SC-100 is Microsoft's expert-level security exam and leads to the Microsoft Certified: Cybersecurity Architect Expert certification. It is a different kind of exam from the associate-level security tests. SC-300 or AZ-500 ask how to configure something. SC-100 mostly asks what you should design, and why that design is the best fit for an organisation's requirements.
A prerequisite most people miss
Passing SC-100 on its own does not earn the certification. You also need one of the associate-level security certifications: Security Operations Analyst (SC-200), Identity and Access Administrator (SC-300) or Azure Security Engineer (AZ-500). Microsoft recommends earning that first, and it makes sense to: SC-100 assumes you already understand how the underlying products work.
What the exam covers
The SC-100 skills outline is organised into four areas:
- Design solutions that align with security best practices and priorities — Zero Trust, resilience, ransomware protection and aligning with Microsoft's security frameworks.
- Design security operations, identity and compliance capabilities — security operations tooling, identity and access strategy, and regulatory compliance.
- Design security solutions for infrastructure — endpoints, servers, SaaS, and hybrid and multicloud workloads.
- Design security solutions for applications and data — securing applications and protecting data across Microsoft 365 and Azure.
Microsoft adjusts the exact weighting of each area when it revises the outline, so check the current percentages on Microsoft Learn. Across versions, Zero Trust and security operations have consistently been central. A passing score is 700.
How to prepare
Think like an architect, not an administrator. The typical SC-100 question gives you a business situation with constraints and asks for the most appropriate strategy. Several answers may be technically possible. The right one is the one that best meets the stated requirements. Read requirements carefully, and notice words like "minimise administrative effort" or "meet compliance requirements".
Know Microsoft's reference frameworks. The exam draws on Microsoft's published security guidance, including Zero Trust principles and Microsoft's reference architectures and security benchmarks. You don't need to memorise them word for word, but you should recognise what they recommend.
Use your associate-level knowledge. If you passed SC-300, SC-200 or AZ-500 recently, you already know one domain in depth. Spend most of your time on the areas you know least.
Plan for renewal. Microsoft associate and expert certifications expire annually and are renewed through a free online assessment on Microsoft Learn, so the credential stays current with less effort than retaking the exam.
Study resources from CertCraft
- SC-100 Practice Tests — scenario-style questions to test your design judgement.
- SC-100 Study Notes — condensed notes organised by exam topic.
- SC-100 Quick Reference — for last-minute review.
- SC-100 Exam Simulator — interactive practice in your browser.
Still working on the prerequisite? Our SC-300 study guide covers the identity route.
Always confirm the current skills outline, prerequisites and renewal rules on the official SC-100 page on Microsoft Learn before booking. CertCraft Institute is an independent study resource and is not affiliated with, endorsed by, or sponsored by Microsoft.