- What SC-100 Actually Tests
- The Four Domains and How They Interlock
- Registration, Format, and Passing Score Mechanics
- What Changed in the July 2026 Refresh
- A Domain-Weighted Study Timeline
- How to Practice Answering Like an Architect
- Common First-Attempt Mistakes
- After You Pass: The Credential Requirement
- Frequently Asked Questions
- SC-100 needs a 700+ score on a 100-1000 scale, delivered via Pearson VUE for $165 USD.
- Domains 2 and 3 together carry 50-60% of the exam weight - prioritize study time accordingly.
- The July 28, 2026 refresh added Microsoft Entra Agent ID, AI workload data security, and Purview Audit topics.
- Passing SC-100 alone doesn't grant the Cybersecurity Architect Expert title - you still need SC-200, SC-300, or AZ-500.
What SC-100 Actually Tests
Microsoft Cybersecurity Architect (SC-100) is not an exam about clicking through the Azure or Microsoft 365 admin portals. It's an exam about judgment - whether you can look at a business requirement, a compliance obligation, or a threat model and design a coherent security architecture that spans identity, infrastructure, data, and applications. If you've spent your career configuring individual controls rather than designing the strategy behind them, this exam will feel unfamiliar at first, and that's exactly why so many candidates underestimate the prep time it requires.
This guide breaks down what to study, in what order, and how to practice the specific reasoning style Microsoft rewards on test day. For a deeper breakdown of question format and scoring mechanics specifically, pair this with our SC-100 Passing Score guide, and if you're still deciding whether this certification fits your career path, see our ROI analysis.
The Four Domains and How They Interlock
Microsoft groups SC-100 content into four domains, and understanding how they weight against each other should directly shape your study schedule. We cover each in far more depth in our full domain-by-domain guide, but here's the summary you need for planning purposes.
Domain 1: Design solutions that align with security best practices and priorities (20-25%)
This is the Zero Trust and governance foundation. Expect scenarios asking you to translate business risk into security strategy, align controls to regulatory frameworks, and recommend a security operations model.
- Zero Trust principles applied to hybrid environments
- Governance, risk, and compliance (GRC) strategy design
- Security posture recommendations using Microsoft Security Exposure Management attack path analysis
Domain 2: Design security operations, identity, and compliance capabilities (25-30%)
The largest single domain. It covers SIEM/SOAR strategy, identity architecture (including hybrid identity and Conditional Access design), and compliance capability planning across Microsoft Purview.
- Identity and access architecture, including agent identity design with Microsoft Entra Agent ID
- Security operations strategy - incident response, threat intelligence integration
- Compliance and information protection strategy using Purview capabilities
Domain 3: Design security solutions for infrastructure (25-30%)
Covers network security architecture, multicloud and hybrid infrastructure protection, and security for servers, containers, and endpoints at a design level.
- Network segmentation and Zero Trust network access patterns
- Multicloud security architecture (Azure plus AWS/GCP scenarios)
- Container, IoT, and OT security strategy considerations
Domain 4: Design security solutions for applications and data (20-25%)
Covers application security architecture, DevSecOps integration, and data protection strategy - including newer AI-specific concerns.
- Secure AI adoption strategy and AI workload data security
- API and application security design patterns
- Data classification and protection architecture across the data lifecycle
Key Takeaway
Because Domains 2 and 3 together represent 50-60% of the exam, allocate roughly half your total study hours to identity/operations/compliance architecture and infrastructure security design - not evenly across all four domains.
Registration, Format, and Passing Score Mechanics
SC-100 is owned and published by Microsoft and delivered through Pearson VUE, either at a physical test center or as an online proctored exam from home. The exam fee is $165 USD in the United States before taxes, and before any discount you might qualify for as a Microsoft Certified Trainer or Microsoft Partner Network member. If you're budgeting for retakes or bundling this with a prerequisite exam, our certification cost breakdown walks through the full picture.
Scoring works on Microsoft's standard 100-to-1000 scale, and you need 700 or higher to pass - there's no partial credit interpretation beyond that threshold, and Microsoft doesn't publish a breakdown of how points are weighted per question. For the full mechanics of how that score is calculated and what it means practically, read our dedicated passing score guide.
| Exam Attribute | Detail |
|---|---|
| Delivery | Pearson VUE - test center or online proctored |
| Fee (US, before tax/discounts) | $165 USD |
| Passing score | 700 out of 100-1000 scale |
| Question count | Typically 40-60 questions |
| Appointment length | 120 minutes |
| Question formats | Multiple choice, multiple response, drag-and-drop, hot area, yes/no series, case studies |
Expect a mix of formats rather than uniform multiple-choice - case studies in particular present a business scenario with several pages of context, then ask multiple questions against that single scenario. These test whether you can hold a lot of architectural context in your head at once, which is a very different skill than answering isolated fact questions. Our difficulty guide covers why this format catches unprepared candidates off guard, and our pass rate discussion explains why Microsoft doesn't publish official numbers and what that means for how you should calibrate readiness.
What Changed in the July 2026 Refresh
The skills-measured outline currently in effect took effect July 28, 2026, following earlier refreshes in November 2025 and April 2026. If you trained from older material, you have gaps. The most consequential additions from the latest refresh:
- Agent identity design with Microsoft Entra Agent ID - as AI agents increasingly act as autonomous identities in enterprise environments, you need to know how to design governance and access control around them, not just human and service accounts.
