Updated 1 Nov 2026 · 5 min read
On this page
What the Microsoft SC-100 is and who it is for
The SC-100, Microsoft Cybersecurity Architect, is the exam behind the Microsoft Certified: Cybersecurity Architect Expert certification. Microsoft describes the role as translating a cybersecurity strategy into capabilities that protect an organisation's assets, business and operations, with solutions that follow Zero Trust principles across identity, devices, data, AI, applications, network, infrastructure and DevOps.
It is not an entry point. Microsoft expects implementation experience across security areas and expert skills in at least one. To hold the certification you must also earn one of three associate certifications: Identity and Access Administrator (SC-300), Security Operations Analyst (SC-200) or Cloud and AI Security Engineer (SC-500).
Microsoft's update to the English version of the exam takes effect on 21 October 2026, and localised versions follow about eight weeks after that date. The study guide lists the skills measured as of 21 October 2026, and that is the version described here. Its change log rates the changes as minor, in two objective groups: security operations and securing Microsoft 365.
Microsoft SC-100 at a glance
| Item | Detail |
|---|---|
| Exam code | SC-100 |
| Questions | Not published for this exam. Microsoft says most of its exams have 40 to 60 and the number varies |
| Time allowed | Not listed on the SC-100 page. Microsoft's expert role-based exams run 100 minutes, or 120 if they may contain labs, and you are told the exam time when you register |
| Passing score | 700 out of 1,000, scaled |
| Exam fee | US$165 in the US, priced by country or region elsewhere |
| Languages | English, Japanese, Chinese (Simplified and Traditional), Korean, German, French, Spanish, Portuguese (Brazil) and Italian |
| Where you sit it | Pearson VUE, online proctored or at a test centre |
| Certification valid for | One year, renewed free by passing an online assessment on Microsoft Learn |
What is on the exam
Design solutions that align with security best practices and priorities (20 to 25%). The frameworks domain. Resiliency against ransomware, including backup and restore and prioritising privileged access. Alignment with the Microsoft Cybersecurity Reference Architectures (MCRA), the Microsoft Cloud Security Benchmark (MCSB) and the Zero Trust adoption framework. Then the Cloud Adoption Framework, the Well-Architected Framework, Azure landing zones, secure AI adoption and DevSecOps.
Design security operations, identity, and compliance capabilities (25 to 30%). XDR and SIEM, SOAR with Microsoft Sentinel and Defender XDR, logging with Purview Audit, and detection coverage mapped to MITRE ATT&CK. Identity in hybrid and multicloud estates, external identities, agent identities with Microsoft Entra Agent ID, Conditional Access and AD DS hardening. Privileged access through the enterprise access model, PIM and access reviews. Compliance means turning requirements into controls with Purview, Azure Policy and Defender for Cloud.
Design security solutions for infrastructure (25 to 30%). Posture management with Defender for Cloud, Secure Score, Azure Arc, Defender External Attack Surface Management and Microsoft Security Exposure Management. Requirements for servers, mobile devices, IoT and OT, plus Windows LAPS. SaaS, PaaS and IaaS baselines, containers and Azure AI services. Network design with Entra Internet Access and Entra Private Access.
Design security solutions for applications and data (20 to 25%). Microsoft 365 security with Defender for Office 365, Defender for Cloud Apps, Intune, Purview and the data controls in Microsoft 365 Copilot. Application security through threat modelling, workload identities, API management and Azure Web Application Firewall. Data security from classification and encryption with Key Vault to Azure SQL, Cosmos DB, Storage and data used in AI workloads.
Why people fail it
The biggest trap is altitude. Candidates who passed an associate exam know how to configure Defender, Sentinel or Conditional Access, and they answer as if they were still implementing. Almost every objective starts with design, evaluate, specify or recommend. The exam asks what you would propose and why, not which setting you would change.
