SC-100 · Domain 2 of 4

SC-100 Domain 2: Design security operations, identity, and compliance capabilities

One of the two heaviest SC-100 areas: designing detection and response with Defender XDR and Microsoft Sentinel, identity and access with Microsoft Entra, privileged access with the enterprise access model, and regulatory compliance with Microsoft Purview, Azure Policy and Defender for Cloud.

Exam weight
25–30%
Official functional groups
4
Estimated questions estimate
~14
Suggested study time estimate
18–24 hrs

About 14 min read Reviewed October 2026

Overview

Domain 2 bundles four functional groups that together define how an organization detects threats, controls access and proves compliance. Security operations covers XDR and SIEM design, centralized logging with Microsoft Purview Audit, hybrid and multicloud monitoring, SOAR with Microsoft Sentinel and Defender XDR, incident and hunting workflows, and detection coverage measured against MITRE ATT&CK Enterprise, Mobile and ICS matrices. Identity and access covers Microsoft Entra ID in hybrid and multicloud estates, external identities, agent identities with Microsoft Entra Agent ID, Conditional Access, continuous access evaluation, AD DS hardening and secrets management.

Privileged access applies the enterprise access model, PIM, entitlement management, access reviews, cloud infrastructure entitlement management and privileged access workstations. Regulatory compliance turns requirements into controls through Microsoft Purview, Azure Policy and the Defender for Cloud regulatory compliance dashboard. At 25–30%, this is joint-heaviest with Domain 3.

How it's tested

Expect long scenarios describing an organization's tenants, on-premises Active Directory, partners, SOC maturity and regulatory obligations. Questions ask which design meets every stated requirement, often with two plausible Microsoft products in the options. Success depends on mapping each requirement to the product boundary where it is best solved.

  • XDR, SIEM or both

    You decide whether a detection need is met by Defender XDR, Microsoft Sentinel, or the unified security operations platform combining them.

  • Pick the access control

    A user, guest, workload or AI agent needs access, and you choose Conditional Access conditions, authentication strengths, PIM or entitlement management.

  • Requirement to control

    A regulation or internal rule is quoted, and you select Purview, Azure Policy or Defender for Cloud compliance features to enforce or measure it.

Reasoning it through

A company lets an AI agent built in Microsoft Foundry read customer records in several Azure resources. Security wants the agent's access governed like a user's, including risk-based blocking. A shared service principal secret would bypass those policies. Registering the agent with Microsoft Entra Agent ID gives it a managed identity object that Conditional Access policies can target, so the requirement for policy-governed agent access is met directly.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

