How long to study for SC-200? 3–14 weeks, by background

Short answer, and these are our estimates, not official figures: if you're an IT or security pro new to Microsoft's security tools, plan on about 6–10 weeks of part-time study at roughly 6–8 hours a week. If you already work in Defender XDR and Microsoft Sentinel every day, about 3–4 weeks may be enough. If you're new to security, expect 12–14 weeks or more. Either way, a real share of that time should be hands-on in the Microsoft Defender portal and writing KQL, not just reading.

SC-200 is Microsoft's associate-level exam for security operations analysts: three domains, 100 minutes, and scenarios where you pick the connector, rule, role, response action or query that fits a constraint. Your timeline depends mostly on three things: whether you know security operations work, whether you know Microsoft's tools, and whether you can write KQL. Here's the timeline by background, how to split your hours across the domains, and how to tell when you're ready.

Study time by background

These are rough ranges based on what the outline covers, not guarantees, and not numbers Microsoft publishes. Here's what each background brings:

• Analyst already on Microsoft's stack. You know the incident queue and advanced hunting. Your time goes into the parts you don't touch at work: often data connectors and transformations, retention tiers, Sentinel roles, and Purview Audit and eDiscovery search.
• Analyst on another SIEM or EDR. Triage and response are familiar; Microsoft's names, portals and KQL are new. Budget extra time on KQL and on where each Defender product's alerts come from.
• Azure or Microsoft 365 admin. Identity, RBAC, Azure Policy and diagnostic settings are familiar, which helps with the biggest domain. Incident response and hunting are new, so most of your time goes there.
• IT pro with Security+. You know the concepts but not the tools. Spend your first weeks in the Defender portal and on KQL basics.
• New to security. SC-200 assumes you already know what attacks look like. A vendor-neutral foundation such as CompTIA Security+ first makes SC-200 much easier. Our is SC-200 worth it? post covers who the cert fits.

The exam at a glance

What drives the time: the domain weights

Weight your time the way Microsoft weights the exam. The right-hand column is our arithmetic: the official weight ranges applied to a 40–60 hour plan, which is roughly what 6–8 weeks at 6–8 hours a week works out to. On a shorter or longer track, keep the same proportions.

• Manage a security operations environment is the biggest and broadest: Defender XDR email notifications and alert tuning, Defender for Endpoint advanced features, attack surface reduction rules and indicators, device groups and automation levels, automatic attack disruption, Sentinel automation rules and playbooks, Sentinel roles and Defender unified RBAC, the Analytics and Data lake tiers, workbooks and SOC optimization, data connectors via the Azure Monitor Agent and transformations, and detections (custom detections plus scheduled, NRT and anomaly rules).
• Respond to security incidents covers Defender for Office 365 remediation and zero-hour auto purge, Purview DLP and Defender for Cloud alerts, Defender for Cloud Apps policies, Microsoft Entra ID Protection risk remediation, Defender for Identity alerts, the unified incident queue and Security Copilot, device actions and live response, and Microsoft 365 investigation with Purview Audit, eDiscovery search and Microsoft Graph activity logs.
• Perform threat hunting covers picking the right Defender XDR or Sentinel table, KQL operators and joins, unified advanced hunting, threat analytics, the hunting graph, Sentinel hunting queries, KQL jobs, summary rules and notebooks.

Two timeline profiles

Profile A — the 6-week track (analyst already using Defender XDR or another SIEM)

• Week 1 — set up and connect: take a mixed practice set on day 1 to find your gaps, then Sentinel roles and unified RBAC, data connectors via the Azure Monitor Agent, transformations and retention tiers.
• Week 2 — configure Defender XDR: notifications, alert tuning, Defender for Endpoint advanced features, ASR rules and indicators, device groups, automation levels and attack disruption.
• Week 3 — detections and automation: custom detections, scheduled and NRT rules, anomalies, MITRE ATT&CK coverage, automation rules and playbooks.
• Week 4 — respond: email, identity, cloud and endpoint alerts, device actions and live response, Security Copilot, Purview Audit and eDiscovery search.
• Week 5 — hunt: the right tables, KQL joins and string operators, threat analytics, KQL jobs and summary rules, then a mixed quiz across all three domains.
• Week 6 — mocks: full timed mocks; drill what's under 80%, then book.

Profile B — the 10-week track (IT pro or admin new to Microsoft security operations)

• Weeks 1–4 — manage a security operations environment. Get a test tenant and a Sentinel workspace in week 1 and start writing simple KQL; then connectors and tiers, Defender XDR settings, and detections and automation.
• Weeks 5–7 — respond to security incidents. The incident queue first, then email and identity, then endpoints and Microsoft 365 investigation.
• Weeks 8–9 — perform threat hunting. Tables and KQL first, then the Sentinel hunting tools.
• Week 10 — review and mocks: re-drill everything under 80%, take full timed mocks, then sit the exam.

Want both tracks written out week by week, with a daily routine, four cheat sheets and the KQL to know? That's our SC-200 study plan.

How to use your practice-question scores

• Track accuracy per domain, not overall. 82% overall with managing a security operations environment at 65% isn't ready; that domain is 40–45% of the exam.
• Only count fresh questions. A second pass over questions you've already seen measures memory. Readiness is consistently 80% or higher on questions you haven't seen.
• Read the explanation for every miss, including why each wrong answer is wrong. On SC-200 the wrong answers are usually real features or tables that would be right for a slightly different scenario.
• Finish with a full timed mock at 80%+. CrushCert's mock is 50 questions on a 100-minute timer with a 70% pass line; treat 70% as the floor, not the target.

What makes it take longer (or shorter)

• Skipping KQL practice. Reading a query is easier than writing one. People who never type KQL tend to need more weeks on the hunting domain, not fewer.
• Mixing up the lookalikes. Automation rule vs playbook, NRT vs scheduled rule, custom detection vs analytics rule, Hide vs Resolve vs Set as behavior, Dismiss risk vs Confirm compromised, soft vs hard delete, Isolate vs Contain vs Restrict app execution, SecurityEvent vs WindowsEvent. Drill them side by side.
• Studying from outdated material. Tutorials from before the changes will teach Azure Sentinel in the Azure portal, the Log Analytics agent, Fusion, Archive retention and manually triggered automated investigations. Use current Microsoft Learn pages and a bank written for the October 21, 2026 outline.
• Already in the Defender portal every day? Take a full practice set on day one and spend your time on the parts you don't use at work. That's how the 3-week end of the range happens.

How to study efficiently

• Pair free training with a question bank. Microsoft Learn's free self-paced SC-200 training covers the material; practice questions show you where you're actually weak.
• Use adaptive quizzes so your reps go to the topics you miss rather than the ones you already know.
• Write the queries yourself. CrushCert's six KQL labs have you build hunting and detection queries clause by clause, from failed sign-ins in SigninLogs to lateral movement with dcount(), and coach you on each missing piece. They're simulated (no real workspace), so use them for syntax and recall, and a test tenant for real hunting.
• Pick your question sources deliberately. Our best SC-200 practice tests post compares the free and paid options.

Is it worth the time?

For analysts working on Microsoft's security stack, usually yes: it's Microsoft's current role-based credential for that work, and it renews yearly for free. People new to security and SOCs on other stacks have better-fitting first steps. The full take is in is SC-200 worth it?, and the SC-200 practice test page shows exactly what's in the prep.

Keep reading

Frequently asked questions