CertQuests
What is the Microsoft SC-100 Cybersecurity Architect Expert?
The SC-100 (Designing Microsoft Cybersecurity Architecture) is the capstone of Microsoft’s security certification track. Where the associate-level security exams (SC-200 for security operations, SC-300 for identity, AZ-500 for Azure security engineering) validate implementation skills in specific domains, SC-100 validates the ability to think across all of those domains simultaneously and design the overarching strategy that ties them together. An SC-100 architect is not configuring individual security controls — they are deciding which controls belong in the architecture, how they interact, and how the total design maps to business risk tolerance and compliance obligations.
The exam was introduced in July 2022 and has been updated through exam refresh cycles since. It sits at the Expert tier alongside other Microsoft Expert certifications (Azure Solutions Architect Expert, Azure DevOps Engineer Expert, Microsoft 365 Enterprise Administrator Expert), making it one of the most prestigious credentials in the Microsoft ecosystem. Unlike the associate-level exams, which test configuration-level knowledge against specific Azure services, SC-100 tests design-level reasoning across hybrid environments, multi-cloud deployments, and cross-organizational security boundaries — the kind of decisions a Chief Information Security Officer (CISO) or enterprise security architect makes, translated into exam format.
Exam prerequisites and eligibility
SC-100 has formal prerequisites that distinguish it from every Microsoft associate-level exam. To sit the SC-100, candidates must hold two active credentials:
- An active Associate-level Microsoft certification in any Azure, Microsoft 365, or security domain (e.g., Azure Administrator Associate AZ-104, Azure Security Engineer Associate AZ-500, Security Operations Analyst Associate SC-200, Identity and Access Administrator Associate SC-300, Information Protection and Compliance Administrator Associate SC-400)
- A qualifying security or advanced exam: specifically, at least one of SC-200, SC-300, SC-400, AZ-500, MS-500 (Microsoft 365 Security Administration), or an equivalent expert-track qualifying exam
In practice, most candidates come to SC-100 after having passed SC-200 (Security Operations Analyst) or AZ-500 (Azure Security Engineer Associate), as those exams provide the deepest technical grounding in the security tooling and attack surface Microsoft’s architecture questions reference. Candidates who skip directly to SC-100 from a non-security associate exam (such as AZ-104) without the security domain background consistently find the exam significantly harder, because the design questions assume familiarity with what Microsoft Sentinel, Microsoft Defender XDR, Entra ID, and Azure Policy actually do before asking how to incorporate them into a broader architecture.
Exam format and domains
The SC-100 exam is administered at Pearson VUE testing centers and as an online proctored exam. The fee is $165 USD. The passing score is set on a scaled basis and has historically been 700 out of 1000, consistent with other Microsoft Expert certifications. The exam contains approximately 40–60 questions (the count varies by form) and must be completed in 120 minutes. Questions include multiple choice, multiple select, case studies, and drag-and-drop architecture design scenarios.
| Domain | Weight |
|---|---|
| 1. Design solutions that align with security best practices and priorities | 20–25% |
| 2. Design security operations, identity, and compliance capabilities | 25–30% |
| 3. Design security solutions for infrastructure | 35–40% |
| 4. Design security solutions for applications and data | 20–25% |
Domain 1: Design solutions that align with security best practices and priorities — 20–25%
This foundational domain establishes the architectural thinking required for the entire exam. It tests the ability to translate organizational risk tolerance, regulatory obligations, and business objectives into security design requirements — the “why” behind every security control decision. Core areas include: Zero Trust architecture — Microsoft’s implementation of Zero Trust across the six pillars (identities, endpoints, applications, data, infrastructure, network) and how to apply the Verify Explicitly / Use Least Privilege / Assume Breach principles to design decisions at each pillar; Cloud Adoption Framework (CAF) security — how Microsoft’s Cloud Adoption Framework maps to security domain ownership, migration landing zones, and the Secure methodology for cloud environments; and Microsoft Security Development Lifecycle (SDL) — integrating security into the software development process at the design, development, verification, and release stages.
