. They test different jobs, not different difficulty levels of the same job, so choose based on whether you investigate incidents (SC-200) or configure the controls being monitored (SC-500).

Which exam is hardest: AZ-500, SC-200, or SC-300?

Difficulty depends on your existing experience. A Sentinel analyst may find SC-200 more familiar, while an Entra administrator may prefer SC-300. We do not have verified comparative pass-rate data; use the current skills outlines and practice assessments where available.

How long does it take to study for each Microsoft security exam?

Study time depends on experience and the gaps you identify against the current objectives. Start with a diagnostic or practice assessment where available, then plan study around those gaps rather than an unsupported fixed hour estimate.

Do Microsoft security certifications require annual renewal?

Yes. All three certifications require free online renewal assessments taken through Microsoft Learn, available starting 180 days before the certification expiration date. The renewal assessment reflects the current exam blueprint and must be completed before the expiration date. Failure to renew causes the certification to lapse, requiring a full proctored exam to recertify.

Official sources checked October 1, 2026: exam retirements; SC-500 certification; SC-100 prerequisites