2.1 Design solutions for security operationsXDR and SIEM, centralized logging, multicloud monitoring, SOAR, workflows and MITRE ATT&CK coverage.
What it means
This group covers designing detection and response with Defender XDR and Microsoft Sentinel, centralized logging and auditing including Microsoft Purview Audit, monitoring across hybrid and multicloud estates, SOAR with Sentinel and Defender XDR, incident response, threat hunting and incident management workflows, and evaluating detection coverage using MITRE ATT&CK Enterprise, Mobile and ICS matrices.
What to understand
Defender XDR correlates signals from endpoints, identities, email and cloud apps into incidents and can disrupt attacks automatically. Sentinel adds broad data ingestion from third-party and multicloud sources, long-term retention through its data lake, analytics rules and playbooks. In the unified Defender portal, both share incidents and hunting. Purview Audit supplies Microsoft 365 activity records. MITRE ATT&CK mapping exposes which techniques lack detections, guiding where new rules or data sources are needed.
How it shows up
Scenarios ask whether to add Sentinel, which data connector or automation pattern to use, or how to measure detection gaps.
Common confusion
Assuming Defender XDR collects firewall and AWS logs on its own; broad third-party ingestion is a Sentinel role.
2.2 Design solutions for identity and access managementAgent identities, access to all resource types, Entra ID, external identities, modern authentication, AD DS hardening and secrets.
What it means
This group covers agent identities with Microsoft Entra Agent ID and Conditional Access, access to SaaS, PaaS, IaaS, on-premises and multicloud resources, Microsoft Entra ID designs for hybrid and multicloud, B2B and decentralized identity, Conditional Access with continuous access evaluation, risk scoring and protected actions, validating policies against Zero Trust, AD DS hardening requirements, and managing secrets, keys and certificates.
What to understand
Conditional Access evaluates signals such as user or agent risk, device compliance, location and application before granting tokens. Continuous access evaluation lets resources revoke sessions quickly after critical events. Protected actions require stronger authentication before sensitive admin changes. B2B collaboration brings partners in as guests, while Verified ID supports decentralized credentials. Key Vault or Managed HSM stores secrets, keys and certificates, ideally accessed with managed identities rather than stored credentials.
How it shows up
Expect a mixed population of employees, partners, workloads and agents, with a question asking which identity design and policy set fits.
Common confusion
Thinking continuous access evaluation replaces Conditional Access. It enforces revocation faster but still relies on policy decisions.
2.3 Design solutions for securing privileged accessEnterprise access model, PIM, entitlement management, AD DS resilience, tenant administration, CIEM and privileged workstations.
What it means
This group covers assigning and delegating privileged roles with the enterprise access model, evaluating PIM, entitlement management and access reviews, evaluating AD DS security against common attacks, securing administration of SaaS and multicloud tenants, cloud infrastructure entitlement management, access review management, and secure privileged workstations including remote access.
What to understand
The enterprise access model separates a control plane, management plane, data and workload plane, user access and app access, each protected differently. PIM provides just-in-time, approval-based role activation. Entitlement management packages access with expiry. Cloud infrastructure entitlement management, now part of Defender for Cloud, finds unused permissions across Azure, AWS and GCP. Privileged access workstations isolate admin tasks from email and browsing risks.
How it shows up
Questions ask how to remove standing admin rights, govern partner access or harden AD DS against credential theft.
Common confusion
Confusing PIM with access reviews. PIM controls activation of a role, while access reviews periodically confirm who should keep access.
2.4 Design solutions for regulatory complianceRequirements to controls, Microsoft Purview, Azure Policy and Defender for Cloud regulatory compliance.
What it means
This group covers translating compliance requirements into security controls, designing compliance solutions with Microsoft Purview, designing Azure Policy solutions for security and compliance requirements, and evaluating alignment with regulatory standards and benchmarks in Microsoft Defender for Cloud.
What to understand
A requirement becomes useful only when tied to an enforceable or measurable control. Microsoft Purview Compliance Manager scores improvement actions against regulations, while Purview data lifecycle, retention and eDiscovery address records obligations. Azure Policy enforces resource configuration with effects such as deny, audit and deployIfNotExists. Defender for Cloud's regulatory compliance dashboard maps assessments to standards such as ISO 27001, PCI DSS and NIST SP 800-53.
How it shows up
Scenarios quote a requirement and ask which tool enforces it, measures it or provides evidence for auditors.
Common confusion
Choosing Compliance Manager to block noncompliant Azure resources; preventing deployment is an Azure Policy deny effect.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Unified security operations platform

    Defender XDR and Microsoft Sentinel combined in the Microsoft Defender portal.

    Remember
    Incidents, hunting and automation are shared across both products.
    Tested as
    Central to SOC design questions in the current outline.
    Trap
    Designing separate, duplicate incident queues.

  • Microsoft Sentinel data lake

    Low-cost, long-term storage tier for security data in Sentinel.

    Remember
    Balances retention cost against interactive query speed.
    Tested as
    Relevant to centralized logging and retention design.
    Trap
    Sending all verbose logs to the analytics tier.

  • MITRE ATT&CK coverage

    Mapping detections to adversary tactics and techniques.

    Remember
    Enterprise, Mobile and ICS matrices are named in the objective.
    Tested as
    Used to evaluate and prioritize detection gaps.
    Trap
    Treating full matrix coverage as a realistic target.

  • Microsoft Entra Agent ID

    Identity platform capability for registering and governing AI agents.

    Remember
    Agents get identities that Conditional Access and governance can target.
    Tested as
    New October 2026 objective on agent identities.
    Trap
    Using shared app secrets for agents.

  • Conditional Access

    Policy engine that grants, blocks or requires controls based on signals.

    Remember
    Combine user or agent risk, device, location and app conditions.
    Tested as
    Core to every access scenario.
    Trap
    Building one broad policy instead of a tested policy set.

  • Continuous access evaluation

    Near real-time enforcement of critical events such as account disablement or location change.

    Remember
    Shortens the gap between revocation and token expiry.
    Tested as
    Appears in modern authentication strategy questions.
    Trap
    Assuming all apps support it.

  • Protected actions

    Conditional Access protection for sensitive administrative operations.

    Remember
    Requires step-up authentication such as phishing-resistant MFA before the action.
    Tested as
    Tested as part of modern authorization strategy.
    Trap
    Confusing it with PIM activation.

