SC-200: Microsoft Security Operations Analyst Exam Resource Guide (April 2026 Update)

The SC-200 study guide just received a major update, with changes in weightings, new topics being added, topics being removed and more, so let’s jump in and take a look at what these changes are.

First of all, it has been reduced to three main sections with the following weightings.

• Manage a security operations environment (40–45%)
• Respond to security incidents (35–40%)
• Perform threat hunting (20–25%)

Previously it was

• Manage a security operations environment (20–25%)
• Configure protections and detections (15–20%)
• Manage incident response (25–30%)
• Manage security threats (15–20%)

The main things to notice with these changes are the increase in the manage a security operations environment, effectively doubling its weighting, and the removal of configure and protections and detections, but elements of this are incorporated into the other parts of the exam.

A few topics have been consolidated, including Security Copilot being reduced to one item, as well as Sentinel workspace planning being rolled in to other areas. A few specific Sentinel and Defender XDR items have been removed, but it’s better to work on the assumption that these have just become expected base knowledge that the candidate profile addresses. Defender for Cloud workload protections have been deemphasized, but integration into Defender XDR is still present.

In terms of what’s new, we now see that Sentinel additions include data lake, MCP server, summary rules, KQL jobs on data lake, and Sentinel graph as the most prominent. On the Defender side, we see the addition of hunting graph, custom data collection in Microsoft Defender for Endpoint, new case management, and threat analytics as the obvious entries new Configure custom data collection in Microsoft Defender for Endpoint

This is one my favorite exams to recommend for someone who wants to get into Microsoft cybersecurity technologies and exams, due the Defender and Sentinel skills you need to pass the exam. If you’ve already passed MS-500 (now retired) and AZ-500 (soon to be retired and replaced by SC-500), this is an excellent choice as your next exam, because there will be some overlap in the technologies, but expect this exam to go deeper into understanding the Defender family of technologies, and it also goes deeper into Sentinel than you will have seen on previous exams. You will definitely need to spend time with KQL and Log Analytics, not just for the Microsoft Sentinel questions in the exam, but Microsoft Defender XDR as well, especially with the unified SecOps experience, with less of a focus on Defender for Cloud capabilities in the Azure portal.

Manage a security operations environment (40–45%)

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

• Configure email notifications in Microsoft Defender XDR, including incidents, actions, and threat analytics
  • Threat analytics overview
• Configure alert notifications in Microsoft Defender XDR, including tuning, suppression, and correlation
  • Configure alert notifications
• Configure Microsoft Defender for Endpoint advanced features
  • Configure advanced features
  • Configure device discovery
  • What is Microsoft Defender Vulnerability Management
• Configure rules settings in Microsoft Defender for Endpoint
  • Create indicators
• Configure custom data collection in Microsoft Defender for Endpoint
  • Custom data collection in Microsoft Defender for Endpoint
• Configure security policies for Microsoft Defender for Endpoint, including attack surface reduction (ASR) rules
  • Learn about attack surface reduction rules
  • Configure attack surface reduction capabilities
  • Security operations dashboard
  • Manage security baselines
• Manage automated investigation and response capabilities in Microsoft Defender XDR
  • Incident alerts
  • Manage incidents in Microsoft 365 Defender
  • View and organize the Incidents queue
  • View and organize the Alerts queue
• Configure automatic attack disruption in Microsoft Defender XDR
  • Configure automatic attack disruption capabilities in Microsoft Defender XDR
• Configure and manage device groups, permissions, and automation levels in Microsoft Defender for Endpoint
  • Create and manage device groups in Microsoft Defender for Endpoint
• Create and configure automation rules in Microsoft Sentinel
  • Automation rules
  • Use automation to respond to threats
• Create and configure Microsoft Sentinel playbooks
  • Steps for creating a playbook
  • How to run a playbook
  • Use triggers and actions in playbooks
  • Migrate alert playbooks to automation rules
  • Customize playbooks from templates

Configure the Microsoft Sentinel SIEM and platform

• Specify Microsoft Sentinel roles
  • Roles and permissions
  • Azure RBAC
• Manage data retention for XDR and Microsoft Sentinel tables, including Analytics, Data lake, and XDR tiers
  • Log data usage and costs
  • Manage data tiers and retention in Microsoft Sentinel
  • Microsoft Defender XDR integration with Microsoft Sentinel
  • Configure data retention and archive
  • Restore archived logs from search
  • Search large datasets
• Create and configure Microsoft Sentinel workbooks
  • Use built-in workbooks
  • Security operations efficiency workbook
  • Create new workbook
  • Use Azure Monitor workbooks
  • Visualize collected data
• Optimize the Microsoft Sentinel platform, including SOC optimization recommendations
  • Monitor costs
  • Reduce costs
  • Optimize costs with pre-purchase plan
  • Use SOC optimizations programmatically
  • Design a workspace deployment

Ingest data into the Microsoft Sentinel SIEM and platform

• Select data connectors based on data source requirements, including Windows logs and security events
  • Connect data sources
• Configure collection of Windows Security events by using Windows Security Events via AMA, including data collection rules
  • Collect Windows events from virtual machine with Azure Monitor
• Plan and configure collection of Windows Security events by using Windows Event Forwarding (WEF)
  • Windows security events
• Plan and configure Syslog via AMA and Common Event Format (CEF) via AMA connectors
  • Collect data from Linux-based sources using Syslog
  • CEF over Syslog sources
• Configure collection of Azure activities by using Azure Policy and resource diagnostic settings
  • Azure Policy
  • Connect data sources
  • Create a custom connector
• Ingest threat indicators into Microsoft Sentinel
  • Work with threat indicators
  • Connect threat intelligence
  • Create a custom connector
• Create custom log tables in the workspace to store ingested data
  • Custom data ingestion and transformation in Microsoft Sentinel

