SC-200 study plan: 6-week & 10-week schedules

Here's a concrete, week-by-week plan for Microsoft SC-200 (Microsoft Security Operations Analyst), in two tracks: 6 weeks if you're already a SOC analyst, on Microsoft's tools or another SIEM, and 10 weeks if you're an IT pro or admin new to Microsoft security operations. Both run on the same daily routine of about an hour (roughly 6–8 hours a week), both follow the official domain weights, both put hands-on time in the Microsoft Defender portal and KQL into every week, and both finish with timed mocks. Book the exam when you're consistently scoring 80%+ on fresh questions.

SC-200 isn't a "describe" exam; it's a "choose and do" exam. Most questions describe an alert, an incident or a hunting task and a constraint, and ask which connector, rule, role, response action or query fits. The wrong answers are real options that would work for a slightly different need. So this plan pairs Microsoft's free training with practice questions, portal time and KQL from week one, and ends with four cheat sheets and the KQL worth knowing.

The exam you're planning for

Managing a security operations environment is the biggest domain at 40–45%, so both tracks spend the most weeks there. Because the 700/1000 score is scaled and Microsoft doesn't publish the question count, aim higher than the mock pass line: 80%+ on fresh questions in every domain, not 70%.

Which track are you on?

Those line up with our estimates in how long to study for SC-200, which also has the per-domain hour split.

The daily routine (every study day)

• 20 minutes — learn: the matching module in Microsoft Learn's free self-paced SC-200 training. Read for when you'd choose this over the alternative, not just what the feature does.
• 20 minutes — hands-on: do the thing you just read about in the Defender portal of a test tenant, and write at least one KQL query.
• 15 minutes — practice questions on that day's topic on CrushCert, plus a few mixed questions from earlier weeks so nothing goes cold.
• 5–10 minutes — review misses and flashcards: read the explanation for every wrong answer and say what each wrong choice would be right for; then run flashcards on the lists that blur together (Sentinel roles, connectors and tables, alert tuning actions, device actions).

Track 1: the 6-week plan (SOC analyst)

• Week 1 — set up and connect (domain 1): start with a 30-question mixed set to find your gaps. Then Sentinel roles and Defender unified RBAC (cheat sheet 1); Windows Security Events via AMA, Windows Forwarded Events, Syslog and CEF via AMA, Azure Activity through Azure Policy, and threat intelligence connectors (cheat sheet 2); transformations; the Analytics and Data lake tiers (cheat sheet 3). Run Pick the Sentinel Data Connector and Choose the Right Data Tier.
• Week 2 — configure Defender XDR (domain 1): email notifications and alert tuning (Hide, Resolve, Set as behavior); Defender for Endpoint advanced features; ASR rule modes and file indicators; device groups and automation levels; automatic attack disruption and its prerequisites; workbooks and SOC optimization.
• Week 3 — detections and automation (domain 1): custom detections (required columns, frequencies, actions), scheduled, NRT and anomaly rules, why Fusion isn't available in the Defender portal, MITRE ATT&CK coverage; automation rules (triggers, order, expiration) and playbooks on Azure Logic Apps. Run Turn a Hunt into a Custom Detection and Write a Brute-Force Analytics Rule Query.
• Week 4 — respond (domain 2): the unified incident queue and Security Copilot; Defender for Office 365 remediation and ZAP; Entra ID Protection; Defender for Identity alerts; Purview DLP, Defender for Cloud and Defender for Cloud Apps alerts; device actions and live response (cheat sheet 4); Purview Audit, eDiscovery search and Microsoft Graph activity logs. Run Work the Incident in Order, Which Defender Raised It? and Who Clicked the Phishing Link?
• Week 5 — hunt (domain 3): the right table for the question, Timestamp vs TimeGenerated, KQL joins and string operators, unified advanced hunting, threat analytics, the hunting graph, Sentinel hunting queries, KQL jobs, summary rules and notebooks. Run Hunt Failed Sign-ins in Sentinel, Find Encoded PowerShell on Endpoints and Hunt Lateral Movement over RDP. End the week with a 50-question mixed quiz and record your score per domain.
• Week 6 — mocks and the exam: a full 50-question CrushCert mock on the 100-minute timer. Drill the weakest domain with fresh questions, take a second mock, and book once you're at 80%+.

Track 2: the 10-week plan (IT pro or admin new to Microsoft SecOps)

About an hour a day, six days a week. Use the seventh to catch up or rest.