  • Enterprise access model

    Microsoft's model separating control, management, data and workload, user and app access planes.

    Remember
    Highest privilege lives in the control plane and needs the strongest protection.
    Tested as
    The basis for privileged role delegation designs.
    Trap
    Reusing the old tier 0, 1, 2 model without cloud planes.

  • Privileged Identity Management (PIM)

    Just-in-time, time-bound and approval-based role activation.

    Remember
    Removes standing privilege for Entra and Azure roles.
    Tested as
    Common answer for reducing admin exposure.
    Trap
    Expecting PIM to review guest access.

  • Cloud infrastructure entitlement management

    Analysis of granted versus used permissions across clouds in Defender for Cloud.

    Remember
    Supports right-sizing permissions in Azure, AWS and GCP.
    Tested as
    Multicloud privilege questions.
    Trap
    Referring to the retired standalone product name as current.

  • Windows LAPS and AD DS hardening

    Controls that reduce credential theft and lateral movement in Active Directory.

    Remember
    Tiered admin, protected users and unique local passwords matter.
    Tested as
    AD DS hardening requirements appear in identity and privilege groups.
    Trap
    Assuming Entra ID protections cover on-premises AD automatically.

  • Azure Policy effects

    Deny, audit, modify, append and deployIfNotExists behaviors.

    Remember
    Deny prevents; audit only reports.
    Tested as
    Key to compliance enforcement designs.
    Trap
    Choosing audit when the requirement says prevent.

  • Purview Compliance Manager

    Assessment and scoring of compliance actions against regulations.

    Remember
    Measures and tracks posture; it does not enforce Azure resource settings.
    Tested as
    Used when evidence and progress tracking are required.
    Trap
    Treating its score as a certification.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Detection and response platforms

ConceptMeaningKey differenceCommon trap
Microsoft Defender XDR Native protection and correlation across Microsoft endpoints, identity, email and cloud apps. Strongest for Microsoft workloads with automatic attack disruption. Expecting it to ingest arbitrary third-party logs.
Microsoft Sentinel Cloud SIEM and SOAR with broad connectors and analytics. Adds multicloud and third-party data, custom analytics and playbooks. Deploying it without a data and cost plan.
Unified Defender portal Single portal running XDR and Sentinel together. One incident queue and hunting experience. Assuming it removes the need for a Sentinel workspace.

Privileged access governance tools

ConceptMeaningKey differenceCommon trap
PIM Just-in-time role activation with approval and MFA. Controls when privilege is active. Using it for application access packages.
Entitlement management Access packages with policies, approvals and expiration. Governs bundled access, often for partners. Expecting it to elevate admin roles.
Access reviews Periodic attestation of group, app or role membership. Confirms access is still needed. Assuming reviews remove access in real time.
Cloud infrastructure entitlement management Permission usage analytics across clouds. Finds over-permissioned identities in Azure, AWS and GCP. Confusing it with PIM activation.

Compliance tools

ConceptMeaningKey differenceCommon trap
Azure Policy Rules evaluated against Azure resource configuration. Can prevent or remediate noncompliant resources. Using it to score Microsoft 365 controls.
Purview Compliance Manager Regulatory assessments and improvement actions. Measures compliance progress across Microsoft services. Expecting it to block deployments.
Defender for Cloud regulatory compliance Dashboard mapping security assessments to standards. Shows cloud workload alignment with benchmarks. Assuming it covers non-technical policy controls.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. SIEM for everything

    What candidates pick
    Deploy Microsoft Sentinel as the only detection layer
    Why it looks right
    SIEM sounds like the complete answer.
    Why it's wrong
    Defender XDR provides native correlation and automatic disruption for Microsoft workloads; Sentinel complements it with wider data sources.

    Clue to watch for Scenarios limited to Microsoft 365 and endpoints.

  2. Service principal for an agent

    What candidates pick
    Create an app registration with a client secret
    Why it looks right
    It is the familiar pattern for automation.
    Why it's wrong
    Secrets can leak and bypass agent-specific governance; Entra Agent ID lets Conditional Access and lifecycle controls target the agent.

    Clue to watch for Mentions of AI agents needing governed, policy-based access.

  3. Standing admin rights

    What candidates pick
    Permanently assign Global Administrator to the on-call team
    Why it looks right
    It keeps response fast during incidents.
    Why it's wrong
    Permanent privilege expands the attack surface; PIM gives just-in-time activation with approval and auditing.

