Microsoft’s security certs split by role, not by a single staircase. SC-900 is optional literacy. After that you pick operations (SC-200), identity (SC-300), or Azure security engineering (AZ-500).
Start: SC-900 study guide · SC-900 practice. Already an Azure admin? Jump to AZ-500 or SC-300.
The four certs
| Cert | Role | Prerequisite in practice |
|---|---|---|
| SC-900 | Security, compliance, identity concepts | None |
| SC-200 | Security operations analyst (Sentinel, Defender) | Comfortable with Microsoft 365 / Azure portals |
| SC-300 | Identity and access administrator (Entra) | Directory and Conditional Access thinking |
| AZ-500 | Azure security engineer | AZ-104-level admin skill |
SC-900 does not teach you to run Sentinel or write Azure Policy. It is a vocabulary exam. Skip it if you already hold AZ-104 or Security+.
Which associate after SC-900?
You work in a SOC / Microsoft Defender stack: SC-200.
You own Entra ID, Conditional Access, PIM, and lifecycle: SC-300. This is the identity job.
You lock down Azure subscriptions, Key Vault, network security, and Defender for Cloud: AZ-500. Take AZ-104 first if you cannot already deploy VNets and RBAC.
Many identity admins take SC-300 then AZ-500. Many cloud admins take AZ-104 then AZ-500 and never sit SC-200.
Broader security map: Best cybersecurity certs 2026. Azure family: Azure roadmap.
Suggested sequences
- Compliance / GRC in a Microsoft shop: SC-900 → optional SC-300 (identity governance) → not AZ-500 unless you engineer Azure.
- SOC analyst: Security+ or SC-900 → SC-200.
- Azure administrator going security: AZ-104 → AZ-500 → optional SC-300.
- Pentest / general security: stay on CompTIA / ISC2; add SC-900 only if the employer is Microsoft-centric.
Ready to Pass Your Microsoft SC-900 Exam?
Get 300+ practice questions with detailed explanations, flashcards, and full-length practice exams. Try 10 free practice questions. Unlock 300+ questions and timed exams when you are ready.
✓ Plans from $19.99/mo • ✓ Cancel anytime • ✓ 91 certifications
