The sc 200 syllabus is organized into three domains that Microsoft weights and publishes for Exam SC-200: Microsoft Security Operations Analyst: managing a security operations environment (42%), responding to security incidents (36%), and performing threat hunting (22%). The exam runs 100 minutes and requires a score of 700 or higher. Below is every objective statement listed under each domain, taken directly from Microsoft's published skills outline.
Exam SC-200: Microsoft Security Operations Analyst is built from three functional domains, each carrying a published weight toward your final score. Microsoft groups the objective statements under each domain by the product area or workflow they belong to. The sc 200 syllabus below reproduces those groupings and statements as Microsoft publishes them, so you can map your study time directly to what is measured.
Domain weights at a glance
| Domain | Weight |
|---|---|
| Manage a security operations environment | 42% |
| Respond to security incidents | 36% |
| Perform threat hunting | 22% |
These three weights are the entire sc-200 exam objectives structure Microsoft publishes; there is no fourth domain and no sub-weighting beneath the domain level.
Domain 1: Manage a security operations environment (42%)
This is the largest domain on the sc-200 syllabus. It covers configuring automation across Microsoft Defender XDR and Microsoft Sentinel, and configuring the Sentinel SIEM platform itself. Microsoft lists these objective statements:
- Configure email notifications in Microsoft Defender XDR, including incidents, actions, and threat analytics
- Configure alert notifications in Microsoft Defender XDR, including tuning, suppression, and correlation
- Configure Microsoft Defender for Endpoint advanced features
- Configure rules settings in Microsoft Defender for Endpoint
- Configure custom data collection in Microsoft Defender for Endpoint
- Configure security policies for Microsoft Defender for Endpoint, including attack surface reduction (ASR) rules
- Manage automated investigation and response capabilities in Microsoft Defender XDR
- Configure automatic attack disruption in Microsoft Defender XDR
- Configure and manage device groups, permissions, and automation levels in Microsoft Defender for Endpoint
- Create and configure automation rules in Microsoft Sentinel
- Create and configure Microsoft Sentinel playbooks
- Specify Microsoft Sentinel roles
- Manage data retention for XDR and Microsoft Sentinel tables, including Analytics, Data lake, and XDR tiers
- Create and configure Microsoft Sentinel workbooks
Domain 2: Respond to security incidents (36%)
This domain is about working an incident once Microsoft Defender XDR or Microsoft Defender for Endpoint has raised it: investigating, remediating, and documenting the response. The exam objectives read:
- Investigate and remediate threats by using Microsoft Defender for Office 365, including automatic attack disruption
- Investigate and remediate threats or compromised entities identified by Microsoft Purview
- Investigate and remediate alerts and incidents identified by Microsoft Defender for Cloud workload protections
- Investigate and remediate security risks identified by Microsoft Defender for Cloud Apps
- Investigate and remediate compromised identities that are identified by Microsoft Entra ID
- Investigate and remediate security alerts from Microsoft Defender for Identity
- Investigate and remediate alerts and incidents identified by Microsoft Sentinel
- Investigate incidents by using agentic AI, including embedded Microsoft Security Copilot
- Investigate complex attacks, such as multi-stage, multi-domain, and lateral movement
- Manage security incidents by using case management
- Investigate device timelines
- Perform actions on the device, including live response and collecting investigation packages
- Perform evidence and entity investigation
- Investigate and remediate incidents identified by automatic attack disruption
Domain 3: Perform threat hunting (22%)
The smallest domain by weight still covers a distinct skill set: writing and running Kusto Query Language (KQL) hunts across Microsoft Defender XDR and the Microsoft Sentinel platform, and interpreting the results. The published objectives are:
- Identify the appropriate table to use in a KQL query
- Identify threats by using Kusto Query Language (KQL)
- Create Advanced Hunting queries
- Interpret threat analytics in Microsoft Defender XDR
- Create hunting graphs, including blast radius
- Analyze relationships between entities by using Sentinel Graph
- Create and monitor hunting queries
- Create and manage KQL jobs in Data lake
- Create and manage Summary rule tables for querying
- Hunt for threats by using Notebooks, including connection to the Sentinel MCP Server
What the weighting means for your study time
Because the first two domains together make up most of the exam, most of your preparation time should go toward configuring and operating Microsoft Sentinel and Microsoft Defender XDR automation, then toward incident response workflows. Threat hunting is smaller in weight but distinct in skill: it rewards comfort with KQL syntax rather than portal navigation. Start with our study plan to turn these weights into a week-by-week schedule, and check exam format & scoring for how the 100-minute exam is timed.
The sc-200 exam topics above are grouped exactly as Microsoft groups them, without added categories. If a term is unfamiliar, treat it as a study target rather than skipping it: every line is in scope for scoring. Pair this list with our sample questions and practice test to see the objectives applied to scenario-based items, and review prerequisites if you are not yet sure the exam is the right starting point.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.