Configure detections

• Create custom detection rules by using Advanced Hunting in Microsoft Defender XDR
  • Create & manage detection rules
• Manage custom detection rules in Microsoft Defender XDR
  • Create & manage detection rules
• Configure and manage analytics rules in Microsoft Sentinel SIEM, including scheduled, near-real time (NRT), threat intelligence, and machine learning
  • Create a custom analytics rule with a scheduled query
  • Create a rule
  • Use built-in rules
  • Create near-real-time (NRT) analytics rules
  • Content hub catalog
  • Manage custom content with repositories
  • Useful resources
  • Configure multistage attack (Fusion) rules
• Analyze attack vector coverage by using the MITRE ATT&CK matrix
  • MITRE ATT&CK coverage
• Configure anomalies in Microsoft Sentinel
  • Anomaly detection rules
  • Work with out-of-the-box anomaly rules

Respond to security incidents (35–40%)

Respond to alerts and incidents in Microsoft Defender XDR

• Investigate and remediate threats by using Microsoft Defender for Office 365, including automatic attack disruption
  • Safe Attachments in Defender for Office 365
  • Remediation actions
  • AIR overview
  • Set up steps for the Standard or Strict preset security policies in Microsoft Defender for Office 365
  • Security policies and settings
  • What is Microsoft Security Exposure Management?
• Investigate and remediate threats or compromised entities identified by Microsoft Purview
  • Investigate data loss prevention alerts with Microsoft 365 Defender
  • Plan for insider risk management
• Investigate and remediate alerts and incidents identified by Microsoft Defender for Cloud workload protections
  • Security alerts and incidents
  • How are alerts classified?
  • Set up email notifications
  • Create and manage alerts suppression rules
  • Automate responses to recommendations
  • What is a security recommendation?
  • Automate responses to alerts
  • Investigate and respond to security alerts
  • Manage security incidents
  • Generate threat intelligence reports
  • Access and track your secure score
• Investigate and remediate security risks identified by Microsoft Defender for Cloud Apps
  • Investigate cloud app risks and suspicious activity
  • Create snapshot Cloud Discovery reports
  • Investigate risky users
  • Detect suspicious user activity with UEBA
  • Investigate risky OAuth apps
  • Manage alerts
• Investigate and remediate compromised identities that are identified by Microsoft Entra ID
  • Configure notifications
• Investigate and remediate security alerts from Microsoft Defender for Identity
  • Microsoft Defender for Identity Security Alerts
• Investigate and remediate alerts and incidents identified by Microsoft Sentinel
  • Investigate incidents
  • Manage your SOC with incident metrics
• Investigate incidents by using agentic AI, including embedded Copilot for Security
  • Build your own promptbook
  • Manage plugins
  • Upload a file 
  • Connectors overview
  • Prepare your environment for Copilot for Security
  • Configure owner settings
  • Manage usage
  • Create effective prompts
  • Triage incidents with enriched threat intelligence
• Investigate complex attacks, such as multi-stage, multi-domain, and lateral movement
  • Get started with advanced hunting mode
  • Threat hunting
  • Hunt for ransomware
  • Hunt across devices, emails, apps, and identities
  • Get started with guided hunting mode
• Manage security incidents by using case management
  • Manage security operations cases natively in the Microsoft Defender portal

Respond to alerts and incidents in Microsoft Defender for Endpoint

• Investigate device timelines
  • Microsoft Defender for Endpoint device timeline
• Perform actions on the device, including live response and collecting investigation packages
  • Investigate entities on devices using live response
• Perform evidence and entity investigation
  • Investigate incidents in Microsoft Defender for Endpoint
• Investigate and remediate incidents identified by automatic attack disruption

Investigate Microsoft 365 activities to identify threats

• Investigate threats by using Audit from Microsoft Purview
  • Search the audit log
• Investigate threats by using Content Search in Microsoft Purview
  • Get started with Content search
• Investigate threats by using Microsoft Graph activity logs
  • security: runHuntingQuery

Perform threat hunting (20–25%)

Detect threats by using Microsoft Defender XDR

• Identify the appropriate table to use in a KQL query
  • Create KQL queries
• Identify threats by using Kusto Query Language (KQL)
  • Create KQL queries
• Create Advanced Hunting queries
  • Get started with advanced hunting mode
• Interpret threat analytics in Microsoft Defender XDR
  • Threat analytics in Microsoft Defender
• Create hunting graphs, including blast radius
  • Hunt for threats using the hunting graph
• Analyze relationships between entities by using Sentinel Graph
  • What is Microsoft Sentinel graph?

Detect threats by using the Microsoft Sentinel platform

• Create and monitor hunting queries
  • Threat hunting
  • Hunt with livestream
  • Hunt with bookmarks
  • Conduct end-to-end hunts
• Create and manage KQL jobs in Data lake
  • Create KQL jobs in the Microsoft Sentinel data lake
• Create and manage Summary rule tables for querying
  • Aggregate Microsoft Sentinel data with summary rules
• Hunt for threats by using Notebooks, including connection to the Sentinel MCP Server
  • Hunt for security threats with Jupyter notebooks
  • Get started with Microsoft Sentinel MCP server