SC-500 vs SC-200: securing the platform or running the SOC?

The short answer

SC-200 is for the security operations analyst: triage, incident response, threat hunting and detection engineering in Microsoft Defender XDR and Microsoft Sentinel (SC-200 certification page). SC-500 is for the security engineer who puts the controls in place across identity, network, data, compute and AI workloads (SC-500 study guide).

Put simply, SC-500 asks you to set things up. SC-200 asks you to use them when something goes wrong. They meet mostly in Microsoft Sentinel.

Side by side

	SC-200	SC-500
Certification	Security Operations Analyst Associate	Cloud and AI Security Engineer Associate
Role on the certification page	Security Operations Analyst	Security Engineer
Level	Intermediate	Intermediate
Exam time	100 minutes	120 minutes
Domains	Manage a security operations environment (40–45%); respond to security incidents (35–40%); perform threat hunting (20–25%)	Identity, access and governance (20–25%); storage, databases and networking (25–30%); compute (20–25%); security posture (20–25%)
Free practice assessment	Available	Not available on October 20, 2026
Outline	New English version from October 21, 2026; Microsoft’s change log marks one subgroup, with minor changes	First version, no change log; page last updated May 13, 2026

Sources: SC-200 study guide, SC-200 certification page, SC-500 study guide, SC-500 certification page.

Where they overlap

Topic	SC-200	SC-500
Sentinel roles	Specify the roles	Assign the roles
Data retention	XDR and Sentinel tables, including the analytics, data lake and XDR tiers	Retention in Sentinel data stores
Windows Security events	Collection through the AMA connector with data collection rules, and through Windows Event Forwarding	Collection through data collection rules, including Windows Event Forwarding
Syslog and CEF	The AMA-based Syslog and CEF connectors	Syslog and CEF collection
Custom log tables	Create them to store ingested data	The same objective
Automation	Automation rules and playbooks	Automation rules and playbooks
Azure data	Azure activity logs through Azure Policy and diagnostic settings	Microsoft data connectors for Azure resources
Microsoft Purview Audit	Investigate threats with it	Query it in Defender XDR
Blast radius	Hunting graphs, including blast radius	Blast radius of risks tied to Entra Agent ID, in Defender XDR
Security Copilot	Investigate incidents with agentic AI, including embedded Security Copilot	Configure workspaces, roles, plugins and agents
Defender for Cloud	Investigate alerts from its workload protections	Enable and configure the plans

Sources: SC-200 study guide, SC-500 study guide.

Read down the right-hand column and the verbs are configure, enable, assign. On the left they are investigate, specify, hunt. Sentinel data collection is the one area where both exams ask for the same hands-on setup work.

Only in SC-200

• Microsoft Defender for Endpoint: features, rules, attack surface reduction, device groups, live response and investigation packages.
• Defender XDR operations: notifications, automated investigation and response, automatic attack disruption, case management.
• Detections: custom detection rules, Sentinel analytics rules (scheduled, near-real-time, threat intelligence and machine learning), anomalies, and MITRE ATT&CK coverage.
• Incident response across Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Entra ID and Purview.
• Hunting: KQL, Advanced Hunting, threat analytics, Sentinel Graph, data lake KQL jobs, summary rules and notebooks.
• Platform upkeep: workbooks, SOC optimization and threat indicators.

Source: SC-200 study guide.

Detections are the clearest line between the two. AZ-500 asked candidates to enable Sentinel analytics rules (AZ-500 study guide). SC-500 doesn’t name analytics rules at all; its Sentinel subgroup is about activity and event collection (SC-500 study guide).

Only in SC-500

Hardening and configuration: Entra access controls, Key Vault, Azure Policy and resource locks, storage, Azure SQL, network security, virtual machines, containers and app services, Defender for Cloud posture management, and two subgroups the AZ-500 outline didn’t have, securing AI (11 objectives) and Security Copilot setup (4 objectives) (SC-500 study guide, AZ-500 study guide).

Which one to take

• You triage incidents, hunt and write detections: SC-200.
• You configure controls, harden subscriptions or secure AI deployments: SC-500.
• You want both: take either first. The Sentinel collection work overlaps, so whichever you take second starts with that part done.
• You are aiming for Cybersecurity Architect Expert: either certification meets the prerequisite for that certification, which you earn by passing SC-100 (Cybersecurity Architect Expert).

If SC-500 is your exam, our SC-500 study guide covers the Sentinel collection objectives along with the rest of the outline, with practice questions where every option is explained.