Microsoft Cybersecurity Architect (SC-100) Exam Prep

What's inside

1. Level 1: SC-100 Orientation and the Scenario-Question MethodFree
   [Design solutions that align with security best practices and priorities] Covers how the course is built and how to answer architect-level scenario questions: the skills measured as of October 21, 2026 come from Microsoft's study guide, which is not reproduced here and is free on Microsoft Learn; check the vendor's exam page for exam length, price and languages; this course is independent of Microsoft, is not endorsed by it, and does not promise a pass.
2. Level 2: Security Strategy for Business Resiliency GoalsFree
   [Design solutions that align with security best practices and priorities] Teaches how to design a security strategy that supports business resiliency goals by identifying business-critical assets and ranking the threats to them, following Microsoft Security Best Practices.
3. Level 3: BCDR and Secure Backup for Hybrid and Multicloud
   [Design solutions that align with security best practices and priorities] Covers designing business continuity and disaster recovery (BCDR) solutions, including secure backup and restore across hybrid and multicloud environments.
4. Level 4: Ransomware Mitigation Priorities and Security Updates
   [Design solutions that align with security best practices and priorities] Teaches how to design ransomware mitigation that puts BCDR and privileged access first, and how to evaluate solutions for security updates.
5. Level 5: MCRA and MCSB: Capabilities and Controls
   [Design solutions that align with security best practices and priorities] Explains how the Microsoft Cybersecurity Reference Architectures (MCRA) and the Microsoft Cloud Security Benchmark (MCSB) guide the design of solutions that follow best practices for cybersecurity capabilities and controls.
6. Level 6: Insider, External and Supply Chain Attacks
   [Design solutions that align with security best practices and priorities] Covers designing solutions that follow MCRA and MCSB best practices for protecting against insider, external and supply chain attacks.
7. Level 7: AI Solutions Aligned to MCSB and Secure AI Adoption
   [Design solutions that align with security best practices and priorities] Teaches how to design AI solutions that follow the Microsoft Cloud Security Benchmark, and how to design a strategy for secure AI adoption under the Cloud Adoption Framework objective.
8. Level 8: Zero Trust Adoption Framework
   [Design solutions that align with security best practices and priorities] Covers designing solutions that follow the Zero Trust adoption framework and its principles: verify explicitly, use least privilege access and assume breach.
9. Level 9: CAF and WAF Security and Governance Strategy
   [Design solutions that align with security best practices and priorities] Teaches how to design a new security and governance strategy, or evaluate an existing one, and how to recommend solutions, based on the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework (WAF) security pillar.
10. Level 10: Implementing and Governing Security with Azure Landing Zones
    [Design solutions that align with security best practices and priorities] Covers designing solutions that implement and govern security by using Azure landing zones.
11. Level 11: DevSecOps Process Aligned to CAF
    [Design solutions that align with security best practices and priorities] Teaches how to design a DevSecOps process that follows best practices in the Microsoft Cloud Adoption Framework for Azure (CAF).
12. Level 12: Detection and Response with XDR and SIEM
    [Design security operations, identity, and compliance capabilities] Covers designing a detection and response solution that combines extended detection and response (XDR) and security information and event management (SIEM) with Microsoft Defender XDR and Microsoft Sentinel.
13. Level 13: Centralized Logging, Purview Audit and Multicloud Monitoring
    [Design security operations, identity, and compliance capabilities] Teaches how to design centralized logging and auditing, including Microsoft Purview Audit, and how to design monitoring that supports hybrid and multicloud environments.
14. Level 14: SOAR and Security Workflows
    [Design security operations, identity, and compliance capabilities] Covers designing security orchestration, automation, and response (SOAR) with Microsoft Sentinel and Microsoft Defender XDR, and designing and evaluating workflows for incident response, threat hunting and incident management.
15. Level 15: Threat Detection Coverage with MITRE ATT&CK
    [Design security operations, identity, and compliance capabilities] Teaches how to design and evaluate threat detection coverage by using the MITRE ATT&CK matrices for Enterprise, Mobile and industrial control systems (ICS).
16. Level 16: Microsoft Entra ID Design and External Identities
    [Design security operations, identity, and compliance capabilities] Covers designing a Microsoft Entra ID solution for hybrid and multicloud environments, and designing for external identities, including business-to-business (B2B) and decentralized identity.
17. Level 17: Agent Identities and Access to Cloud Resources
    [Design security operations, identity, and compliance capabilities] Teaches how to design for agent identities with Microsoft Entra Agent ID and Conditional Access policies, and how to design access to SaaS, PaaS, IaaS, hybrid/on-premises and multicloud resources with identity, networking and application controls.
