SC-200 · Domain 1 of 3

SC-200 Domain 1: Manage a security operations environment

This is the largest SC-200 functional group. It covers setting up and running the analyst's environment: configuring automation across Defender XDR and Sentinel, building the Sentinel SIEM, ingesting the right data, and creating the detections that surface threats.

Exam weight
40–45%
Official functional groups
4
Estimated questions estimate
17–26
Suggested study time estimate
35–45 hrs

About 12 min read Reviewed October 2026

Overview

Managing the security operations environment is the foundation of the SC-200 role. This group covers four areas. Configuring automation covers email and alert notifications, Defender for Endpoint advanced features and policies including attack surface reduction rules, automated investigation and response, automatic attack disruption, device groups and permissions, and Sentinel automation rules and playbooks. Configuring the Sentinel SIEM covers roles, data retention across Analytics, Data lake and XDR tiers, workbooks and SOC optimization. Ingesting data covers choosing data connectors, collecting Windows security events through the Azure Monitor Agent or Windows Event Forwarding, Syslog and Common Event Format via AMA, Azure activity logs, threat indicators and custom log tables. Configuring detections covers custom detection rules in Defender XDR, analytics rules in Sentinel including scheduled, near-real-time, threat intelligence and machine learning rules, MITRE ATT&CK coverage analysis, and anomalies.

This group prepares the environment that the response work in group 2 and the hunting in group 3 depend on. Get the data and detections right here and the rest of the SOC workflow functions.

How it's tested

Expect scenario questions that describe a data source, an automation need or a detection requirement and ask which connector, agent, rule type or automation feature to use. The exam rewards knowing the exact product and feature for each task across Defender XDR and Sentinel.

  • Right connector or agent

    A data source such as Windows security events or Syslog is described, and you must choose the connector and collection method.

  • Right rule type

    A detection need is described, and you must choose between a Defender XDR custom detection and a Sentinel analytics rule type such as scheduled, NRT, threat intelligence or machine learning.

  • Right automation feature

    An automated response need is described, and you must choose automation rules, playbooks, automated investigation and response, or attack disruption.

Reasoning it through

An analyst must collect Windows Security event logs from Azure virtual machines into Sentinel, with control over which event IDs are gathered. Older guidance points to the Log Analytics agent, but it is retired. The current method is the Windows Security Events via AMA connector, which uses the Azure Monitor Agent and data collection rules to filter events, so that is the answer the exam expects.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