- Strategy for secure AI adoption - expect scenario questions asking you to design controls around organizational AI rollout, not just secure a single AI application.
- AI workload data security - protecting the data that feeds and flows through AI systems, an extension of traditional data protection architecture into a newer workload type.
- Microsoft Purview Audit for centralized logging - architecture-level understanding of how audit data is centralized and retained for compliance and investigation purposes.
- Microsoft Security Exposure Management attack paths - using attack path analysis to prioritize security posture investments, tying directly back into Domain 1.
A Domain-Weighted Study Timeline
Generic weekly study templates rarely map to how SC-100 is actually weighted. Here's a schedule built around the domain percentages rather than an arbitrary even split, assuming you already have hands-on security experience and are studying part-time.
Foundations and Domain 1
- Review Zero Trust architecture principles end to end
- Study governance and compliance framework alignment
- Work through Security Exposure Management attack path scenarios
Domain 2 - the heaviest domain
- Design identity architecture including Conditional Access and hybrid identity
- Study Microsoft Entra Agent ID and agent identity governance patterns
- Map security operations strategy: SIEM/SOAR, incident response design
- Review Purview compliance capabilities and Purview Audit centralized logging
Domain 3 - infrastructure security
- Practice multicloud and hybrid network security design scenarios
- Review container, endpoint, and OT/IoT security architecture
- Study network segmentation patterns and Zero Trust network access
Domain 4 - applications and data
- Study secure AI adoption strategy and AI workload data security
- Review DevSecOps integration points and application security patterns
- Practice data classification and protection lifecycle design
Full case-study practice and review
- Run full-length timed practice sessions on our practice test platform
- Revisit weak domains identified from missed scenario questions
- Skim the SC-100 cheat sheet for last-mile review
How to Practice Answering Like an Architect
The single biggest mistake candidates make is studying SC-100 the way they'd study an operational exam - memorizing feature lists and portal steps. SC-100 questions are written to test tradeoffs: given constraints X and Y, which architecture best satisfies both security requirements and business priorities? You need to practice recognizing distractor answers that are technically valid but wrong for the stated scenario.
When you work through case studies, resist the urge to skim the scenario text. Case studies typically embed constraints - budget limits, existing on-premises investments, regulatory jurisdiction, or a stated risk appetite - that eliminate answer choices that would otherwise look correct. Practicing under realistic, timed conditions on a full practice exam is the fastest way to build this scenario-reading habit before test day.
Key Takeaway
Don't just review answer explanations after practice questions - write out, in your own words, why each wrong answer fails the specific scenario constraints. This mirrors the reasoning Microsoft is actually scoring.
Common First-Attempt Mistakes
- Treating this as an entry-level exam. SC-100 assumes prior depth in identity, operations, or infrastructure security. If you haven't worked hands-on in at least one of those areas, review our requirements guide before scheduling.
- Ignoring the newest AI-related content. Candidates who studied from pre-2026 material miss Entra Agent ID and AI workload data security entirely - both are now testable.
- Under-preparing for case studies. These take longer to read and can eat disproportionate time in a 120-minute appointment if you haven't practiced pacing.
- Forgetting the domain weight skew. Spending equal time on all four domains shortchanges Domains 2 and 3, which together make up half or more of the exam.
- Not planning for the credential requirement. Passing SC-100 doesn't complete the certification by itself - more on that next.
After You Pass: The Credential Requirement
Passing SC-100 alone does not award the Microsoft Certified: Cybersecurity Architect Expert credential. You also need an active associate-level prerequisite - one of SC-200, SC-300, or AZ-500. If you haven't earned one of those yet, factor that exam and its own study time into your overall timeline; our requirements article covers how the prerequisite stacking works in detail.
Once earned, the certification expires annually, but renewal is free and done through an unproctored online assessment on Microsoft Learn - there's no need to retake the full proctored exam each year. If you're weighing whether the ongoing maintenance and the prerequisite investment are worth it for your career trajectory, our salary guide and ROI analysis go deeper on that decision, and SC-100 jobs covers the kinds of roles that list this credential as a preferred or required qualification.
Frequently Asked Questions
Candidates typically see 40 to 60 questions within a 120-minute appointment, combining multiple choice, multiple response, drag-and-drop, hot area, yes/no series, and full case studies.
You need a score of 700 or greater on Microsoft's 100-to-1000 scale. See our passing score guide for a full explanation of how scoring works.
No. Microsoft Certified: Cybersecurity Architect Expert also requires an active associate-level prerequisite - SC-200, SC-300, or AZ-500 - in addition to passing SC-100.
The July 28, 2026 refresh added agent identity design with Microsoft Entra Agent ID, secure AI adoption strategy, AI workload data security, Microsoft Purview Audit for centralized logging, and Security Exposure Management attack path analysis.
Start with Domain 1 to build your Zero Trust and governance foundation, then spend the most time on Domains 2 and 3, since together they carry 50 to 60 percent of the exam weight.
The exam fee is $165 USD in the United States before taxes, before any Microsoft Certified Trainer or Microsoft Partner Network discount. See our cost breakdown for the full picture including prerequisites.