The domain also covers regulatory compliance design — how to map a compliance requirement (GDPR, HIPAA, PCI-DSS, FedRAMP, ISO 27001) to specific Azure controls, Microsoft Purview compliance capabilities, and Microsoft Defender for Cloud regulatory compliance views. Candidates must understand how to evaluate which compliance controls can be inherited from the cloud provider (Azure) and which remain the customer’s responsibility under the shared responsibility model. Resiliency and business continuity are also tested: how to design backup and recovery architectures that preserve data availability while meeting recovery time objectives (RTOs) and recovery point objectives (RPOs) under security-incident scenarios like ransomware attacks.
Domain 2: Design security operations, identity, and compliance capabilities — 25–30%
This is the widest-scope domain and covers three distinct sub-areas that are each large enough to be standalone certifications at the associate level. The security operations (SecOps) sub-area covers how to design a Security Operations Center (SOC) architecture using Microsoft Sentinel: workspace design (single vs. multiple workspaces, cost vs. coverage tradeoffs), log ingestion strategy (which log sources are critical, how to manage ingestion cost), analytics rule design (scheduled rules vs. near-real-time rules, Microsoft Security Insights vs. custom KQL), and SOAR (Security Orchestration, Automation, and Response) architecture using Sentinel playbooks (Logic Apps). The exam tests design decisions — which data connector architecture supports the organization’s detection requirements — not Sentinel configuration syntax.
The identity and access sub-area covers Microsoft Entra ID (formerly Azure AD) architecture for enterprise environments: hybrid identity design (Azure AD Connect vs. cloud-only vs. Azure AD Connect Cloud Sync), Privileged Identity Management (PIM) for just-in-time access and role activation workflows, Conditional Access policy design (named locations, sign-in risk vs. user risk policies, authentication strength requirements), and External Identities (B2B collaboration, B2C customer identity, cross-tenant access settings). The Sub-area also covers Entra Permissions Management (Microsoft’s CIEM solution for multi-cloud permissions visibility) and Microsoft Entra Verified ID for decentralized identity use cases. The compliance sub-area covers Microsoft Purview: Information Protection (sensitivity labels, auto-labeling policies), Data Lifecycle Management (retention labels and policies, records management), and Communication Compliance for regulatory monitoring scenarios.
Domain 3: Design security solutions for infrastructure — 35–40%
At 35–40%, Infrastructure is the SC-100’s most heavily weighted domain and the area where most candidates invest the most preparation time. It covers the full range of infrastructure security design decisions across Azure IaaS, PaaS, hybrid on-premises, and multi-cloud environments. Microsoft Defender for Cloud is central to this domain: Defender for Cloud Plans (which plans cover which resource types — Defender for Servers, Defender for Containers, Defender for SQL, Defender for Storage, etc.), the Secure Score architecture, Cloud Security Posture Management (CSPM) vs. Cloud Workload Protection (CWP) roles, and how Defender for Cloud integrates with multi-cloud environments (AWS and GCP) via the Azure Arc connector.
Network security design is tested at architecture depth: how to position Azure Firewall, Azure Firewall Premium, Azure Web Application Firewall (WAF), Azure DDoS Protection Standard, and Network Security Groups (NSGs) as layered controls; when to use Azure Private Link vs. VNet Service Endpoints for PaaS service isolation; how to design hub-and-spoke or Virtual WAN topologies with security in mind; and how to implement network segmentation using Azure Virtual Network Manager. The domain also covers Microsoft Sentinel network analytics — using network flow logs, Traffic Analytics, and NSG flow logs as data sources for network-based threat detection in Sentinel.
Endpoint and server security design covers Microsoft Defender for Endpoint (MDE) deployment architecture across Windows, Linux, macOS, Android, and iOS; the Microsoft Defender XDR (Extended Detection and Response) platform as the unified security operations surface; and Microsoft Intune for endpoint compliance policy and conditional access integration. The container security sub-area covers Defender for Containers (Azure Kubernetes Service runtime threat detection, image vulnerability assessment, Kubernetes admission control via Azure Policy for Kubernetes), and how to design a secure container deployment pipeline from image build through runtime protection. Azure Policy and Microsoft Defender for Cloud Recommendations as the governance and posture enforcement layer — how policies, initiatives, and compliance assignments translate into the Secure Score and the Regulatory Compliance dashboard — are also heavily tested in this domain.