Weeks 1–4 — manage a security operations environment

• Week 1 — set up: get a test tenant, open the Defender portal (security.microsoft.com), and create a Microsoft Sentinel workspace. Connect a free source such as Azure Activity and run your first queries in advanced hunting. Learn where, project and summarize. Run Hunt Failed Sign-ins in Sentinel.
• Week 2 — connect and store: Sentinel roles (cheat sheet 1), data connectors and their tables (cheat sheet 2), data collection rules and transformations, the retention tiers (cheat sheet 3). Run Pick the Sentinel Data Connector and Choose the Right Data Tier.
• Week 3 — configure Defender XDR: notifications, alert tuning, Defender for Endpoint advanced features, ASR rules and indicators, device groups, automation levels and attack disruption.
• Week 4 — detect and automate: custom detections, analytics rule types, anomalies, MITRE ATT&CK coverage, automation rules and playbooks. Run Turn a Hunt into a Custom Detection and Write a Brute-Force Analytics Rule Query.

Weeks 5–7 — respond to security incidents

• Week 5 — the incident queue: attack story, incident graph, evidence and entities, classification, Security Copilot summaries and guided responses, case management. Run Work the Incident in Order and Which Defender Raised It?
• Week 6 — email and identity: Defender for Office 365 remediation (soft vs hard delete), ZAP, submissions; Entra ID Protection (Dismiss risk vs Confirm compromised); Defender for Identity alerts and entity tags; Defender for Cloud Apps and Purview DLP alerts. Run Who Clicked the Phishing Link?
• Week 7 — endpoints and Microsoft 365 investigation: the device timeline, device actions and live response (cheat sheet 4), Defender for Cloud alerts, Purview Audit Standard vs Premium, eDiscovery search, Microsoft Graph activity logs.

Weeks 8–10 — threat hunting, mocks

• Week 8 — tables and KQL (domain 3): which Defender XDR and Sentinel table answers which question, Timestamp vs TimeGenerated, has vs contains, joins and the innerunique default (the KQL table below). Run Find Encoded PowerShell on Endpoints and Hunt Lateral Movement over RDP.
• Week 9 — hunting tools (domain 3): unified advanced hunting, threat analytics, the hunting graph, Sentinel hunting queries, KQL jobs, summary rules, notebooks and search jobs. Finish with a 50-question mixed quiz and record your score per domain.
• Week 10 — review, mocks and the exam: your weakest domain with fresh questions; a full CrushCert mock on the 100-minute timer; drill what it exposed; a second mock. Two in a row at 80%+ and you're ready to book.

Cheat sheet 1: which Sentinel role?

Microsoft recommends Responder plus Playbook Operator for analysts and Contributor plus Logic App Contributor for engineers, assigned at the resource group. Automation rules run playbooks as the Microsoft Sentinel service account, which needs permissions on the playbook's resource group, and granting that takes Owner.

Cheat sheet 2: which connector, which table?

Two classic traps: forwarded events land in WindowsEvent, not SecurityEvent, so built-in rules that query SecurityEvent won't match them; and an Azure Policy assignment only covers existing resources if you tick Create a remediation task. Non-Azure machines need Azure Arc before the Azure Monitor Agent can be deployed to them.

Cheat sheet 3: where does the data live?

Advanced hunting's interactive queries see only the analytics retention period; older lake data needs a search job, a KQL job or the lake explorer. Moving a table from Analytics to the Data lake tier stops real-time analytics and hunting on it.

Cheat sheet 4: which device action?

All device actions are tracked in the Action center. For email, remediation from automated investigation always waits for SecOps approval.

KQL to know

These are the patterns CrushCert's six KQL labs make you type. Learn what each one does; the last column is the lab that drills it.

Defender XDR tables use Timestamp; Sentinel and Log Analytics tables use TimeGenerated. Use =~ for case-insensitive matches on process and file names, because attackers vary case.

The last day before the exam

• No new topics, no full mocks. A 20-question mixed quiz, the flashcard deck, the four cheat sheets and the KQL table above.
• On exam day: you have 100 minutes. Read every scenario for the words that decide it ("least privilege," "existing resources," "without code," "lowest cost," "as quickly as possible," "must be recoverable," "no manual approval"), and keep a steady pace so a long KQL question doesn't squeeze the last ones.

More on SC-200

Not sure what to practice with? See our honest look at the best SC-200 practice tests, free and paid. Still deciding whether to sit it at all? Read is SC-200 worth it? and how long it takes by background. Everything in the prep is laid out on the SC-200 practice test page. New to security? Start with the Security+ practice test; coming from Azure administration, see the AZ-104 practice test.

Keep reading

Frequently asked questions