Microsoft Security Certifications in 2026: SC-900, SC-200, SC-300, and SC-401

Microsoft’s security certification lineup has changed enough that older “SC-series” articles can now be actively misleading. In 2026, candidates should distinguish the current fundamentals and role-based exams from retired credentials rather than treating SC-200, SC-300, SC-400, and SC-900 as an unchanged four-exam family.

The most important correction is SC-400. Microsoft retired the Information Protection and Compliance Administrator Associate certification and SC-400 exam on May 31, 2025. The current information-security administration path is SC-401, Microsoft Information Security Administrator. SC-200, SC-300, and SC-900 remain current, while Microsoft continues to update their measured skills as products and job roles evolve.

For most candidates, the useful comparison is therefore SC-900 for security, compliance, and identity fundamentals; SC-200 for security operations; SC-300 for identity and access administration; and SC-401 for information protection, data security, and related Microsoft Purview responsibilities. They overlap in the Microsoft security ecosystem, but they validate different kinds of work.

SC-900 is the foundation, not a junior version of the other exams

SC-900 is designed for people who need a conceptual understanding of security, compliance, and identity across Microsoft Azure and Microsoft 365. It covers security and compliance concepts, Microsoft Entra capabilities, Microsoft security solutions, and Microsoft compliance solutions. The emphasis is understanding what the capabilities do and why an organization would use them.

That makes SC-900 useful for business stakeholders, new IT professionals, students, and technical staff moving into Microsoft security. It can also give candidates a vocabulary for Entra, Defender, Sentinel, and Purview before they take a more implementation-heavy role exam.

However, SC-900 is not a prerequisite for SC-200, SC-300, or SC-401. Experienced practitioners can move directly to the role that matches their work. A security analyst who already investigates incidents in Sentinel does not need to delay SC-200 solely to collect the fundamentals credential first.

Microsoft has announced an English SC-900 skills update for October 21, 2026. Candidates testing before that date should use the current July 28 blueprint and verify the study guide again for later appointments.

SC-200 is for security operations and threat response

SC-200 is the most operations-centered exam in this group. The current role focuses on triage, incident response, threat hunting, detection engineering, and automation across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra signals, Microsoft Purview evidence, and Defender for Cloud workload protections.

The July 28, 2026 blueprint gives 40–45% to managing a security operations environment, 35–40% to responding to security incidents, and 20–25% to threat hunting. That weighting tells candidates something important: SC-200 is not simply a Sentinel query exam. It expects you to understand how a SOC is configured and operated, how alerts become incidents, how analysts investigate across products, and how KQL and automation support the work.

If your daily work involves security monitoring, incident triage, hunting, KQL, Defender XDR, Sentinel analytics, or security automation, SC-200 is the closest role match. The cross-product workflow in Defender XDR investigations and Sentinel analytics and automation shows how evidence, detections, incidents, and response decisions connect.

Microsoft has also published a skills update for October 21, 2026, so candidates should tie their final preparation to their actual exam date.

SC-300 is for identity and access administration

SC-300 validates a different security boundary: identity. The Microsoft Identity and Access Administrator role designs, implements, operates, troubleshoots, and governs identity and access using Microsoft Entra. Current objectives cover user identities, authentication and access management, workload identities, and identity governance.

This is the right path for professionals working with Conditional Access, authentication methods, hybrid identity, enterprise applications, service principals, managed identities, entitlement management, access reviews, Privileged Identity Management, and identity monitoring.

SC-300 is broader than “Azure AD administration,” an older framing that no longer captures the role well. Candidates need to understand Microsoft Entra as an access-control system across human and workload identities, cloud and hybrid environments, applications, and Azure resources. Microsoft Entra identity design brings those human, workload, policy, and governance pieces into one architecture.

The current English blueprint is measured from April 27, 2026, with another update announced for October 28, 2026. Again, the exam date matters.

SC-401 replaced the retired SC-400 path

SC-400 should now be treated as legacy context. Microsoft retired the SC-400 exam and its Information Protection and Compliance Administrator Associate certification on May 31, 2025. Candidates researching old study plans may still encounter SC-400 references, practice material, and job descriptions, but they should not describe it as the current Microsoft exam for this role.

The current exam is SC-401, aligned to the Microsoft Information Security Administrator role. Its scope centers on protecting sensitive data, managing information-protection and data-loss-prevention capabilities, mitigating risks around data, and using Microsoft Purview and related security capabilities in current environments.

There is still value in understanding what SC-400 covered historically because organizations may use older terminology and some core information-protection concepts continue. But a new candidate should map preparation to SC-401, not build a plan around the retired SC-400 exam.