1.1 Configure automation for Microsoft Defender XDR and Microsoft SentinelNotifications, Defender for Endpoint features and policies, AIR, attack disruption, and Sentinel automation.
What it means
This covers email and alert notifications in Defender XDR including tuning, suppression and correlation, Defender for Endpoint advanced features, rules and custom data collection, security policies including attack surface reduction rules, automated investigation and response, automatic attack disruption, device groups, permissions and automation levels, and Sentinel automation rules and playbooks.
What to understand
Automation reduces analyst load for repeatable tasks. In Defender XDR, automated investigation and response can investigate and remediate alerts automatically at a configured level, while attack disruption contains active attacks. In Sentinel, automation rules orchestrate incident handling and playbooks run Logic Apps workflows. Device groups set the scope and automation level for endpoints.
How it shows up
An automation need is described, and you must choose the right feature: automation rules, playbooks, AIR or attack disruption.
Common confusion
Confusing Sentinel automation rules with playbooks. Automation rules orchestrate and can trigger playbooks; playbooks are the Logic Apps workflows that take action.
1.2 Configure the Microsoft Sentinel SIEM and platformRoles, data retention, workbooks and SOC optimization.
What it means
This covers specifying Sentinel roles, managing data retention for XDR and Sentinel tables across the Analytics, Data lake and XDR tiers, creating and configuring workbooks for visualization, and optimizing the platform using SOC optimization recommendations.
What to understand
Sentinel roles follow Azure role-based access control, so assigning the least-privileged role that fits the task matters. Data retention is now tiered, with Analytics, Data lake and XDR tiers balancing cost against query speed and retention length. Workbooks visualize data, and SOC optimization recommends coverage and cost improvements.
How it shows up
A role, retention or visualization need is described, and you must choose the right role, tier or feature.
Common confusion
Treating all Sentinel data the same. The Analytics, Data lake and XDR tiers differ in cost, query performance and retention.
1.3 Ingest data into the Microsoft Sentinel SIEM and platformData connectors, Windows event collection, Syslog and CEF, Azure logs, indicators and custom tables.
What it means
This covers selecting data connectors based on the data source, collecting Windows Security events via AMA with data collection rules, planning Windows Event Forwarding, configuring Syslog and Common Event Format via AMA, collecting Azure activity logs via Azure Policy and diagnostic settings, ingesting threat indicators, and creating custom log tables.
What to understand
The Azure Monitor Agent (AMA) is the current collection agent, replacing the retired Log Analytics agent. Data collection rules filter which events are gathered. Syslog and CEF are collected via AMA for Linux and network devices. Azure activity logs come through diagnostic settings, and custom tables hold data without a built-in connector.
How it shows up
A data source is described, and you must choose the connector and collection method, usually an AMA-based one.
Common confusion
Recommending the retired Log Analytics agent. The current method uses the Azure Monitor Agent and data collection rules.
1.4 Configure detectionsDefender XDR custom detections, Sentinel analytics rules, MITRE ATT&CK coverage and anomalies.
What it means
This covers creating and managing custom detection rules in Defender XDR using Advanced Hunting, configuring Sentinel analytics rules (scheduled, near-real-time, threat intelligence and machine learning), analyzing attack vector coverage with the MITRE ATT&CK matrix, and configuring anomalies in Sentinel.
What to understand
Defender XDR custom detections run on Advanced Hunting queries over XDR data, while Sentinel analytics rules run over the Sentinel workspace. Scheduled rules run on an interval, near-real-time rules run almost continuously for urgent cases, threat intelligence rules match indicators, and machine learning rules detect anomalies. Mapping rules to MITRE ATT&CK shows coverage gaps.
How it shows up
A detection requirement is described, and you must choose the product and the analytics rule type.
Common confusion
Confusing a Defender XDR custom detection with a Sentinel analytics rule. One runs over XDR data, the other over the Sentinel workspace.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Azure Monitor Agent (AMA)

    The current agent for collecting logs into Sentinel, with data collection rules to filter events.

    Remember
    It replaced the retired Log Analytics agent.
    Tested as
    Data ingestion questions.
    Trap
    Choosing the Log Analytics agent.

  • Data collection rules

    Rules that define which events AMA collects and where they go.

    Remember
    They filter Windows security events by event ID and source.
    Tested as
    Data ingestion questions.
    Trap
    Forgetting that DCRs control what is collected.

  • Windows Security Events via AMA

    The connector for collecting Windows Security event logs into Sentinel.

    Remember
    It uses AMA and data collection rules.
    Tested as
    Connector selection questions.
    Trap
    Using an older Windows events connector.

  • Syslog and CEF via AMA

    Connectors for collecting Linux Syslog and Common Event Format data.

    Remember
    CEF is a structured Syslog format from security devices.
    Tested as
    Connector selection questions.
    Trap
    Confusing plain Syslog with CEF.

  • Sentinel automation rules vs. playbooks

    Automation rules orchestrate incident handling; playbooks are Logic Apps workflows that take action.

    Remember
    Automation rules can trigger playbooks.
    Tested as
    Automation questions.
    Trap
    Treating them as the same feature.

  • Automated investigation and response (AIR)

    Defender XDR capability that automatically investigates and remediates alerts.

    Remember
    Its automation level is configurable per device group.
    Tested as
    Automation questions.
    Trap
    Confusing it with attack disruption.

