Microsoft SC-100

SC-100 is the exam behind Microsoft Certified: Cybersecurity Architect Expert. It’s the top of Microsoft’s security certification path. It’s also the only one that needs an associate-level certification before it counts.

The English version was updated on 28 July 2026, so material written before then may not match the current skills measured list.

You Need a Prerequisite First

Passing SC-100 alone does not make you a Cybersecurity Architect Expert. Microsoft requires at least one of three associate certifications alongside it:

Security Operations Analyst Associate, earned through SC-200. Identity and Access Administrator Associate, earned through SC-300. Cloud and AI Security Engineer Associate, earned through SC-500. (Format the three options as a bulleted list.)

That list changed recently and it catches people out. AZ-500 used to be an accepted prerequisite. It retired on 31 August 2026. SC-500 replaced it in the list. If you were counting on AZ-500 for SC-100, that route is closed.

What Does the Exam Cover?

Four areas, published as ranges:

Design security operations, identity, and compliance capabilities (25 to 30%): XDR and SIEM solution design, centralised logging, SOAR with Sentinel and Defender XDR, threat detection coverage mapped against MITRE ATT&CK including the ICS matrix. Identity design covers Entra ID, external and decentralised identity, privileged access using the enterprise access model, and hardening Active Directory Domain Services.

Design security solutions for infrastructure (25 to 30%): Posture management with Defender for Cloud and Secure Score, integrating hybrid and multicloud through Azure Arc, endpoint and server requirements, IoT and embedded systems, operational technology and industrial control systems through Defender for IoT, and Security Service Edge evaluation.

Design solutions that align with security best practices and priorities (20 to 25%): Ransomware resilience, business continuity and disaster recovery, and designing against the Microsoft Cybersecurity Reference Architectures, the Cloud Security Benchmark, the Cloud Adoption Framework and the Zero Trust adoption framework.

Design security solutions for applications and data (20 to 25%): Securing Microsoft 365, Defender for Office 365 and Defender for Cloud Apps, Intune, Purview for data protection, application security lifecycle, threat modelling, API security, data discovery and classification, and encryption design.

It Is a Design Exam, Not a Configuration Exam

This is the shift that catches engineers moving up from SC-200 or SC-500. The verbs in the skills list are design, evaluate, specify and recommend. Almost nothing says implement or configure.

Questions give you a business scenario and ask which solution fits. Several options will be technically capable. The right answer is the one that matches the stated constraints, whether that’s regulatory, budgetary or an existing architecture. Knowing how to configure conditional access does not help if you can’t argue why this design and not that one.

AI runs through the syllabus rather than sitting in its own section. Topics include designing a strategy for secure AI adoption, aligning AI solutions to the Cloud Security Benchmark, agent identity design using Entra Agent ID, security for data used in AI workloads, and compliance controls in Copilot for Microsoft 365.

Who Should Take SC-100?

It suits security architects, lead engineers and consultants who design across a whole Microsoft estate and already hold one of the three prerequisites.

It’s the wrong exam if you’re still hands on keyboard most of the day. The associate exams pay off faster in that role. It’s also vendor-specific. SC-100 proves you can architect a Microsoft environment. CISSP and CISSP-ISSAP cover architecture without assuming a vendor, and they travel better if you might not stay in the Microsoft world.

Exam Details

Microsoft prices exams by the region the exam is proctored in, so check the figure for yours at booking. Role-based certifications also expire each year. You renew them free through an online assessment on Microsoft Learn, so budget time rather than money.

What Comes After SC-100?

SC-100 is the top of the Microsoft security path, so the next move is usually sideways into vendor-neutral architecture. CISSP-ISSAP is the closest equivalent, and CCSP covers cloud security architecture across providers rather than one.

If you came in through SC-200 and want the engineering half of the picture, SC-500 covers implementing the controls you’re now designing.

Daniel Griggs

Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.