SC-200 just received an update to reflect the name change of Microsoft Copilot for Security to Microsoft Security Copilot. Due to the changes being minimal this time round, I’ve kept the details in this post about the changes that were introduced in the October update.

Back in October, the exam received a major update, including weighting changes, new topics being added, including a section on Copilot for Security, as well as some topics being removed. Along with this there was some restructuring, merging some sections and consolidating topics

Let’s start by taking a look at the new sections and weightings.

October 2024

  • Manage a security operations environment (20–25%)
  • Configure protections and detections (15–20%)
  • Manage incident response (25–30%)
  • Manage security threats (15–20%)

July 2024

  • Manage a security operations environment (25–30%)
  • Configure protections and detections (15–20%)
  • Manage incident response (35–40%)
  • Perform threat hunting (15–20%)

The thing to notice here is that the update reduces the weighting for the first and third objective domains, and there seems to be an issue because the maximum total only adds up to 95%. I guess this is something we will see corrected at some point soon.

If we take a look at what’s been added to the exam, you will notice that the majority of them are related to Copilot for Security, which is a new section that has been added to the exam.

  • Mitigate risk by using Exposure Management in Microsoft Defender XDR
  • Monitor and optimize data ingestion
  • Implement behavioral analytics
  • Create and use promptbooks
  • Manage sources for Copilot for Security, including plugins and files
  • Integrate Copilot for Security by implementing connectors
  • Manage permissions and roles in Copilot for Security
  • Monitor Copilot for Security capacity and cost
  • Identify threats and risks by using Copilot for Security
  • Investigate incidents by using Copilot for Security
  • Create and manage hunts

This isn’t a comprehensive list of what’s been removed, and I use the word removed loosely because most of these topics could still be included as parts of some of the other topics. This is a common phenomenon in exams, and the best way to understand it is that the baseline knowledge expectations change over time, so some items don’t need to listed specifically. I’ve moved any of the links from previous exam resource guides into other topics that they align with.

  • Manage multiple workspaces by using workspace manager and Azure Lighthouse
  • Manage resources by using Azure Arc
  • Connect environments to Microsoft Defender for Cloud (by using multi-cloud management)
  • Configure bidirectional synchronization between Microsoft Sentinel and Microsoft Defender XDR
  • Investigate and remediate threats to Microsoft Teams, SharePoint Online, and OneDrive
  • Manage actions and submissions in the Microsoft Defender portal
  • Hunting topics consolidation

All up, if we look at everything else the exam still includes, this exam description update is definitely a major restructure, but not necessarily a major change to the skills the exam expects you to have.

This is one my favorite exams to recommend for someone who wants to get into Microsoft cybersecurity technologies and exams, due the Defender and Sentinel skills you need to pass the exam. If you’ve already passed MS-500 (now retired) and AZ-500, this is an excellent choice as your next exam, because there will be some overlap in the technologies, but expect this exam to go deeper into understanding the Defender family of technologies, and it also goes deeper into Sentinel than you will have seen on previous exams. You will definitely need to spend time with Kusto and Log Analytics, not just for the Microsoft Sentinel questions in the exam, but Microsoft Defender XDR as well.

Manage a security operations environment (20–25%)

Configure settings in Microsoft Defender XDR

Manage assets and environments

Design and configure a Microsoft Sentinel workspace

Ingest data sources in Microsoft Sentinel

Configure protections and detections (15–20%)

Configure protections in Microsoft Defender security technologies

Configure detection in Microsoft Defender XDR

Configure detections in Microsoft Sentinel

Manage incident response (25–30%)

Respond to alerts and incidents in the Microsoft Defender portal

Respond to alerts and incidents identified by Microsoft Defender for Endpoint

Investigate Microsoft 365 activities

Respond to incidents in Microsoft Sentinel

Implement and use Microsoft Security Copilot

Manage security threats (15–20%)

Hunt for threats by using Microsoft Defender XDR

Hunt for threats by using Microsoft Sentinel

Create and configure Microsoft Sentinel workbooks