18. Level 18: Modern Authentication, Authorization and Conditional Access
    [Design security operations, identity, and compliance capabilities] Covers designing a modern authentication and authorization strategy, including Conditional Access, continuous access evaluation, risk scoring and protected actions, and checking that Conditional Access policies fit a Zero Trust strategy.
19. Level 19: Managing Secrets, Keys and Certificates
    [Design security operations, identity, and compliance capabilities] Teaches how to design a solution to manage secrets, keys and certificates under the identity and access management objective.
20. Level 20: Hardening and Evaluating AD DS
    [Design security operations, identity, and compliance capabilities] Covers specifying requirements to harden Active Directory Domain Services (AD DS), and evaluating the security and governance of AD DS, including resilience to common attacks.
21. Level 21: Governing Entra ID: PIM, Entitlements, Access Reviews
    [Design security operations, identity, and compliance capabilities] Serves 'Design solutions for securing privileged access'. You evaluate the security and governance of Microsoft Entra ID through Microsoft Entra Privileged Identity Management (PIM), entitlement management and access reviews, and you evaluate an access review management solution against a case study's governance requirements.
22. Level 22: AD DS Resilience, Tenant Admin, CIEM and PAWs
    [Design security operations, identity, and compliance capabilities] Serves 'Design solutions for securing privileged access'. You evaluate AD DS security and governance for resilience to common attacks, then design secure administration of cloud tenants (SaaS and multicloud), cloud infrastructure entitlement management and secure workstations for privileged access, including remote access.
23. Level 23: Compliance Requirements to Controls with Purview
    [Design security operations, identity, and compliance capabilities] Serves 'Design solutions for regulatory compliance'. You translate compliance requirements into security controls and design a solution that addresses those requirements by using Microsoft Purview.
24. Level 24: Azure Policy and Defender for Cloud Compliance
    [Design security operations, identity, and compliance capabilities] Serves 'Design solutions for regulatory compliance'. You design Azure Policy solutions for security and compliance requirements, then evaluate and validate alignment with regulatory standards and benchmarks by using Microsoft Defender for Cloud.
25. Level 25: Posture with Defender for Cloud, MCSB and Secure Score
    [Design security solutions for infrastructure] Serves 'Design solutions for security posture management in hybrid and multicloud environments'. You evaluate security posture by using Microsoft Defender for Cloud, including the Microsoft Cloud Security Benchmark (MCSB), and by using Microsoft Secure Score.
26. Level 26: Hybrid and Multicloud Posture with Azure Arc
    [Design security solutions for infrastructure] Serves 'Design solutions for security posture management in hybrid and multicloud environments'. You design integrated security posture management with Microsoft Defender for Cloud across hybrid and multicloud environments, and design hybrid and multicloud integration by using Azure Arc.
27. Level 27: Selecting Cloud Workload Protection Plans
    [Design security solutions for infrastructure] Serves 'Design solutions for security posture management in hybrid and multicloud environments'. You select cloud workload protection solutions in Microsoft Defender for Cloud by matching each Defender plan to the workloads and threats in a case study.
28. Level 28: Microsoft Defender EASM
    [Design security solutions for infrastructure] Serves 'Design solutions for security posture management in hybrid and multicloud environments'. You design a solution for Microsoft Defender External Attack Surface Management (Defender EASM) to discover and monitor internet-facing assets that an organization owns but may not know about.
29. Level 29: Microsoft Security Exposure Management
    [Design security solutions for infrastructure] Serves 'Design solutions for security posture management in hybrid and multicloud environments'. You specify requirements and priorities for a posture management process that uses Microsoft Security Exposure Management attack paths, attack surface reduction, security insights and initiatives.
30. Level 30: Server and Client Endpoint Requirements
    [Design security solutions for infrastructure] Serves 'Specify requirements for securing server and client endpoints'. You specify security requirements for servers across multiple platforms and operating systems, and for mobile devices and clients, covering endpoint protection, hardening and configuration.
31. Level 31: Endpoint Security Baselines and Windows LAPS
    [Design security solutions for infrastructure] Serves 'Specify requirements for securing server and client endpoints'. You specify security baselines for server and client endpoints and evaluate a Windows Local Administrator Password Solution (Windows LAPS) solution.
32. Level 32: IoT, Embedded and OT/ICS with Defender for IoT
    [Design security solutions for infrastructure] Serves 'Specify requirements for securing server and client endpoints'. You specify security requirements for IoT devices and embedded systems, and evaluate solutions for securing operational technology (OT) and industrial control systems (ICS) by using Microsoft Defender for IoT.
33. Level 33: SaaS, PaaS, IaaS Baselines and Azure AI Services
    [Design security solutions for infrastructure] Serves 'Specify requirements for securing SaaS, PaaS, and IaaS services'. You specify security baselines for SaaS, PaaS and IaaS services according to the shared responsibility split, and evaluate solutions that include Azure AI services security.
