SC-200 is Microsoft's Security Operations Analyst Associate exam, and it has quietly become one of the more interesting AI-in-security credentials around. Microsoft Security Copilot gets roughly 700 searches a month and most people looking it up want to know how it is used day to day. This exam is where Microsoft actually writes that down. The exam covers three areas: managing a security operations environment (40 to 45%), responding to security incidents (35 to 40%) and threat hunting (20 to 25%). In practice that means configuring Defender XDR and Microsoft Sentinel, ingesting data, writing detection rules, investigating incidents across Defender for Endpoint, Office 365, Identity and Cloud Apps, and hunting with KQL.
It is 100 minutes, proctored through Pearson VUE, with a pass mark of 700. Price depends on country; in the US it is about $165. The English version updates on 21 October 2026. The new objectives include investigating incidents by using agentic AI, including embedded Microsoft Security Copilot, plus hunting with notebooks connected to the Sentinel MCP server and analysing entity relationships with Sentinel Graph. The candidate profile now lists familiarity with AI agents and Copilots alongside Windows and Azure.
That is a big shift. It means Microsoft expects a mid-level SOC analyst to supervise AI-driven investigation, not just run queries. I like this direction, with a caveat. The useful skill is knowing when Copilot's summary of an incident is wrong. The training explains what Copilot does, but it is quieter about failure modes: hallucinated entity relationships, summaries that skip the one odd log line that matters, and confident recommendations based on incomplete data.
Microsoft is the vendor selling Security Copilot capacity, so it is not the party that will teach you to distrust it. Bring that scepticism yourself. The practical problem is access. Security Copilot runs on paid compute units, and a personal Azure trial will not give you much of it. Most learners will understand the AI objectives from documentation and demos rather than hands-on use.
The rest of the exam is very practisable with a free trial and Microsoft's sample data, and the KQL work is the part you will use daily in any Microsoft SOC. Training is free on Microsoft Learn, there is a free practice assessment, and renewal each year is a free online test. That is far kinder than most security certs. I give it 4.1. Free training, a fair exam, current AI content and cheap upkeep. It loses points for being locked to one vendor and for teaching the AI features without much on their limits.