The second is the shape of the objectives. Many ask you to design solutions that align with Zero Trust and Microsoft's reference material, the MCRA and the MCSB, so expect scenarios where several answers would work but only one fits that material. Microsoft's exams can also include case studies, where one long scenario feeds several questions, so one misread requirement can cost more than one mark.
Third, no domain is below 20%, so a strong area cannot carry a weak one. Finally, the objectives name products many practitioners have never deployed, such as Entra Agent ID, Security Exposure Management and Entra Private Access. Expect them in scenarios anyway.
A study plan that fits the exam
Six weeks suits most people who already hold an associate certification. The heaviest domain, security operations, identity and compliance, is split over two weeks, the other three get a week each, and the last week is timed practice.
- Week 1: frameworks. The MCRA, the MCSB, the Zero Trust adoption framework, then landing zones and ransomware resiliency. End with the free SC-100 practice questions to see how design questions are worded.
- Week 2: security operations and compliance. XDR versus SIEM, SOAR, MITRE ATT&CK coverage, then turning regulations into controls with Purview and Azure Policy.
- Week 3: identity and privileged access. Hybrid Entra ID, external and agent identities, Conditional Access, AD DS hardening, PIM and access reviews.
- Week 4: infrastructure. Defender for Cloud, Secure Score, Exposure Management, endpoint and OT requirements, containers and Security Service Edge.
- Week 5: applications and data. Microsoft 365 and Copilot data controls, threat modelling, API management and WAF, classification and encryption.
- Week 6: timed runs. Take Microsoft's free Practice Assessment, then work through the questions-only copy in the SC-100 practice question pack in timed blocks. Read the explanation for every miss, especially where two answers looked valid.
On exam day
You book through Pearson VUE and sit the exam online, proctored by webcam and microphone, or at a test centre. Online, you can check in from 30 minutes before your appointment, and Microsoft says check-in takes about 15 minutes, so start early.
Five minutes of break time is built in, but the clock keeps running and you cannot return to questions you saw before a break, even inside a case study. You can open Microsoft Learn during the exam, but the timer keeps going, so use it only for the odd fact. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Frequently asked questions
What happens if I fail the SC-100?
You can retake it after 24 hours. After that, Microsoft imposes a 14 day wait between attempts, with no more than five attempts in 12 months from the first. You pay for each retake, so it is worth being ready the first time.
Should I wait for the 21 October 2026 update?
There is no need. Microsoft rates the changes as minor and limited to two objective groups. If you sit in English on or after 21 October, reread the security operations and Microsoft 365 objectives in the study guide first.
I hold Azure Security Engineer Associate. Does it count?
It is not one of the three associate certifications on the SC-100 certification page, and Microsoft retired it, along with its exam, on 31 August 2026. Check your Microsoft Learn profile before you book.
Is the practice pack enough on its own?
No. The pack is practice, not a course. Its 360 questions show how SC-100 frames design decisions and explain why each wrong option is wrong, but they do not replace reading the MCRA and the Zero Trust guidance or real implementation experience. Learn the material on Microsoft Learn, then use the pack to find your gaps.
When you are ready to test yourself properly, get the SC-100 practice questions with full explanations.
Sources
The official pages the facts in this guide were checked against.
- learn.microsoft.com/en-us/credentials/certifications/exams/sc-100/
- learn.microsoft.com/en-us/credentials/certifications/cybersecurity-architect-expert/
- learn.microsoft.com/en-us/credentials/certifications/identity-and-access-administrator/
- learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/
- learn.microsoft.com/en-us/credentials/certifications/cloud-and-ai-security-engineer-associate/
- learn.microsoft.com/en-us/credentials/certifications/azure-security-engineer/
- learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-100
- learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
- learn.microsoft.com/en-us/credentials/certifications/exam-scoring-reports
- learn.microsoft.com/en-us/credentials/exam-pricing.json
- learn.microsoft.com/en-us/credentials/certifications/online-exams
- learn.microsoft.com/en-us/credentials/certifications/renew-your-microsoft-certification
- learn.microsoft.com/en-us/credentials/support/retake-policy