SC-100 Certification

What the SC-100 Certification Actually Is

The Microsoft Cybersecurity Architect certification, exam code SC-100, is Microsoft's expert-level credential for professionals who design end-to-end security strategy rather than configure individual tools. It's owned and published by Microsoft and delivered exclusively through Pearson VUE, either at a physical test center or as an online proctored exam from home. If you've searched for background on the credential itself before digging into logistics, our overview of what SC-100 is and the plain-language breakdown of what SC-100 means are good starting points.

Unlike associate-level Microsoft exams that test whether you can configure a specific service, SC-100 tests architectural judgment: given a scenario, what design would you recommend, and why. Questions frequently present a business constraint, a compliance requirement, or a hybrid environment, and ask you to choose the approach that best balances security, cost, and operational reality. This is why so many candidates find the exam harder than its associate-level prerequisites, even though the underlying technical concepts feel familiar. If that distinction matters to your prep, our detailed piece on how hard the SC-100 exam actually is unpacks it further.

How the SC-100 Exam Works: Format, Fee, and Scoring

The registration mechanics are straightforward but worth confirming before you book anything. The exam fee is $165 USD in the United States, before taxes and before any discount that Microsoft Certified Trainers or Microsoft Partner Network members might qualify for. If you're mapping out a full budget including retakes or training, the complete SC-100 pricing breakdown walks through every line item.

During the appointment itself, expect roughly 40 to 60 questions inside a 120-minute window. The question formats vary: multiple choice, multiple response, drag-and-drop, hot area, yes/no series, and full case studies that require you to read a scenario and answer several related questions against it. None of these formats test whether you remember a menu path in the Azure portal - they test whether you can reason through a design problem under realistic constraints.

Scoring runs on the familiar Microsoft 100-to-1000 scale, and you need at least 700 to pass. Microsoft doesn't publish how many candidates clear that bar, so treat any specific pass-rate number you see elsewhere with skepticism - for a grounded discussion of what's actually knowable here, see our breakdown of the SC-100 pass rate, and for exact scoring mechanics, the dedicated guide to the SC-100 passing score is worth a read before exam day.

The Four SC-100 Domains You Need to Master

SC-100 is organized into four domains, and the weighting between them is not even. Two middle domains carry noticeably more of the exam than the outer two, which should directly shape how you allocate study time. For a deeper walkthrough of each domain's subtopics, our dedicated guide to all four SC-100 domains goes further than the summary below.

What Changed in the Latest Skills-Measured Update

Microsoft refreshes SC-100's skills-measured document periodically, and the current version took effect July 28, 2026, following earlier refreshes in November 2025 and April 2026. Most tested content still reflects generally available features, though commonly used preview features can and do appear on the exam, so don't assume anything labeled "preview" is automatically off-limits.

The most recent refresh introduced several notable additions that reflect how fast the security landscape is moving:

• Agent identity design with Microsoft Entra Agent ID - architecting identity for autonomous and semi-autonomous agents, not just human and service principals
• Strategy for secure AI adoption - governance and risk frameworks specific to organizations rolling out generative AI
• AI workload data security - protecting the data that trains, grounds, or flows through AI systems
• Microsoft Purview Audit for centralized logging - consolidating audit trails across services for investigation and compliance
• Microsoft Security Exposure Management attack paths - using exposure graphs to reason about how an attacker could realistically move through an environment

If your study materials predate mid-2026, they may be missing these topics entirely. Cross-check whatever course or book you're using against the current skills outline before you assume you're covered.

The Prerequisite You Can't Skip

Here's a detail that trips up a surprising number of candidates: passing SC-100 by itself does not award you the Microsoft Certified: Cybersecurity Architect Expert credential. You also need an active associate-level prerequisite - one of SC-200, SC-300, or AZ-500 - at the time you complete SC-100. If you already hold one of those, you're set; if not, you need to plan the sequencing carefully. The full breakdown of eligibility rules lives in our SC-100 requirements guide.

Who Hires SC-100-Certified Architects

SC-100 sits at the top of Microsoft's security certification track, and it's aimed at people who already operate at a senior technical level: cybersecurity architects, security consultants, cloud security leads, and senior engineers who are being asked to own strategy rather than just execute tickets. Organizations running substantial Microsoft 365 and Azure estates - enterprises, managed security service providers, and consulting firms - are the most common employers looking for this credential specifically, because it signals the ability to design Zero Trust architecture and translate compliance requirements into technical controls.

It's worth being realistic about what the certification does and doesn't guarantee. It's a strong signal of architectural knowledge, not an automatic path to a title or a number on a paycheck. For a grounded look at how the credential tends to factor into compensation conversations, see the SC-100 salary guide, and for a broader cost-versus-benefit view, the analysis of whether SC-100 is worth it covers the tradeoffs candidates weigh most often. If you're specifically browsing openings, our roundup of SC-100 jobs is a useful reference point too.

Building a Study Plan Around the Domain Weights

Generic study advice - spaced repetition, timed practice, active recall - works fine for SC-100, but it only pays off if you point it at the right material in the right order. Given that domains 2 and 3 carry 50-60% of the exam between them, your plan should front-load those two before spending equal time on the lighter domains.

For a more granular week-by-week plan with specific resource recommendations, our SC-100 study guide for 2026 goes deeper than the outline above. And once you're ready to test your recall under exam-like conditions, running through scenario questions on our practice test platform is one of the fastest ways to find gaps before test day. A quick reference sheet like the SC-100 cheat sheet is also handy for a final review pass the night before.

Keeping the Certification Active

Once you pass, the certification doesn't stay valid indefinitely without action. SC-100 expires annually and is renewed at no cost through an unproctored online assessment on Microsoft Learn - there's no need to retake the full proctored exam every year, but you do need to complete the renewal assessment before expiration to keep the credential active. Building a habit of checking your renewal window is a small thing that saves a lot of hassle later. If you're still deciding when to schedule your initial attempt, our guide to SC-100 exam dates and scheduling covers testing windows and appointment logistics, and structured SC-100 training resources can help you get exam-ready efficiently the first time around.

Before you book anything, it also helps to run a couple of full-length simulations on a practice test platform built around the current domains, since timing pressure under the 120-minute limit is different from open-ended study review.

Frequently Asked Questions