  • Automatic attack disruption

    Defender XDR capability that contains an active attack automatically.

    Remember
    It acts on high-confidence, active attacks to limit spread.
    Tested as
    Automation questions.
    Trap
    Confusing it with AIR.

  • Analytics rule types

    Scheduled, near-real-time (NRT), threat intelligence and machine learning rules in Sentinel.

    Remember
    NRT runs almost continuously for urgent detections.
    Tested as
    Detection questions.
    Trap
    Using a scheduled rule where NRT is needed.

  • Defender XDR custom detection vs. Sentinel analytics rule

    Custom detections run on XDR Advanced Hunting data; analytics rules run on the Sentinel workspace.

    Remember
    Choose by where the data lives.
    Tested as
    Detection questions.
    Trap
    Mixing up the two products.

  • Sentinel data tiers

    Analytics, Data lake and XDR tiers balance cost, query speed and retention.

    Remember
    The tier affects cost and how fast data can be queried.
    Tested as
    Retention questions.
    Trap
    Treating all data as the same tier.

  • MITRE ATT&CK coverage

    Mapping detections to the ATT&CK matrix to find coverage gaps.

    Remember
    It shows which attack techniques are and are not detected.
    Tested as
    Detection coverage questions.
    Trap
    Treating ATT&CK as a scoring system.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Automation rules vs. playbooks vs. AIR vs. attack disruption

ConceptMeaningKey differenceCommon trap
Automation rules Orchestrate Sentinel incident handling Trigger actions and playbooks on incidents Confusing them with playbooks
Playbooks Logic Apps workflows that take action Perform the actual automated steps Expecting them to orchestrate on their own
AIR Defender XDR automated investigation and response Investigates and remediates alerts automatically Confusing it with attack disruption
Attack disruption Automatically contains an active attack Acts on high-confidence active attacks Confusing it with AIR

Scheduled vs. NRT vs. threat intelligence vs. ML analytics rules

ConceptMeaningKey differenceCommon trap
Scheduled Runs a query on a set interval Flexible, most common Using it where near-real-time is needed
Near-real-time (NRT) Runs almost continuously Fast detection of urgent events Overusing it for non-urgent cases
Threat intelligence Matches ingested indicators Detects known bad indicators Expecting it to find novel threats
Machine learning Detects anomalies and patterns Finds unusual behavior Treating it as signature-based

Defender XDR custom detection vs. Sentinel analytics rule

ConceptMeaningKey differenceCommon trap
Defender XDR custom detection Runs on XDR Advanced Hunting data Covers endpoint, email, identity and app data in XDR Expecting it to query the Sentinel workspace
Sentinel analytics rule Runs on the Sentinel workspace Covers ingested log data across sources Expecting it to query XDR data directly

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Log Analytics agent

    What candidates pick
    Use the Log Analytics agent to collect Windows security events.
    Why it looks right
    Older study material references it.
    Why it's wrong
    That agent is retired. The current method is the Windows Security Events via AMA connector with data collection rules.

    Clue to watch for The task is collecting Windows events into Sentinel now.

  2. Playbook orchestrates

    What candidates pick
    Use a playbook alone to orchestrate incident handling.
    Why it looks right
    Playbooks perform automated actions.
    Why it's wrong
    Automation rules orchestrate incidents and trigger playbooks; playbooks carry out the actions.

    Clue to watch for The need is to trigger actions when incidents are created or updated.

  3. Scheduled for urgent

    What candidates pick
    Use a scheduled analytics rule for a detection that must fire immediately.
    Why it looks right
    Scheduled rules are the default.
    Why it's wrong
    Near-real-time rules run almost continuously for urgent detections.

    Clue to watch for The detection must trigger with minimal delay.

  4. XDR detection on Sentinel data

    What candidates pick
    Create a Defender XDR custom detection to query ingested Sentinel logs.
    Why it looks right
    Both involve detection.
    Why it's wrong
    Custom detections run on XDR Advanced Hunting data; a Sentinel analytics rule queries the Sentinel workspace.

