SC-100 Exam: Complete Microsoft Cybersecurity Architect Guide

Who should take the SC-100 exam?

SC-100 targets experienced security practitioners moving into an architect role. Microsoft expects candidates to have hands-on implementation or administration experience across identity and access, platform protection, security operations, data and AI security, application security, and hybrid or multicloud infrastructure — with expert-level skill in at least one of those areas.

This is not a first security certification. Microsoft's own course guidance recommends an associate-level security credential such as AZ-500, SC-200, or SC-300 before attempting SC-100 training, and the certification itself formally requires one of three current associate certifications before the Cybersecurity Architect Expert credential is awarded (see prerequisites below). Candidates who have only studied for an exam, without operating real Microsoft security tooling, consistently struggle with the design trade-offs SC-100 asks about.

The role this exam validates sits above individual contributor security work: you translate a cybersecurity strategy into Zero Trust-aligned capabilities, collaborate with leaders and practitioners across engineering and privacy, and design solutions rather than operate them day to day.

SC-100 prerequisites

Unlike most Microsoft fundamentals or single-exam associate certifications, earning the Microsoft Certified: Cybersecurity Architect Expert credential requires passing SC-100 and already holding at least one of three associate certifications:

• Microsoft Certified: Identity and Access Administrator Associate (exam SC-300)
• Microsoft Certified: Security Operations Analyst Associate (exam SC-200)
• Microsoft Certified: Cloud and AI Security Engineer Associate (exam SC-500)

All three are current, active Microsoft certifications as of this writing. SC-500 is a newer associate certification that replaced the retired AZ-500 (Azure Security Engineer Associate) in Microsoft's security track, so if you hold AZ-500 from before its retirement, check Microsoft's current prerequisite page before assuming it still qualifies — Microsoft's SC-100 course materials still reference AZ-500 informally, but the certification's own prerequisite list on Microsoft Learn names SC-300, SC-200, and SC-500. Verify your specific situation on the official certification page before registering, since Microsoft updates prerequisite requirements periodically.

Skills measured on SC-100

Microsoft's official SC-100 study guide lists four domains. Security operations/identity/compliance and infrastructure security together make up roughly half the exam, so a preparation plan weighted only toward identity or only toward application security will leave real gaps.

Microsoft will publish an updated English-language version of this exam on October 21, 2026. Based on the published change log, the four domain names and their weight ranges are unchanged in the update — the revisions are described as "minor" adjustments to the bullet points under each domain — but you should re-check the study guide link above if you are studying close to that date.

Design solutions that align with security best practices and priorities (20–25%)

This domain opens with resiliency: designing a security strategy that supports business continuity and disaster recovery (BCDR) for hybrid and multicloud environments, prioritizing threats to business-critical assets, and designing mitigations for ransomware specifically, including how BCDR and privileged access decisions interact during an attack.

Next, align designs with Microsoft's own frameworks: the Microsoft Cybersecurity Reference Architectures (MCRA), the Microsoft Cloud Security Benchmark (MCSB), and the Zero Trust adoption framework. You should be able to recommend controls that satisfy a named framework rather than inventing an ad hoc control set, and recognize AI-specific considerations within the MCSB.

The domain closes with the Cloud Adoption Framework (CAF) and the Azure Well-Architected Framework (WAF): designing or evaluating a security and governance strategy against CAF and WAF, governing through Azure landing zones, and designing a DevSecOps process consistent with CAF guidance. Treat this section as "which framework governs which decision," since SC-100 scenarios often name the framework explicitly.

Design security operations, identity, and compliance capabilities (25–30%)

Security operations design covers detection and response: extended detection and response (XDR), SIEM, centralized logging and auditing (including Microsoft Purview Audit), monitoring across hybrid and multicloud estates, and security orchestration, automation, and response (SOAR) using Microsoft Sentinel and Microsoft Defender XDR. You should also be able to evaluate threat-detection coverage against MITRE ATT&CK matrices.

Identity and access design is broad: Microsoft Entra ID across hybrid and multicloud environments, external identities (B2B and decentralized identity), modern authentication with Conditional Access and continuous access evaluation, and emerging patterns such as agent identities. Know how to validate that Conditional Access policies actually support a Zero Trust strategy rather than just existing.

Privileged access design includes the enterprise access model for assigning and delegating privileged roles, evaluating Microsoft Entra Privileged Identity Management and access reviews, hardening Active Directory Domain Services, securing cloud tenant administration, and designing secure workstations for privileged users.

Compliance design translates regulatory requirements into controls: using Microsoft Purview, Azure Policy, and Microsoft Defender for Cloud to address and validate compliance requirements and benchmarks. Expect scenario questions that name a compliance requirement and ask which Microsoft tool and control combination satisfies it.

Design security solutions for infrastructure (25–30%)

Posture management spans hybrid and multicloud environments: Microsoft Defender for Cloud and Secure Score, Microsoft Cloud Security Benchmark, integrating hybrid and multicloud resources through Azure Arc, Defender External Attack Surface Management, and prioritizing remediation through Microsoft Security Exposure Management.

