Turn security signals into disciplined investigation and response.
Prepare for SC-200 by connecting detection, investigation, threat hunting, response, and operational judgment across Microsoft security tools.
SC-200Focused exam preparation
Simon Frank, MCTLive instructor-led learning
Clear next stepsKnow what to study and practise next
Choose SC-200 to build a more disciplined way to work through security signals. Simon organizes the course around the analyst’s operational loop: build visibility, identify meaningful activity, investigate, respond, and improve.
Is this the right course for you?
Choose SC-200 if you investigate alerts, hunt threats, coordinate response, or want to move into a security operations analyst role.
What you should know before starting
Working knowledge of Microsoft security services, Azure, Microsoft 365, Windows or Linux, and basic query concepts will help you get more from the course.
What you will cover
- Security operations environment and threat mitigation
- Microsoft Defender XDR investigation and response
- Microsoft Sentinel configuration and operations
- Kusto Query Language for detection and investigation
The course scope is reviewed against Microsoft's current published skills before delivery.
What you can take away
Leave with stronger understanding, clearer exam priorities, and a practical plan for continued study.
Know what you are buying
Before you register, you will receive the course details needed to make a confident decision.
Live course experience
- Instruction from Simon Frank, MCT
- Delivery format, schedule, and class size
- Time for explanation and learner questions
Materials and access
- What course materials are included
- Any accounts, lab environment, or software you need
- Whether the certification exam is purchased separately
Price and terms
- Course price and payment details
- Rescheduling and cancellation terms
- Options for individual or private team delivery
Training and certification are separate steps
This course prepares you for the subject matter and exam objectives. Microsoft manages exam registration, assessment, prerequisites, and the Microsoft Certified: Security Operations Analyst Associate credential.
Check the current exam details
Review Microsoft's current requirements when you plan your exam.
View certification detailsQuestions before you choose SC-200
Still deciding? These answers cover the questions learners most often need before requesting course details.
Will there be demonstrations or hands-on work?
The course proposal will identify the demonstrations, exercises, lab access, and learner accounts included in the delivery you are considering.
Is SC-200 the best first security course?
It fits learners moving into security operations. SC-900 may be a better foundation when Microsoft security and identity concepts are new.