MicrosoftAvailable
AZ-500
SC-100 Exam Guide: Cost, Skills Measured and Study Plan
Direct answer: SC-100 is Microsoft's expert-level Cybersecurity Architect exam. You need a score of 700 to pass, and it tests four domains weighted from 20% to 30% each. Microsoft lists it at $165.00, and our voucher costs $44.99. Plan for roughly 8 weeks at 8 hours a week if you already work in security.
The SC-100 exam is the Microsoft Cybersecurity Architect exam, and you need a score of 700 to pass. According to the official SC-100 exam page, it counts toward the Microsoft Certified: Cybersecurity Architect Expert certification. Microsoft lists the price at $165.00, and our voucher is $44.99.
This guide covers what the exam tests, how the weights work, what it costs, and how to prepare.
What SC-100 proves and who should take it
Passing SC-100 shows you can turn a cybersecurity strategy into protection for an organization's assets, business and operations. Microsoft describes the role as designing, guiding the implementation of, and maintaining security solutions that follow Zero Trust principles. That covers identity, devices, data, AI, applications, network, infrastructure and DevOps.
The exam is for people who already work in security. Microsoft expects experience in identity and access, platform protection, security operations, data and AI security, application security, and hybrid and multicloud infrastructures. You should have expert skills in at least one of those areas. You should also have designed security solutions that include Microsoft security technologies.
If you are new to security, start with a fundamentals exam first. Microsoft points beginners to SC-900 in its course description.
Skills measured and what each domain weighs
The weights below come from the official study guide, under "Skills measured as of October 21, 2026".
Domain | Weight |
|---|---|
Design solutions that align with security best practices and priorities | 20–25% |
Design security operations, identity, and compliance capabilities | 25–30% |
Design security solutions for infrastructure | 25–30% |
Design security solutions for applications and data | 20–25% |
Two domains carry the most weight. Security operations with identity, and infrastructure, together make up a large share of the exam.
What the first domain asks you to design
This domain is about resilience and frameworks. The study guide lists these topics:
A resiliency strategy for ransomware and other attacks, including business continuity and disaster recovery (BCDR) with secure backup and restore for hybrid and multicloud environments.
Solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and the Microsoft Cloud Security Benchmark (MCSB), including AI solutions.
Security and governance based on the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework, including Azure landing zones and a DevSecOps process.
A strategy for secure AI adoption.
What the second domain asks you to design
Security operations covers detection and response with XDR and SIEM, centralized logging with Microsoft Purview Audit, and SOAR with Microsoft Sentinel and Microsoft Defender XDR. You also evaluate threat detection coverage by using MITRE ATT&CK matrices, including Enterprise, Mobile and industrial control systems (ICS).
Identity covers Microsoft Entra ID in hybrid and multicloud setups, external identities (B2B and decentralized identity), and agent identities with Microsoft Entra Agent ID and Conditional Access policies. It also covers modern authentication and authorization, including continuous access evaluation and risk scoring.
The guide notes that bullets illustrate how a skill is assessed, and related topics may appear. Read the full guide before you finalize your plan.
Exam format and requirements at a glance
Item | Detail |
|---|---|
Passing score | 700 |
Languages | English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese (Brazil), Chinese (Traditional), Italian |
Retirement date | None |
Delivery | Scheduled through Pearson VUE |
English version last updated | October 21, 2026 |
Localized versions | Updated about eight weeks after English |
Microsoft says most questions cover generally available features. Preview features can appear if they are commonly used. The exam page also recommends registering with a personal Microsoft account (MSA). If you use a work or school account and leave that organization, your exam records can be lost.
You can also try the exam interface in the exam sandbox linked from the official SC-100 exam page.
Price: Microsoft list price vs our voucher
Here is the cost comparison as of November 15, 2026.
Option | Price (USD) |
|---|---|
Microsoft official exam price | $165.00 |
Our SC-100 voucher | $44.99 |
The list price is the one Microsoft publishes, and it varies by the country or region where you take the exam. Microsoft also notes that prices change without notice and exclude taxes. Confirm your local price with Microsoft before you book.
Voucher validity, redemption and refunds
Our voucher is valid for 12 months and is redeemed with Pearson VUE. Buy it when you are about two months from your target date, so the code does not expire before you are ready.
Here is how delivery and refunds work:
The code is emailed within 12 hours of payment. It also appears in your account.
You can cancel an order for a full refund before delivery.
A delivered code is non-refundable. The exception is a code the test provider rejects as invalid, already used or expired on first use.
In that case, contact support within 14 days. Send the order number and a screenshot, and we replace or refund the code.
Full terms are on the refund policy and delivery policy pages.
