SC-100 is Microsoft's expert-level cybersecurity architect certification. It is one of the harder Microsoft exams in the security portfolio, and one of the more useful credentials for cloud-native security work. Below is the prep approach that maps to the actual exam, plus the reason this cert is undervalued in many job markets.
Exam facts
- Cost: $165 USD via Pearson VUE
- Format: 40-60 questions including case studies and design scenarios, 100 minutes
- Passing score: 700/1000
- English version last updated: April 27, 2026
- Validity: 1 year, free annual online assessment renewal
The prerequisite reality
To earn the Microsoft Certified: Cybersecurity Architect Expert credential, you must hold one of the following before SC-100 itself counts:
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)
- Microsoft Certified: Identity and Access Administrator Associate (SC-300)
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Information Protection and Compliance Administrator Associate (legacy MS-500)
You can sit SC-100 without one of these in hand, but the certification will not be issued until the prerequisite is in place. Plan for two exam fees, not one. Source: Microsoft Learn certification page, accessed May 2026.
Recommended prerequisite path
For most engineers, AZ-500 (Azure Security Engineer Associate) is the most useful prerequisite. It covers identity, platform protection, security operations, and data and application security on Azure, and the topics overlap directly with SC-100 case studies. If your role focuses on identity (SSO, MFA, conditional access, governance), SC-300 is the right prerequisite. If you do SOC or threat-hunting work, SC-200 makes sense.
The four functional groups (skills outline)
| Domain | Weight |
|---|---|
| Design solutions that align with security best practices and priorities | 20-25% |
| Design security operations, identity, and compliance capabilities | 25-30% |
| Design security solutions for infrastructure | 25-30% |
| Design security solutions for applications and data | 20-25% |
The first domain is the one most candidates underprepare for. Microsoft expects you to apply the Microsoft Cybersecurity Reference Architectures (MCRA), Zero Trust principles, and the Cloud Adoption Framework to design choices. Read these documents directly; do not rely on a course summary.
Real study resources that work
- Official Microsoft Learn paths for SC-100. Free, structured, and the closest alignment to the actual question style. Start here. Source: learn.microsoft.com/training.
- Microsoft Cybersecurity Reference Architectures (MCRA). Free PDF from Microsoft. The exam pulls scenarios directly from these architectures. Read all sections relevant to identity, network, endpoint, and SaaS security.
- Zero Trust Maturity Model. Microsoft's Zero Trust documentation maps to several SC-100 case study scenarios. Free at microsoft.com/security/business/zero-trust.
- John Savill's SC-100 master class on YouTube. Free, multi-hour, and covers the design reasoning the exam tests. The most-recommended video resource on r/AzureCertification for this cert.
- MeasureUp practice exams. Microsoft's official practice partner. The questions are representative of exam style. Around $100 for the full bundle.
- Charbel Nemnom's SC-100 study guide. Free, written by an MVP, structured by exam domain. Good complement to the Microsoft Learn paths.
Time to prepare
If you already hold one of the security associate prerequisites and have 2+ years of cloud security experience, plan for 60-90 hours of preparation over 8-10 weeks. If you are coming from a general cloud architecture background without specific security operations experience, budget 120+ hours and consider taking SC-300 or AZ-500 first as scaffolding.
Why SC-100 is undervalued vs CISSP for cloud-native work
CISSP is the dominant security credential in many job markets. It signals broad security knowledge across 8 domains and is widely recognised by HR filters. The honest comparison:
- CISSP: vendor-neutral, broad, requires 5 years of paid security work experience to certify, covers traditional infosec topics plus some cloud. Cost: $749 plus annual maintenance fees of $135 plus 40 CPE credits per year.
- SC-100: Microsoft-specific, tests design reasoning for Azure-native security, requires a Microsoft associate cert prerequisite, covers Zero Trust, MCRA, Defender, Sentinel, Entra ID. Cost: $165 plus zero renewal fees.
For roles where the work is genuinely cloud-native security (designing Azure landing zones with security baked in, Sentinel-based SOC operations, identity-first security architecture), SC-100 tests skills that actually transfer to the day-to-day. CISSP tests breadth that is useful in compliance, audit, and traditional security roles but is less aligned with Azure-specific design work.
In Europe, particularly in financial services and government, CISSP still holds a reputation premium. In US tech and EU consultancies focused on Microsoft cloud, SC-100 holders report comparable or higher offer rates per anonymous reports on r/AzureCertification and Microsoft Tech Community in 2025-2026.
Salary expectations
SC-100 holders in the US typically earn $145,000-$200,000 mid-level total comp, $200,000-$280,000 senior, per Glassdoor and Levels.fyi 2026 data for "cybersecurity architect" titles. In the EU, mid-level cybersecurity architects earn EUR 70,000-100,000, senior EUR 100,000-140,000. The cert plus 5+ years of cloud security experience is the threshold for the senior bands.
Practical preparation plan (10 weeks)
- Weeks 1-2: Microsoft Learn SC-100 paths, full read-through. Take notes by domain.
- Weeks 3-4: MCRA documentation deep dive. Sketch reference architectures from memory after reading.
- Weeks 5-6: Zero Trust documentation plus John Savill master class.
- Weeks 7-8: Practice case studies. Microsoft Learn provides several free; MeasureUp adds depth.
- Week 9: Full-length practice exam. Review every wrong answer against documentation.
- Week 10: Final practice exam plus targeted review of weakest domain. Book the real exam at the end of the week.
What the exam looks like in practice
SC-100 questions present a fictional company with multiple business and technical constraints, then ask you to design a security solution that meets the constraints. There is rarely one objectively correct answer; there is usually one best-aligned answer given the priorities the question states. The skill being tested is reading carefully, identifying the dominant constraint, and matching the design to it. Practice this with real-world architecture review documents, not only with quiz questions.
# Useful for SC-100 study: probe Entra ID conditional access policies
az ad signed-in-user show
az role assignment list --assignee <userPrincipalName> --output table
# List Defender for Cloud security alerts in your subscription
az security alert list --output table
The exam tests architectural reasoning, not CLI fluency. The commands above are useful for building the mental model of what the architecture you are designing will actually configure.