SC-100 study guide · 2026

The 4 SC-100 domains, explained

4 domains and 14 official functional groups. Design security operations, identity, and compliance capabilities carries the most weight at 25–30%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 2 See all domains
Questions
Not published (Microsoft says most exams have 40–60)
Time
100 minutes (Microsoft standard for role-based exams without labs; 120-minute seat time)
Passing score
700 / 1000
Outline
SC-100 study guide, skills measured as of October 21, 2026 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 20–25%
  2. 2 25–30%
  3. 3 25–30%
  4. 4 20–25%
  1. 1 Design solutions that align with security best practices and priorities
  2. 2 Design security operations, identity, and compliance capabilities
  3. 3 Design security solutions for infrastructure
  4. 4 Design security solutions for applications and data

All 4 domains

14 official functional groups 58–78 hrs suggested study

  1. Domain 01 20–25%

    Design solutions that align with security best practices and priorities

    The strategy layer of SC-100: ransomware and business resiliency, alignment with the Microsoft Cybersecurity Reference Architectures and the Microsoft Cloud Security Benchmark, Zero Trust adoption, secure AI adoption, and governance through CAF, Well-Architected and Azure landing zones.

    Inside this domain

    • Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
    • Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)
    • Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework

    Watch for Geo-redundancy as ransomware defense

    Functional groups
    3
    Questions est.
    ~11
    Study time est.
    12–16 hrs
  2. Domain 02 25–30%

    Design security operations, identity, and compliance capabilities

    One of the two heaviest SC-100 areas: designing detection and response with Defender XDR and Microsoft Sentinel, identity and access with Microsoft Entra, privileged access with the enterprise access model, and regulatory compliance with Microsoft Purview, Azure Policy and Defender for Cloud.

    Inside this domain

    • Design solutions for security operations
    • Design solutions for identity and access management
    • Design solutions for securing privileged access
    • Design solutions for regulatory compliance

    Watch for SIEM for everything

    Functional groups
    4
    Questions est.
    ~14
    Study time est.
    18–24 hrs
  3. Domain 03 25–30%

    Design security solutions for infrastructure

    Joint-heaviest SC-100 area: hybrid and multicloud posture with Defender for Cloud, Azure Arc and Exposure Management, endpoint and IoT requirements, baselines for SaaS, PaaS, IaaS and containers, Azure AI services security, and network and Security Service Edge evaluation.

    Inside this domain

    • Design solutions for security posture management in hybrid and multicloud environments
    • Specify requirements for securing server and client endpoints
    • Specify requirements for securing SaaS, PaaS, and IaaS services
    • Evaluate solutions for network security and Security Service Edge (SSE)

    Watch for Free tier with paid features

    Functional groups
    4
    Questions est.
    ~14
    Study time est.
    16–22 hrs
  4. Domain 04 20–25%

    Design security solutions for applications and data

    The SC-100 domain on protecting what users and applications touch: Microsoft 365 and Microsoft 365 Copilot, application security across the lifecycle, workload identities, API Management and Azure WAF, and data security for Azure data services, Storage and AI workloads.

    Inside this domain

    • Evaluate solutions for securing Microsoft 365
    • Design solutions for securing applications
    • Design solutions for securing an organization's data

    Watch for Blocking Copilot to stop oversharing

    Functional groups
    3
    Questions est.
    ~11
    Study time est.
    12–16 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 58–78 hrs of study.

  1. 2 Design security operations, identity, and compliance capabilities 25–30% · 18–24 hrs
  2. 3 Design security solutions for infrastructure 25–30% · 16–22 hrs
  3. 1 Design solutions that align with security best practices and priorities 20–25% · 12–16 hrs
  4. 4 Design security solutions for applications and data 20–25% · 12–16 hrs

Try one

Practice questionDomain 2: Design security operations, identity, and compliance capabilities

A bank's SOC uses Microsoft Defender XDR. It must now correlate alerts from on-premises firewalls and AWS CloudTrail with Defender incidents, keep raw logs for two years at low cost, and automate ticket creation in ServiceNow. Which design meets all requirements?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Geo-redundancy as ransomware defense

    Clue Look for wording about attackers deleting or modifying backups.

  • Domain 2

    SIEM for everything

    Clue Scenarios limited to Microsoft 365 and endpoints.

  • Domain 3

    Free tier with paid features

    Clue Requirements to prioritize risks by attack path.

  • Domain 4

    Blocking Copilot to stop oversharing

    Clue Scenarios about Copilot surfacing sensitive files.

Other Cybersecurity certifications

Study guides for exams that overlap with SC-100.

Practise what you read

SC-100 domains: common questions

How many domains are in the SC-100 exam?

SC-100 has 4 domains with 14 official functional groups between them: Design solutions that align with security best practices and priorities, Design security operations, identity, and compliance capabilities, Design security solutions for infrastructure and Design security solutions for applications and data.

Which SC-100 domain carries the most weight?

Design security operations, identity, and compliance capabilities is the heaviest at 25–30%, followed by Design security solutions for infrastructure (25–30%). The lightest is Design security solutions for applications and data (20–25%). Weights come from Microsoft's official outline.

What is the SC-100 exam format?

Questions: Not published (Microsoft says most exams have 40–60). Time allowed: 100 minutes (Microsoft standard for role-based exams without labs; 120-minute seat time). Passing score: 700 / 1000.

How long should I study for SC-100?

Our planning estimate is 58–78 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Design security operations, identity, and compliance capabilities, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows SC-100 study guide, skills measured as of October 21, 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (SC-100 study guide, skills measured as of October 21, 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.