Certifications
Which Microsoft security certification to take first
There are six, they overlap, and the recommended order depends entirely on the job you do rather than on the numbering.
The numbering is not an order
SC-900 through SC-100 looks like a ladder and is not one. SC-300 and SC-200 are parallel role exams for different jobs, SC-100 is an architect exam that assumes one of them, and SC-500 replaced AZ-500 for infrastructure work. Taking them in numerical order wastes months.
| Role it fits | |
|---|---|
| SC-900 | Anyone new to security, or non-technical stakeholders |
| SC-200 | Security operations, SOC analysts, incident responders |
| SC-300 | Identity administrators, anyone owning Entra ID |
| SC-401 | Information protection, data governance, Purview owners |
| SC-500 | Cloud security engineers, Azure infrastructure security |
| SC-100 | Architects. Assumes one associate exam already held |
AZ-500 retired on 31 August 2026 and was replaced by SC-500. MS-102 retires on 30 November 2026.
The order we would actually recommend
If you administer Microsoft 365 today, start with SC-300
Identity is where the incidents begin, the material is used daily, and it makes everything else easier to reason about.
If you work in a SOC, start with SC-200
It maps most directly to the daily work, and the KQL is useful from the first week whether or not you sit the exam.
If you build Azure infrastructure, go to SC-500
Not AZ-500, which is retiring. SC-500 covers the same ground plus AI workload security.
Take SC-100 last, and only if you architect
It is a design exam. Sitting it without operational depth produces a certificate that does not survive an interview.
Is SC-900 worth it?
For a career changer, a salesperson, a project manager or anyone who needs the vocabulary, yes. It is cheap, it is quick, and it gives you the map.
For a working engineer, no. You will pass it without studying and it adds nothing to a profile that already shows an associate credential. Skip straight to the role exam.
The verdict
SC-300 for most people in a Microsoft estate
Identity is where compromise starts, the knowledge is used daily, and it is the strongest foundation for SC-100 later.
Skip SC-900 if you are already technical, and skip SC-100 until you have real operational depth behind you.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.