SC-401 itself has a scheduled English skills update on October 28, 2026. That makes date-aware preparation particularly important in October 2026.

Choose by job function, not by exam-code sequence

These credentials are not a ladder that every candidate needs to climb in numerical order. SC-900 can provide broad context, but SC-200, SC-300, and SC-401 are role-aligned paths. Choose the exam that matches the decisions you make at work or the role you are trying to enter.

A security operations analyst who spends the day investigating alerts and hunting threats should prioritize SC-200. An identity engineer responsible for access policy, authentication, hybrid identities, and privileged access should prioritize SC-300. A professional responsible for information protection, DLP, insider risk, or Purview-centered data security should evaluate SC-401.

The strongest preparation often includes adjacent knowledge. SC-200 analysts benefit from understanding identity because compromised identities appear in incidents. SC-300 administrators benefit from security-operations context because risky sign-ins and investigations can influence access decisions. SC-401 professionals benefit from identity and threat context because sensitive-data protection does not operate in isolation.

Do not confuse product overlap with role overlap

Microsoft Entra, Defender, Sentinel, and Purview appear across multiple security roles. That does not mean the exams test them in the same way. SC-900 asks what a capability is and why it matters. SC-200 asks how evidence and detections support security operations. SC-300 asks how identity and access controls should be designed and governed. SC-401 asks how information and data risks are classified, protected, monitored, and investigated.

A single technology can therefore create very different exam questions. Microsoft Entra identity risk may be conceptual in SC-900, part of an incident investigation in SC-200, and a direct access-policy input in SC-300. Microsoft Purview can appear as a compliance capability in fundamentals, as investigation context in security operations, or as the core platform for SC-401 data-security tasks.

When comparing certifications, focus on the decision the candidate is expected to make rather than the product logo shown in the objective list.

Use current blueprints instead of old course outlines

Microsoft updates role-based exams regularly. Course names, product branding, objective groupings, and feature emphasis can change without the role disappearing. A preparation plan copied from an old article can therefore be wrong even when many individual concepts remain useful.

For October 2026 specifically, multiple exams have announced updates within the same month: SC-200 and SC-900 on October 21, with SC-300 and SC-401 on October 28. Candidates should verify the official study guide against the date they will actually sit the exam rather than assuming the newest visible objective list is already in force.

The transition dates also affect how you use third-party notes. A topic that appears in both old and new objectives may remain valuable, but a change in objective grouping can signal a different emphasis or workflow. Keep durable technical knowledge, discard retired product assumptions, and re-map every final study checklist to the official blueprint that applies on the appointment date.

This is also why current role descriptions matter more than “new certification” marketing language. The goal is to validate a real security function—operations, identity, information security, or fundamentals—not to collect codes in release order.

Build bridges between roles without duplicating an entire certification

Adjacent knowledge is useful when it explains a dependency. An SC-200 analyst should understand enough identity to interpret risky users and sign-in evidence, but does not need to reproduce the full SC-300 governance curriculum. An SC-300 administrator should understand incident context well enough to react to compromised identities, but does not need to become a Sentinel detection engineer before taking the exam.

Likewise, SC-401 candidates should understand where Purview data signals meet identity and security operations, while still keeping the center of gravity on information security. This boundary-based approach makes study plans smaller and more realistic: learn your primary role deeply, then add neighboring concepts only where they change the decisions you must make.

If you are planning more than one exam, sequence them by overlap in your work. A security analyst moving into identity engineering may find SC-200 followed by SC-300 logical. A compliance or data-security professional may use SC-900 for vocabulary before SC-401. The best sequence is the one that lets each credential reinforce practical responsibilities rather than merely follow exam-code order.

Build a security-certification plan around practical evidence

Before choosing an exam, list the tasks you can already perform without a walkthrough. Can you investigate an incident across Defender XDR and Sentinel? Can you write and troubleshoot KQL? Can you design Conditional Access and explain its effective result? Can you govern privileged access? Can you classify information, design DLP controls, or investigate data risk? The strongest exam choice is the one whose gaps are closest to the role you actually want.

Then build labs that produce evidence. For SC-200, complete an investigation and hunting cycle. For SC-300, trace a human and workload identity through authentication and authorization. For SC-401, protect and monitor sensitive information through a realistic policy lifecycle. For SC-900, be able to explain the Microsoft security architecture to someone who is not a specialist.

Microsoft’s security certification family is more useful when treated as a set of role signals rather than an ordered checklist. In 2026, the current comparison is SC-900, SC-200, SC-300, and SC-401, with SC-400 retained only as historical context. Choose the path that validates the work you need to do now.