Skip to content

Microsoft Cybersecurity Architect (SC-100)

The capstone of the Microsoft security certification track. SC-100 asks you to design an end-to-end security posture across identity, operations, infrastructure, applications, and data, under real business constraints.

It is an expert-level exam with a hard gate: you must already hold SC-200, SC-300, AZ-500, or MS-102 before the certification is awarded. You can sit and pass SC-100 first, but the badge is withheld until a prerequisite is in place.

Exam Details

  • Exam Code: SC-100
  • Level: Expert
  • Duration: 120 minutes
  • Questions: Typically 40-60, including case studies
  • Passing Score: 700/1000
  • Cost: USD 165, varies by region
  • Prerequisites: SC-200, SC-300, AZ-500, or MS-102
  • Validity: 1 year, free online renewal

See the fact sheet for the full breakdown and official links.

Domains

Domain Weight Notes
Design solutions that align with security best practices and priorities 20-25% 01
Design security operations, identity, and compliance capabilities 30-35% 02
Design security solutions for infrastructure 20-25% 03
Design security solutions for applications and data 20-25% 04

How to approach it

This is a design exam. The questions give you a scenario and several architectures that would all work; you pick the one that best matches the stated constraint.

Practical reading technique: find the constraint before you read the options. The stem almost always contains a qualifier that eliminates three answers, and it is usually one of:

  • "with the least administrative effort"
  • "with the least privilege"
  • "without additional licensing"
  • "the solution must minimize cost"
  • "must meet [regulatory framework] requirements"
  • "must not require changes to the application"

Two answers will be technically correct. Only one satisfies the qualifier.

Study sequence

  1. Frameworks first. MCRA, Zero Trust, Cloud Adoption Framework Secure, Well-Architected security pillar. These give you the language the rest of the exam uses.
  2. Domain 2 next. It is the largest and covers identity plus security operations, the two areas that appear inside other domains' questions.
  3. Infrastructure and data. Defender for Cloud, network segmentation, Purview, encryption and key management.
  4. Case study practice. Long multi-question scenarios are a distinct skill. Practice reading requirements into a table before answering.

Detailed schedule in the practice plan; technique in strategy.

Prior knowledge that helps most

  • Conditional Access design, including what a policy cannot do
  • The difference between CSPM and workload protection in Defender for Cloud
  • When Private Link is required rather than a service endpoint
  • Sentinel workspace and cost design
  • Purview sensitivity labels versus DLP policies
  • Which Defender plan covers which resource type

If any of those are unfamiliar, work AZ-500 material first. SC-100 assumes the implementation knowledge and tests the design decision on top of it.

Study resources