Endpoint security requirements span servers across multiple platforms, mobile and client devices, IoT and embedded systems, and operational technology secured through Defender for IoT. You should also know security baselines and the role of Windows Local Administrator Password Solution (LAPS) for local account protection.

Service-model security requirements cover SaaS, PaaS, and IaaS baselines, IoT and web workload security, container and container-orchestration security, and Azure AI services security — reflecting how deeply AI workloads are now woven into the infrastructure domain.

Network security and Security Service Edge (SSE) close the domain: evaluating network designs against security requirements, and evaluating Microsoft Entra Internet Access (as a secure web gateway and for Microsoft-services access, including cross-tenant scenarios) and Microsoft Entra Private Access.

Design security solutions for applications and data (20–25%)

Microsoft 365 security evaluation includes Secure Score for productivity workloads, Microsoft Defender for Office 365 and Defender for Cloud Apps, device management through Microsoft Intune, and data security and compliance controls — including specifically how Microsoft Purview and Microsoft 365 Copilot data controls interact.

Application security design covers evaluating an existing application portfolio's security posture, threat modeling business-critical applications, and designing a full-lifecycle application security strategy and standards. You should also be able to design workload identity solutions for Azure resource access and API management security, and recommend Azure Web Application Firewall (WAF) where it fits.

Data security design closes the domain: discovery and classification, prioritizing threats to data, encryption at rest and in transit (including Azure Key Vault and infrastructure encryption), securing data used in AI workloads specifically, and designing data security for Azure SQL, Azure Synapse Analytics, Azure Cosmos DB, and Azure Storage, including Microsoft Defender for Storage and for Databases.

How to prepare for SC-100

Treat the four domains as a single integrated design problem rather than four separate study blocks. A strong preparation project takes one realistic organization and designs its Zero Trust identity model, its security operations and SOAR workflow, its infrastructure posture management, and its application and data protection together — because the real exam expects you to reconcile decisions across all four areas, not optimize one in isolation.

Spend real time in the Microsoft Cybersecurity Reference Architectures and the Cloud Adoption Framework security guidance; SC-100 repeatedly expects you to recommend the framework-aligned answer, not just a technically valid one. If you have lab access, walk through Microsoft Defender for Cloud's posture recommendations, Microsoft Sentinel analytics rules, and Microsoft Entra Conditional Access policies so the framework language maps to something you have actually clicked through.

Microsoft's SC-100T00 instructor-led course follows the official domain sequence and is explicitly built for candidates who already hold an associate-level security certification — use it as a structured review rather than a first introduction to the material.

SC-100 practice questions

Good SC-100 practice questions present an organization's current state, a business or compliance constraint, and ask for the design decision that best satisfies both — not a single product configuration step. When you review a missed question, identify which framework or constraint should have driven the answer, not just which option was "more secure" in isolation.

Use only objective-aligned, scenario-based practice material built against the published skills measured outline. Dumps and "real exam question" sites are against Microsoft's candidate agreement, go stale as soon as Microsoft updates the exam (as it is doing on October 21, 2026), and do not build the cross-domain design judgment SC-100 actually tests.

SC-100 compared with associate-level security exams

SC-100 sits above SC-200, SC-300, and SC-500 in Microsoft's security track. Those associate exams test whether you can implement and operate a specific area — security operations, identity, or cloud and AI security engineering. SC-100 tests whether you can design a coherent strategy that spans all of them, reconciling trade-offs between teams that own different parts of the environment.

You cannot reach the Cybersecurity Architect Expert credential without first holding one of those three associate certifications, so SC-100 is best approached as a capstone exam rather than a starting point in Microsoft's security curriculum.

Career value of the Cybersecurity Architect Expert certification

The credential targets architect, principal engineer, and senior consultant roles responsible for an organization's overall security strategy rather than a single control area. It signals that you can translate business and compliance requirements into a coherent, framework-aligned security design across identity, infrastructure, applications, and data.

Because it is an expert-level credential with a real prerequisite requirement, it carries more weight with employers than a single associate exam, but it also expires annually like Microsoft's other role-based certifications. Pair it with documented architecture work — a threat model, a Zero Trust roadmap, or a posture-management rollout — to make the credential's value concrete to a hiring manager.

Exam-day notes

• Associate and expert role-based Microsoft exams without labs run 100 minutes; those that may include labs run 120 minutes. Microsoft does not publish in advance whether a specific SC-100 session will include lab tasks.
• The exam is proctored through Pearson VUE; Microsoft does not list a Certiport option for SC-100, unlike several associate and fundamentals exams.
• Microsoft does not publish a fixed question count or confirm specific item types for SC-100. Most Microsoft certification exams typically contain 40–60 questions.
• Associate and expert exams allow access to Microsoft Learn during the exam for targeted lookups, while the timer continues to run.
• A scaled score of 700 or higher passes; this does not mean exactly 70% correct.
• Schedule with a personal Microsoft account so your exam record does not disappear if you leave an employer or school.