Certifications
Building a home lab for Microsoft security exams without a big bill
Most of what you need is free. What to use, what actually costs money, and how to avoid the Azure bill people get caught by.
Why a lab decides whether you pass
Every associate-level Microsoft security exam asks configuration-order questions: not what a feature is, but what you would do next. That is very hard to learn from video and straightforward to learn from breaking things.
Candidates who fail SC-300 and SC-401 almost always did the reading and never touched a tenant.
What to set up, in order
A Microsoft 365 developer or trial tenant
Gives you Entra ID, Purview and the admin centres. This covers SC-300 and SC-401 almost entirely, and most of MS-102.
Microsoft Learn sandboxes
Free, time-limited Azure environments attached to specific modules. Enough for a good share of AZ-104 and SC-500 exercises with no card involved.
An Azure free account for the rest
Needed for networking practice, which the sandboxes do not fully cover. This is the part that can cost money.
A Sentinel workspace, briefly
For SC-200 you need to have written KQL against real data. Create it, connect a couple of sources, hunt for a week, then delete it.
The bill people get caught by
Three things generate unexpected Azure charges in a study lab: virtual machines left running, public IP addresses left allocated after the VM is gone, and a Sentinel workspace ingesting verbose logs. Set a budget alert on day one, and delete the whole resource group rather than individual resources when you finish a topic.
The verdict
Developer tenant plus Learn sandboxes, add Azure only when you need networking
It covers the identity, compliance and Microsoft 365 exams for nothing, and delays any spend until the point where a sandbox genuinely cannot help.
Do not build a permanent lab you pay for monthly. Create what a topic needs, use it hard for a week, then delete the resource group.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.