    Clue to watch for The data source determines the product.

  5. AIR is disruption

    What candidates pick
    Use automated investigation and response to contain an active, spreading attack.
    Why it looks right
    Both are automated Defender XDR features.
    Why it's wrong
    AIR investigates and remediates alerts; automatic attack disruption contains active high-confidence attacks.

    Clue to watch for The scenario describes an attack actively spreading.

  6. Sentinel-only mindset

    What candidates pick
    Answer every detection question with a Sentinel feature.
    Why it looks right
    Sentinel is the most discussed product.
    Why it's wrong
    SC-200 spans Defender XDR, Defender for Endpoint and Sentinel, and many answers lie in the Defender products.

    Clue to watch for The data or alert originates in a Defender product.

Answer framework

For any Domain 1 scenario, use these steps before choosing an answer.

  1. Identify which product owns the data or task, whether Defender XDR, Defender for Endpoint or Microsoft Sentinel, since the answer usually lives there.
  2. For data ingestion, choose the Azure Monitor Agent and the matching connector, using data collection rules to filter events.
  3. For detections, decide whether the data is in XDR or the Sentinel workspace, then choose the custom detection or analytics rule type that fits.
  4. For automation, match the need to the feature: automation rules to orchestrate, playbooks to act, AIR to investigate and remediate, and attack disruption to contain.
  5. Check role and retention requirements, assigning least-privileged Sentinel roles and the data tier that balances cost and query needs.

Practice question

A security operations team needs to collect specific Windows Security event IDs from Azure virtual machines into Microsoft Sentinel, filtering out unneeded events to control cost. Which approach should they use?

Want more like this? The SC-200 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this group the most study time, since it is the largest and underpins the other two. Start by mapping the product landscape: Defender XDR, Defender for Endpoint, and Microsoft Sentinel, and what each is responsible for. The single most important habit is asking which product owns the data or task, because that usually decides the answer.

Next, master data ingestion, a common loss area. Learn that the Azure Monitor Agent with data collection rules is the current method, and match each data source to its connector. Then learn the detection options: the difference between a Defender XDR custom detection and a Sentinel analytics rule, and the four analytics rule types.

Then cover automation, keeping automation rules, playbooks, AIR and attack disruption distinct. Hands-on time in a Microsoft Sentinel and Defender trial environment makes these concrete far faster than reading. Afterwards, move to group 2, responding to incidents, which acts on the detections configured here.

FAQ

How much of SC-200 is this functional group?

Manage a security operations environment is 40 to 45% of the exam, the largest of the three groups, under the skills measured as of 21 October 2026.

Is SC-200 just a Sentinel exam?

No. It spans Microsoft Defender XDR, Defender for Endpoint, Microsoft Sentinel and the data that feeds them. Treating it as Sentinel-only is a common reason capable candidates fail.

Which agent collects logs into Sentinel now?

The Azure Monitor Agent (AMA), with data collection rules to filter events. The older Log Analytics agent is retired.

What is the difference between an automation rule and a playbook?

An automation rule orchestrates incident handling and can trigger playbooks. A playbook is a Logic Apps workflow that performs the automated actions.

When should I use a near-real-time analytics rule?

For urgent detections that must fire with minimal delay, since NRT rules run almost continuously, unlike scheduled rules that run on an interval.

What changed in the 2026 skills measured?

The three functional groups and weights are unchanged, but the objectives now include agentic AI with embedded Security Copilot, Sentinel Graph, KQL jobs in the Data lake and the Sentinel MCP Server.

How does this group connect to the rest of the exam?

It builds the environment, data and detections that the incident response in group 2 and the threat hunting in group 3 depend on.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered automation, the Sentinel SIEM, data ingestion and detections across Defender XDR and Sentinel. Test whether you can pick the right product and feature under exam conditions.

Take the SC-200 practice test Check your SC-200 readiness

Keep going