Domain 4: Design security solutions for applications and data — 20–25%
The Applications and Data domain covers the security design decisions that span the software development lifecycle and the data estate. Application security design, includes: how to integrate security into Azure DevOps pipelines (SAST with GitHub Advanced Security, secret scanning, dependency review, container image scanning); how to design API security using Azure API Management (subscription keys, OAuth 2.0 / JWT validation policies, rate limiting, backend mTLS); and how to design authentication and authorization for web applications using Microsoft Entra ID app registrations, app roles, OAuth 2.0 authorization code flow with PKCE, and managed identities for Azure services that eliminate credential management entirely.
Data security design covers: how to protect data at rest (Azure Storage encryption, Azure Disk Encryption, Transparent Data Encryption for Azure SQL, Customer-Managed Keys via Azure Key Vault); how to protect data in transit (TLS enforcement, Azure Front Door end-to-end TLS, Private Endpoints eliminating public routing); and how to implement data classification and discovery at scale using Microsoft Purview Data Map (automated scanning, classification rules, sensitivity label propagation across Azure data sources). The domain also covers Microsoft Defender for Storage (malware scanning on upload, anomalous access detection) and Microsoft Defender for SQL (SQL injection attack detection, anomalous database access) as data-tier security controls. Azure Key Vault architecture is tested in depth: Vault vs. Managed HSM, access policies vs. Azure RBAC for Key Vault authorization, soft-delete and purge protection for key lifecycle management, and how to design key rotation policies that don’t require application downtime.
SC-100 vs SC-200 vs AZ-500: which Microsoft security cert should you pursue?
SC-200 — Security Operations Analyst
Focus: Detect and respond to threats using Microsoft Sentinel and Microsoft Defender XDR. Depth: Configuration and operation of SIEM/SOAR/EDR tools. Target role: SOC analyst, threat hunter, incident responder. Best if: You work in a SOC or want to, and your day involves investigating alerts and writing detection rules, not designing the security architecture.
AZ-500 — Azure Security Engineer
Focus: Implement and manage Azure security controls (Entra ID, Key Vault, Defender for Cloud, network security). Depth: Hands-on configuration of Azure security services. Target role: Azure security engineer, cloud security engineer. Best if: You implement security controls in Azure and want to validate the implementation-level knowledge that SC-100 then asks you to synthesize into an architecture.
SC-100 — Cybersecurity Architect Expert
Focus: Design end-to-end cybersecurity strategies across hybrid and multi-cloud environments. Depth: Architecture and design reasoning across all security domains. Target role: Cybersecurity architect, principal security engineer, CISO-track. Best if: You have 5+ years of security experience, hold at least one Microsoft security associate cert, and want the highest-level Microsoft security credential that demonstrates strategic thinking, not just tool configuration.
The three certifications are not mutually exclusive — they form a progression. SC-200 or AZ-500 builds the domain knowledge SC-100 then asks you to reason across. Many enterprise security architects hold all three: SC-200 validates the operations background, AZ-500 validates the implementation background, and SC-100 validates the design-level synthesis that comes from having both.
The Microsoft security certification track in 2026
Microsoft’s security certification track has expanded significantly since 2020. What was once a relatively narrow set of certifications focused on on-premises Windows Server and Office 365 security has grown into a comprehensive portfolio covering cloud security, identity governance, information protection, security operations, and AI security. The current Expert-level security credential (SC-100) reflects this expansion: its four domains deliberately cross the boundaries of the associate exams, requiring candidates to reason about how an SC-200’s Sentinel architecture interacts with the SC-300’s Conditional Access design, which in turn interacts with the AZ-500’s network isolation design.
