SC-200 Study Guide UK 2026 — Microsoft Security Operations Analyst

What is SC-200?

The SC-200 — Microsoft Security Operations Analyst — is Microsoft's certification for security professionals who work in a Security Operations Centre (SOC) environment. It validates your ability to detect, investigate, and respond to threats using the Microsoft security stack: Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. It is a role-based certification aimed at practising SOC analysts, security engineers, and threat hunters who work day-to-day with Microsoft security tooling.

In the UK, SC-200 has become an increasingly sought-after credential in financial services, government, and NHS organisations that have adopted Microsoft Sentinel as their SIEM platform. FCA-regulated firms in particular are driving demand: as Sentinel deployments mature, organisations need analysts who can configure detection rules, write KQL queries, and manage incident workflows — all core SC-200 exam objectives. If you are already working with the Microsoft security stack, this certification directly validates those skills in a way that AZ-500 (more architecture-focused) does not.

The exam consists of 40–60 questions covering multiple formats: multiple choice, drag-and-drop scenario tasks, and case studies. There is no mandatory prerequisite, but Microsoft recommends familiarity with Azure fundamentals — AZ-900 is a useful foundation if you are new to the Azure platform. The passing score is 700 out of 1000, and the exam costs £165 when booked through Pearson VUE in the UK.

Exam Topic Breakdown

The SC-200 exam is divided into three domains. The weighting below is taken from Microsoft's official study guide and is approximate — individual exams may vary within these ranges.

UK Context

In the UK job market, SC-200 is increasingly valued alongside the broader Sentinel ecosystem. Typical salary ranges for UK SOC analysts and security engineers holding SC-200 are £45,000–£75,000, with senior threat hunters and detection engineers in London-based financial services firms reaching £80,000+. The certification is particularly relevant to roles in banking, insurance, and asset management firms that have chosen Microsoft Sentinel as their primary SIEM — a pattern that has accelerated since FCA guidance on operational resilience encouraged firms to consolidate their security tooling.

NHS England and NHS Scotland have significant Sentinel deployments under the NHS Cyber Security programme. Public sector roles requiring SC-200 or equivalent Sentinel experience are increasingly common in central government and NCSC-aligned organisations. UK defence contractors also commonly list Sentinel experience as a requirement for SOC roles.

Free Study Resources

There is a solid set of free resources for SC-200, anchored by Microsoft's own learning platform. The main limitation is the absence of exam-quality practice questions — free resources will build your knowledge but won't benchmark your exam readiness.

Paid Study Resources

The three resources below cover the full preparation spectrum: deep video learning, official practice exams, and a budget question bank. Most candidates use a combination of two: a video course for knowledge building, and a practice test for exam readiness assessment.

Recommended Study Plan

The following 6-week plan assumes part-time study of 1–2 hours per day. If you are already working with Microsoft Sentinel daily, compress Weeks 4–5 and use that time for additional practice exam runs.

Booking the Exam in the UK

SC-200 is delivered exclusively through Pearson VUE. You can choose between an online proctored exam (from home) or an in-person test centre sitting.

Related Resources