Which Microsoft security exam should you take first
An honest comparison of the Microsoft security certifications, and which one to start with depending on the job you actually do.
3 min read· Updated 15 August 2026
There is no single right order, and anybody who tells you otherwise is selling a path. The useful question is which exam is closest to the work you already do, because that one is cheapest to pass and most useful afterwards.
Below is what each exam is actually about, and who each suits. We write practice tests for 53 of these, and we have said plainly where a different exam is the better starting point.
If you are new to the field
SC-900, the security, compliance and identity fundamentals exam, is the gentle entry. It is broad and shallow, it costs less, and it will not teach you to do a job.
It is worth taking if you need something on paper quickly or you are moving into security from elsewhere and want the vocabulary. If you already work in IT, skip it and go to whichever role exam matches your work.
If you work in a security operations team
SC-200 is the closest match. It is about detection and response: Defender XDR, Sentinel, incident triage, and enough KQL to hunt. If your day involves alerts, this is the one where your existing knowledge counts most.
It is also the most immediately practical of the four, because almost everything in it is something a security operations team does rather than designs.
If you administer identity
SC-300 covers Entra ID, Conditional Access, workload identities and governance. If you look after who can sign in and what they can reach, start here.
It is also the best single exam for anybody who wants to understand modern security architecture, because identity is where most of the decisions now live. That is a reasonable argument for taking it before SC-200 even if operations is where you work.
If you look after data and compliance
SC-401 is about protecting data with Microsoft Purview: labelling, loss prevention, retention and insider risk. It suits people in compliance, records management, or any role where the question is what may leave.
Note the code. SC-401 replaced SC-400, which Microsoft retired on 31 May 2025, so anything you find referring to SC-400 is out of date.
Leave SC-100 until last
SC-100, the cybersecurity architect exam, is expert level and it assumes you have done the work. It asks you to recommend designs, and the questions reward judgement built over years rather than material learned in weeks.
You can sit the exam whenever you like, but the certification itself has a gate: to be awarded Cybersecurity Architect Expert you must also hold one of three associate certifications, for Azure security engineer, identity and access administrator, or security operations analyst. SC-401 is not on that list, so if the expert certification is the goal, plan for SC-200 or SC-300 as well. The Azure security engineer route is closing: AZ-500 retires on 31 August 2026.
Take it when you are already making design decisions and want them validated, not as a way to learn how to make them.
A reasonable order for most people
If your job does not point clearly at one of them, this order works: SC-300 for the foundation, then SC-200 for the operational skills, then SC-401 if data protection is part of your remit, then SC-100 once you have been designing for a while.
Whatever you choose, sit a practice test in your chosen exam before you commit to studying it. A short practice test tells you more about the gap between you and the paper than a week of reading a syllabus.
Find out what you actually know in five minutes
You have just read what this exam covers. Answering up to ten of its questions will tell you which parts of it you already know.
Try a question, free