A significant 2026 development affecting SC-100 preparation is the continued expansion of Microsoft Security Copilot integration across the Microsoft Defender XDR, Sentinel, Entra ID, and Purview surfaces. Microsoft Security Copilot is now covered in the SC-100 blueprint as part of the security operations design domain — candidates are expected to understand how generative AI-assisted investigation and triage changes SOC workflow design, and how to evaluate Security Copilot’s role in a modern security architecture. This addition reflects Microsoft’s broader bet that AI-augmented security operations will be a standard architecture component within the next two to three years, and that architects need to account for it in their designs today.
SC-100 is not a tool certification. It tests whether you can look at a business requirement, a compliance obligation, and a threat model and design a security architecture that addresses all three simultaneously — using Microsoft’s tool ecosystem as the building blocks.
Salary impact and career outcomes
SC-100 occupies the top of the Microsoft security certification hierarchy, and salary data from 2026 reflects that position. Cybersecurity architects with the SC-100 credential earn median base salaries of $130,000 to $175,000 in North American markets, with senior and principal security architects at enterprise organizations reaching $180,000 to $220,000 when combined with significant hands-on experience (typically 8+ years in security roles). The premium over associate-level security certifications (SC-200, AZ-500, SC-300) is substantial — typically 25–45% higher — reflecting the combination of domain breadth and design-level seniority that the Expert credential signals.
The demand drivers for cybersecurity architects in 2026 are structural: enterprise organizations continue to expand their cloud footprint (increasing the attack surface architects must design for), regulatory environments are tightening globally (the EU Cyber Resilience Act, updated NIST CSF 2.0, and sector-specific regulations all require documented security architecture work), and the increasing sophistication of threat actors (ransomware-as-a-service, state-sponsored supply chain attacks) has elevated security architecture from a compliance function to a board-level priority. These trends make SC-100 one of the most career-relevant certifications in the Microsoft ecosystem for experienced security professionals in 2026.
Who should pursue Microsoft SC-100 in 2026
Study approach and resources
The official Microsoft preparation path for SC-100 is the SC-100T00-A: Microsoft Cybersecurity Architect instructor-led course (4 days, available through Microsoft Learning Partners). The course maps directly to the four exam domains and includes case study exercises that practice the architectural reasoning style the exam tests. Microsoft Learn offers a free self-paced learning path that covers all SC-100 domains: the path is organized around the four domain areas and includes knowledge checks that mirror the exam question style. The Microsoft Learn path is the starting point for all SC-100 candidates, regardless of whether they supplement it with additional resources.
Given SC-100’s design emphasis, the most effective supplementary preparation is working through Microsoft architecture case studies: the Microsoft Cloud Adoption Framework (CAF) security documentation and the Azure Architecture Center’s security design guidance provide real-world scenarios that develop the reasoning the exam tests. Candidates preparing for SC-100 consistently report that the exam questions are not answered by memorizing service features — they require applying design principles to scenario descriptions, which means preparation must involve reasoning through scenarios rather than passive reading.
For the case study portions of the exam, practice with Microsoft Sentinel workspace design scenarios (understanding when multiple workspaces are justified vs. when a single workspace is preferred, and what the cost and coverage implications of each choice are) and Zero Trust network segmentation design scenarios (how to translate a flat network with lateral movement risk into a segmented architecture using Azure Firewall, NSGs, and Private Endpoints) are particularly high-value. These two scenario types appear frequently in SC-100 case studies because they require candidates to reason about tradeoffs — cost vs. coverage, security vs. operational complexity — rather than identify a single “correct” configuration.
Microsoft’s official SC-100 learning path on Microsoft Learn is free and updated with each exam refresh cycle. It’s the authoritative source for what the current exam blueprint covers. Microsoft also publishes free Microsoft Applied Skills credentials in areas like “Secure Azure services and workloads with Microsoft Defender for Cloud regulatory compliance controls” that serve as practical checkpoints on the path to SC-100.
Practice Microsoft security questions free on CertQuests.
Microsoft Security Practice Questions →