SC-100 is about to receive a minor update, in the Design solutions for securing privileged access and Evaluate solutions for network security and Security Service Edge (SSE) sections. What are these changes?

In the Design solutions for securing privileged access section, the difference is the removal of the words on-premises before Active Directory. This might seem minor, but it’s been an annoyance of mine that “on-premises Active Directory” is used as a general term instead of just using “Active Directory”. ignoring the fact Active Directory can be deployed in VMs in the cloud, rather than purely being on-premises. In some cases the use of “on-premises Active Directory” is accurate, but they are only when you are referring to Active Directory deployments that are, you guessed it, on-premises!

In the Evaluate solutions for network security and Security Service Edge (SSE) section was updated to say Microsoft Entra Internet Access for Microsoft Services, which is a broader reference to the supported Microsoft networking endpoints, instead of just referring to the endpoints as being for Microsoft 365.

The biggest challenges I hear about from people who are preparing for this exam, or have attempted it, is that they usually encounter something that they aren’t aware of, or at least aren’t very familiar with it. This is usually a byproduct of perhaps having strong skills in some areas of the exam, but not necessarily having exposure to other things the exam includes.

The easiest example to illustrate this could be someone who works on Azure solutions, but with very little Microsoft 365 exposure, or vice versa, which is very common in some organisations. If we convert that into what you really should be doing with this exam is making sure you aren’t just looking at the exam descriptions for topics you should be aware of but also make sure you are looking closely at the MCRA diagrams to make sure there isn’t anything lurking that you may not be aware of.

Additions in the July 2024 update

  • Design a solution for centralized logging and auditing, including Microsoft Purview Audit
  • Evaluate an access review management solution that includes Microsoft Entra Permissions Management
  • Evaluate the security and governance of on-premises Active Directory Domain Services (AD DS), including resilience to common attacks
  • Specify requirements and priorities for a posture management process that uses Exposure Management attack paths, attack surface reduction, security insights, and initiatives
  • Evaluate Windows Local Admin Password Solution (LAPS) solutions
  • Evaluate solutions that include Azure AI Services Security
  • Evaluate network designs to align with security requirements and best practices
  • Evaluate solutions that use Microsoft Entra Internet Access as a secure web gateway
  • Evaluate solutions that use Microsoft Entra Internet Access to access Microsoft 365, including cross-tenant configurations
  • Evaluate solutions that use Microsoft Entra Private Access
  • Evaluate solutions for securing data in Microsoft 365 by using Microsoft Purview
  • Evaluate data security and compliance controls in Microsoft Copilot for Microsoft 365 services
  • Evaluate device management solutions that include Microsoft Intune

Summarising some of the differences here, one of the first things that jumped out to me was that Purview as being referenced more directly. Previously in this exam if there were references to logging, it was probably safe to assume that is was most likely using Log Analytics, Azure Monitor and Sentinel for log collection and analysis, but now Purview’s Audit capabilities are being mentioned as well. This means you need to be comfortable with the Standard and Premium offerings.

Four of the items in the list fall are from a new category under the Design security solutions for infrastructure objective domain, Evaluate solutions for network security and Security Service Edge (SSE). This isn’t completely new to the exam, as Global Secure Access was added to the exam objectives previously. What is new is that these items are being called out specifically.

The final thing thing I want to discuss in terms of changes is that this is the first time that Intune is being specifically mentioned in the exam description. This doesn’t mean that it’s new to the exam, as it was covered under different topics previously, but people may not have realised it. The change means that people won’t be as surprised to hear about Intune being part of the exam, which is something that I know caught some people off guard in the past.

There are obviously other changes, based on the list that I’ve provided, so make sure you focus on those as well if you are already well into your exam preparation.

Design solutions that align with security best practices and priorities (20–25%)

Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices

Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft cloud security benchmark (MCSB)

Design solutions that align with the Microsoft Cloud Adoption Framework for Azure and the Azure Well-Architected Framework

Design security operations, identity, and compliance capabilities (25–30%)

Design solutions for security operations

Design solutions for identity and access management

Design solutions for securing privileged access

Design solutions for regulatory compliance

Design security solutions for infrastructure (25–30%)

Design solutions for security posture management in hybrid and multicloud environments

Design solutions for securing server and client endpoints

Specify requirements for securing SaaS, PaaS, and IaaS services

Evaluate solutions for network security and Security Service Edge (SSE)

Design security solutions for applications and data (20–25%)

Evaluate solutions for securing Microsoft 365

Design solutions for securing applications

Design solutions for securing an organization’s data