An 8-week study plan with weekly hours
This plan assumes you already work in security and can give about 8 hours a week. That is 64 hours in total. If you are weaker in Microsoft tooling, stretch it to 10 or 12 weeks.
First, set aside 8 hours for review: 2 hours in Week 1 and 6 hours in Week 8. Split the other 56 hours by domain weight, using the midpoint of each range and rounding to whole hours:
Domain | Weight midpoint | Study hours (of 56) |
|---|---|---|
Best practices and priorities | 22.5% | 13 |
Security operations, identity, compliance | 27.5% | 15 |
Infrastructure | 27.5% | 15 |
Applications and data | 22.5% | 13 |
The weeks below add up to the same totals: 13 + 15 + 15 + 13 study hours, plus 8 review hours.
Week | Hours | Focus |
|---|---|---|
1 | 8 | 2 h review: read the full study guide and take the Practice Assessment once, cold, to find weak areas. 6 h Domain 1: ransomware resilience and BCDR. |
2 | 8 | 7 h Domain 1: MCRA, MCSB, CAF, Azure landing zones and the DevSecOps process. Sketch one architecture on paper for each. 1 h Domain 2: start with detection and response. |
3 | 8 | Domain 2: security operations. Compare Sentinel and Defender XDR roles, and map detections to MITRE ATT&CK. |
4 | 8 | 6 h Domain 2: identity, including Entra ID, external identities and Conditional Access. 2 h Infrastructure: start access design for SaaS, PaaS and IaaS. |
5 | 8 | Infrastructure: hybrid and multicloud resources, with identity, networking and application controls. |
6 | 8 | 5 h Infrastructure: finish and sketch one design per service model. 3 h Applications and data: start. |
7 | 8 | Applications and data: design decisions for application and data security, plus AI security. |
8 | 8 | 2 h Applications and data: finish. 6 h review: retake the Practice Assessment, fix gaps and try the exam sandbox. |
Microsoft recommends the new Practice Assessment on AI Skills Navigator. It says the legacy one at https://aka.ms/SC100-LearnPA is no longer updated. Microsoft also offers an instructor-led course, SC-100T00, if you prefer a class.
Do you need an associate certification first?
Microsoft does not require one to attend the course, but it strongly encourages one. Use this table to decide.
Your background | Suggested next step |
|---|---|
Mostly security operations | Review identity and infrastructure design first |
Mostly identity | Review SecOps and data protection first |
Platform or cloud security | Review SecOps and GRC topics first |
New to Microsoft security | Take an associate exam such as AZ-500, SC-200 or SC-300 first |
Our SC-200 exam guide helps if you want to build security operations depth first.
Common mistakes to avoid
Studying products instead of design decisions. Every domain name starts with "Design". Practice explaining why you would choose one control over another.
Skipping the frameworks. MCRA, MCSB, CAF and the Well-Architected Framework appear by name in the study guide.
Using old material. The English exam changed on October 21, 2026. Check that any course or notes match the current skills list.
Ignoring AI security. AI appears in several objectives, including secure AI adoption and agent identities.
Booking with a work account. Use a personal MSA so your records stay with you.
Buying the voucher too early. It is valid for 12 months, but your study clock should start first.
After you pass: keeping the certification current
Microsoft says associate, expert and specialty certifications expire annually. You renew by passing a free online assessment on Microsoft Learn, as described on its renewal page.
Connect your certification profile to your Microsoft Learn profile. That lets you schedule and renew exams and share or print certificates.
If you want to compare other security exams, browse our Cybersecurity certifications. When you are ready to book, get the SC-100 voucher for $44.99.
Sources
Questions about this topic
Which Microsoft account should I use to register for SC-100?
Microsoft strongly recommends a personal Microsoft account (MSA). If you register with a work or school account and leave that organization, your exam records can be lost and cannot be recovered.
Is the SC-100 exam going to retire soon?
Microsoft's exam page lists the retirement date as none. The English version was last updated on October 21, 2026, so check the study guide before you start so your notes match the current skills list.
Can I get extra time if the exam is not in my language?
Yes, according to Microsoft's study guide. If the exam isn't available in your preferred language, you can request an additional 30 minutes to complete it.
Is SC-100 harder than the associate security exams?
Microsoft calls the matching course advanced and expert-level. It recommends that students first pass an associate exam such as AZ-500, SC-200 or SC-300. Expect scenario-based design decisions rather than only configuration steps.
Does the SC-100 exam include AI topics?
Yes. The skills list includes designing AI solutions that align to the Microsoft Cloud Security Benchmark, a strategy for secure AI adoption, and agent identities with Microsoft Entra Agent ID. Add these to your plan alongside the classic Zero Trust topics.