    Clue to watch for Requirements for least privilege or reduced standing access.

  4. Audit when prevention is required

    What candidates pick
    An Azure Policy audit effect
    Why it looks right
    Audit avoids breaking deployments.
    Why it's wrong
    Audit only reports; a requirement to stop noncompliant resources needs a deny effect or similar enforcement.

    Clue to watch for Words such as must not be deployed or prevent.

  5. Hybrid identity covered by cloud controls

    What candidates pick
    Rely only on Entra ID Protection
    Why it looks right
    Entra ID Protection detects many identity risks.
    Why it's wrong
    On-premises AD DS still needs hardening, tiered administration and Defender for Identity monitoring against domain attacks.

    Clue to watch for Mentions of domain controllers, Kerberos or pass-the-hash.

  6. Guest accounts for every partner

    What candidates pick
    Invite all partner users as B2B guests with no lifecycle
    Why it looks right
    Guests are quick to create.
    Why it's wrong
    Unmanaged guests accumulate; entitlement management with expiry and access reviews controls partner access over time.

    Clue to watch for Requirements that partner access ends automatically.

Answer framework

Apply these steps when a Domain 2 scenario mixes operations, identity, privilege and compliance requirements.

  1. Separate the requirement into detection, access, privilege or compliance, because each maps to a different product family.
  2. For detection, cover Microsoft workloads with Defender XDR first, then add Sentinel for third-party, multicloud or long-retention needs.
  3. For access, identify the actor type: employee, guest, workload or AI agent, and choose the identity object and Conditional Access policy accordingly.
  4. For privilege, remove standing access with PIM, govern bundles with entitlement management, and confirm need with access reviews.
  5. For compliance, decide whether the requirement must be enforced, measured or evidenced, then select Azure Policy for enforcement, Defender for Cloud for workload benchmarks, or Purview for evidence and data obligations.

Practice question

A bank's SOC uses Microsoft Defender XDR. It must now correlate alerts from on-premises firewalls and AWS CloudTrail with Defender incidents, keep raw logs for two years at low cost, and automate ticket creation in ServiceNow. Which design meets all requirements?

Want more like this? The SC-100 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain is broad, so split study time across its four functional groups roughly in proportion to their bullet counts, with identity and privileged access taking the most hours. Begin with security operations: sketch how Defender XDR, Sentinel and the unified Defender portal share incidents, then list which data sources need Sentinel connectors. Map a few analytics rules to MITRE ATT&CK techniques so the coverage objective feels concrete.

For identity, build a small test tenant if you can and write Conditional Access policies for employees, guests and workload identities. Read the Microsoft Entra Agent ID documentation and note how agents are registered and targeted by policy. Then study the enterprise access model alongside PIM, entitlement management and access reviews, writing one sentence on what each controls.

Close with compliance. Practise turning short requirement statements into an Azure Policy effect, a Purview capability or a Defender for Cloud standard. Budget around 18 to 24 hours and revisit identity scenarios near the end, since they connect to questions in every other domain.

FAQ

How much of SC-100 is Domain 2, Design security operations, identity, and compliance capabilities?

Microsoft weights it at 25–30%, tied with Domain 3 as the largest share. It has four functional groups and the most individual objectives in the outline.

Do I need hands-on Sentinel KQL skills for SC-100?

Deep query writing is tested more on SC-200. SC-100 focuses on design: which data to ingest, how to automate response and how to evaluate detection coverage.

What is Microsoft Entra Agent ID and why is it on the exam?

It gives AI agents their own identities in Microsoft Entra so they can be governed with Conditional Access and lifecycle controls. The October 2026 outline names it explicitly.

Is the enterprise access model the same as the old tier model?

It evolved from the AD tier model but adds cloud planes, separating control, management, data and workload, and user and app access.

Which tool should I pick to prevent noncompliant Azure resources?

Azure Policy with an enforcement effect such as deny. Compliance Manager and the regulatory compliance dashboard measure and report rather than block.

Does SC-100 still cover on-premises Active Directory?

Yes. Objectives ask for AD DS hardening requirements and evaluation of AD DS resilience to common attacks such as credential theft.

How does this domain relate to SC-200 and SC-300?

Those associate exams cover implementation of operations and identity. SC-100 asks you to design and evaluate the same capabilities at an architectural level.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

Test whether you can separate detection, access, privilege and compliance requirements and match each one to the right Microsoft product.

Take the SC-100 practice test Check your SC-100 readiness

Keep going