34. Level 34: Securing IoT Workloads and Web Workloads
    [Design security solutions for infrastructure] Serves 'Specify requirements for securing SaaS, PaaS, and IaaS services'. You specify security requirements for IoT workloads in the cloud and for web workloads hosted on Azure services.
35. Level 35: Containers and Container Orchestration Security
    [Design security solutions for infrastructure] Serves 'Specify requirements for securing SaaS, PaaS, and IaaS services'. You specify security requirements for containers, including image and registry security, and for container orchestration, including cluster access, network policy and runtime protection.
36. Level 36: Network Design and Microsoft Entra Private Access
    [Design security solutions for infrastructure] Serves 'Evaluate solutions for network security and Security Service Edge (SSE)'. You evaluate network designs against security requirements and best practices, and evaluate solutions that use Microsoft Entra Private Access for identity-centric access to private applications.
37. Level 37: Microsoft Entra Internet Access: SWG and M365
    [Design security solutions for infrastructure] Serves 'Evaluate solutions for network security and Security Service Edge (SSE)'. You evaluate solutions that use Microsoft Entra Internet Access as a secure web gateway, and Microsoft Entra Internet Access for Microsoft Services, including cross-tenant configurations.
38. Level 38: M365 Posture, Defender for Office 365 and MDCA
    [Design security solutions for applications and data] Serves 'Evaluate solutions for securing Microsoft 365'. You evaluate security posture for productivity and collaboration workloads by using metrics, including Microsoft Secure Score, and evaluate solutions that include Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps.
39. Level 39: Device Management with Microsoft Intune
    [Design security solutions for applications and data] Serves 'Evaluate solutions for securing Microsoft 365'. You evaluate device management solutions that include Microsoft Intune, covering compliance policies, configuration, app protection and integration with Conditional Access.
40. Level 40: Purview for M365 Data and Microsoft 365 Copilot
    [Design security solutions for applications and data] Serves 'Evaluate solutions for securing Microsoft 365'. You evaluate solutions for securing data in Microsoft 365 by using Microsoft Purview, and evaluate data security and compliance controls in Microsoft 365 Copilot.
41. Level 41: App Portfolio Posture and Threat Modeling
    [Design security solutions for applications and data] Covers the 'Design solutions for securing applications' bullets 'Evaluate the security posture of existing application portfolios' and 'Evaluate threats to business-critical applications by using threat modeling', using architecture case studies in which the learner ranks applications by business criticality and works out the threats to each.
42. Level 42: Full Lifecycle App Security and Secure Dev Standards
    [Design security solutions for applications and data] Covers the 'Design solutions for securing applications' bullets 'Design and implement a full lifecycle strategy for application security' and 'Design and implement standards and practices for securing the application development process', building on the CAF DevSecOps process from Level 11 without repeating it.
43. Level 43: Mapping App Requirements and Workload Identities
    [Design security solutions for applications and data] Covers the 'Design solutions for securing applications' bullets 'Map technologies to application security requirements' and 'Design a solution for workload identities to authenticate and access Azure resources', with the focus on removing stored credentials from application designs.
44. Level 44: API Management Security and Azure WAF
    [Design security solutions for applications and data] Covers the 'Design solutions for securing applications' bullets 'Design a solution for API management and security' and 'Design solutions that secure applications by using Azure Web Application Firewall (WAF)', and ends the application security part of the syllabus.
45. Level 45: Data Discovery, Classification and Threat Priorities
    [Design security solutions for applications and data] Covers the 'Design solutions for securing an organization's data' bullets 'Evaluate solutions for data discovery and classification' and 'Specify priorities for mitigating threats to data', across estates that extend beyond the Microsoft 365 data covered earlier.
46. Level 46: Encryption, Key Vault and Securing AI Workload Data
    [Design security solutions for applications and data] Covers the 'Design solutions for securing an organization's data' bullets 'Evaluate solutions for encryption of data at rest and in transit, including Azure Key Vault and infrastructure encryption' and 'Design security for data used in AI workloads'.
47. Level 47: Securing Azure Data Services with Defender
    [Design security solutions for applications and data] Covers the last 'Design solutions for securing an organization's data' bullets: security solutions for data in Azure SQL, Azure Synapse Analytics, Azure Cosmos DB and Azure Storage, and a solution that includes Microsoft Defender for Storage and Microsoft Defender for Databases.
48. Level 48: Timed Mock Exam: SC-100 (50 Questions, 120 Minutes) Timed mock
    [All sections] A timed mock exam of 50 original scenario questions in 120 minutes, weighted by the study guide's domain weightings, that tests whether the learner can choose the best architecture answer across all four SC-100 skill areas; the pass mark is 70%, and every distractor is explained after submission.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →