Microsoft security · Exam comparison
SC-200 vs SC-300 vs SC-401: which Microsoft security exam?
Microsoft has three associate security exams, one for each security job. SC-200 (Security Operations Analyst Associate) is about detecting and responding to threats. SC-300 (Identity and Access Administrator Associate) is about who can sign in and what they can reach. SC-401 (Information Security Administrator Associate) is about protecting the data itself.
- Choose SC-200 if you work in a security operations center: triaging alerts, investigating incidents and hunting threats.
- Choose SC-300 if you manage sign-in and access: identities, authentication, Conditional Access and privileged access.
- Choose SC-401 if you protect data: classification, sensitivity labels, data loss prevention, retention and insider risk.
Side by side
| SC-200 | SC-300 | SC-401 | |
|---|---|---|---|
| Certification | Security Operations Analyst Associate | Identity and Access Administrator Associate | Information Security Administrator Associate |
| Main job | Detect, investigate and respond to threats | Secure identities, sign-in and access | Classify and protect sensitive data |
| Main tools | Microsoft Defender XDR, Microsoft Sentinel and KQL | Microsoft Entra ID, Conditional Access and Privileged Identity Management | Microsoft Purview: sensitivity labels, DLP, retention and Insider Risk Management |
| Biggest skill areas in our practice tests | Respond to alerts and incidents in Microsoft Defender XDR (22%) Configure automation for Microsoft Defender XDR and Microsoft Sentinel (14%) Ingest data into the Microsoft Sentinel SIEM and platform (12%) Detect threats by using Microsoft Defender XDR (12%) | Configure and manage a Microsoft Entra tenant (8%) Plan, implement, and manage Microsoft Entra user authentication (8%) Plan, implement, and manage Microsoft Entra Conditional Access (8%) | Evenly spread: no skill area above 12% |
| Career path on ExamKite | SC-900 → SC-200 | SC-900 → SC-300 | SC-900 → SC-401 |
| ExamKite practice | 2 practice tests, 150 questions | 2 practice tests, 150 questions | 2 practice tests, 150 questions |
Where they meet
All three build on the security, compliance and identity concepts in SC-900, and they meet at the edges: SC-200 investigates the alerts that identity and data protection raise, SC-300 sets the sign-in policies those alerts come from, and SC-401 manages the alerts for sensitive data. Beyond that, each tests a different product family, so passing one doesn't cover much of another.
What each one goes deep on
SC-200: responding to alerts and incidents in Defender XDR and Defender for Endpoint makes up 32% of its practice questions, plus automation, detections and KQL threat hunting in Sentinel.
SC-300: authentication and Conditional Access make up 16% of its practice questions, and the rest spreads across hybrid and external identities, app access, entitlement management, access reviews and privileged access.
SC-401: data loss prevention, including Endpoint DLP, makes up 22% of its practice questions, alongside classification, labels, retention, insider risk and protecting data used by AI services.
Which should you take first?
The one that matches your job. None of the three has a prerequisite, and they don't depend on each other. If Microsoft security is new to you, SC-900 is a gentle start; on ExamKite all three career paths begin there.
Questions people ask
Do I need SC-900 before SC-200, SC-300 or SC-401?
No. SC-900 is optional, though it is a good start if security, compliance and identity concepts are new to you.
Is SC-401 the same as SC-400?
SC-401 replaced SC-400. Study from the SC-401 outline: older SC-400 material misses newer areas such as protecting data used by AI services.
How long are the certifications valid?
All three are valid for one year. You renew them with a free online assessment on Microsoft Learn before they expire.
More answers in the full FAQ.
Practice in the real exam formats
Every exam on ExamKite starts with a free diagnostic and a study plan for the topics you miss.