Certifications
Building a home lab for Microsoft security exams without a big bill
Most of what you need is free. What to use, what actually costs money, and how to avoid the Azure bill people get caught by.
Why a lab decides whether you pass
Every associate-level Microsoft security exam asks configuration-order questions: not what a feature is, but what you would do next. That is very hard to learn from video and straightforward to learn from breaking things.
Candidates who fail SC-300 and SC-401 almost always did the reading and never touched a tenant.
What to set up, in order
A Microsoft 365 trial tenant, not a developer one
The Microsoft 365 Developer Program is no longer an open sign-up. Eligibility now runs through a paid Visual Studio Professional or Enterprise subscription, ISV Success or partner programme membership, or a Premier or Unified Support contract. Without one of those, start a 30-day Microsoft 365 business trial instead. That gives you Entra ID, Intune and the admin centres.
Turn recurring billing off the day you create it
A trial tenant runs 30 days and then renews into an annual paid subscription by default. Switch recurring billing off under Billing, Your products while you are still thinking about it, not when the invoice arrives.
An Azure subscription for anything Azure
The Microsoft Learn sandboxes have been retired, so there is no longer a free Azure environment attached to the modules. Microsoft's own answer is a 30-day Azure trial or pay as you go, and both want a card. An academic email address gets Azure for Students credit without one.
A Sentinel workspace, briefly
For SC-200 you need to have written KQL against real data. Create it, connect a couple of sources, hunt for a week, then delete it.
The bill people get caught by
Three things generate unexpected Azure charges in a study lab: virtual machines left running, public IPv4 addresses left allocated after the VM is gone, and a Sentinel workspace ingesting verbose logs. Set a budget alert on day one, and delete the whole resource group rather than individual resources when you finish a topic.
The verdict
A 30-day Microsoft 365 trial for the identity and compliance exams, and a separate Azure subscription only once you reach Azure topics
The trial covers Entra ID, Intune and the admin centres without buying a licence, and keeping Azure separate means the meter only runs during the weeks you are actually on an Azure topic.
Do not plan around the Microsoft 365 Developer Program or the Learn sandboxes. The first now needs a paid Visual Studio subscription or a partner contract, and the second has been retired outright. And do not build a permanent lab you pay for monthly: create what a topic needs, use it hard for a week, then delete the resource group.
Sources
The claims above were checked against these pages. They are the vendor's own documentation, not a summary of it.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.