Microsoft Certified: Security Operations Analyst Associate (SC-200)

Security teams working across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Purview, and Security Copilot often lose time to noisy alerts, inconsistent triage, and gaps in SOC data collection. This SC-200 training gives SOC teams a shared, repeatable approach, from onboarding endpoints and tuning alerts to writing KQL detections, running playbooks, and hunting threats mapped to MITRE ATT&CK.

Role fit: Built for Security Analysts and Security Engineers with 1–3 years of experience. Team Leads can use it to standardize how analysts investigate incidents and escalate them.

Time investment: About 16.4 hours across 19 skills of roughly 45–60 minutes each. Most learners can finish it in a few weeks alongside normal SOC duties.

Risk and compliance: The course covers SOC data collection and optimization, Microsoft Purview insider risk policies and alerts, and practical alert-handling decisions, including when to submit false positives to Microsoft and when to suppress true positives through alert tuning.

Change-management notes:

• Learners need an appropriate Microsoft 365 E5-level or A5 tenant to follow along.
• Security Copilot lessons cover provisioning and incident investigation workflows, including data-capture settings and high-usage behavior.
• Plan for a test tenant before analysts change production policies.

SC-200 Practice Exams help IT Directors confirm their team is ready before scheduling exam attempts.

IT teams complete this training to move from reacting to alerts toward a coordinated, repeatable security operations practice across Microsoft Defender XDR and Microsoft Sentinel. The course works through situations your SOC already faces. Learners onboard endpoints through Intune instead of one-off scripts. They submit false positives to Microsoft and tune out noisy true positives. They open live response sessions on a compromised device. They trace a data-exfiltration email through eDiscovery content search.

• Less alert fatigue, faster triage: Analysts learn to separate false positives and false negatives from real threats. They use alert tuning and Automated Investigation & Response so your team spends its time on incidents that matter.
• Faster, consistent escalation: Learners work through Sentinel incident workflows so high-severity incidents are triaged, assigned, and escalated the same way across the SOC.
• Threat-informed defense: Your team reviews threat intelligence and threat analytics, including MITRE ATT&CK technique mapping in Microsoft Defender. They then use that context to understand attacker behavior and confirm the right security controls are in place.
• Audit-ready evidence and controlled AI usage: Analysts configure custom data collection, such as file modifications in sensitive folders, to support compliance requirements. They also learn how Security Copilot can assist investigations while keeping usage visible and controlled.

The result for IT Directors is a SOC team that investigates with shared methods and escalates the same way every time, reducing reliance on outside responders.

After completing this course, IT teams will share a common baseline for running security operations across Microsoft Defender XDR, Microsoft Sentinel, and Security Copilot.

Knowledge

• Defender XDR licensing and permission prerequisites, plus how the Defender portal is organized across endpoint, Office 365, identity, and cloud apps
• How Automated Investigation and Response (AIR) works, including the Action Center, action history, and undoing actions
• The difference between false positives, false negatives, and true positives, and when to submit items to Microsoft versus use alert tuning
• How SOC optimization recommendations in Microsoft Sentinel connect to Content Hub, data connectors, and analytics-rule recommendations
• How Microsoft Defender threat analytics maps attacker activity to MITRE ATT&CK techniques, such as reconnaissance and PowerShell execution, to support remediation planning
• How Security Copilot sessions, prompts, promptbooks, roles, and Security Compute Unit (SCU) capacity are managed

Ability

• Onboard endpoints to Defender for Endpoint with a local script for small groups or with Intune at enterprise scale
• Configure custom data collection, such as PowerShell script execution on admin workstations, and use Exposure Management initiatives like business email compromise to track risk
• Write KQL-based custom detections and manage Sentinel analytics and anomaly rules, including moving rules between flighting and production
• Investigate device incidents with live response, investigation packages, and troubleshooting mode, and use eDiscovery content search for Microsoft 365 activity
• Build automation rules and playbooks that alert the SOC channel when a high-severity incident is created
• Run and customize Security Copilot promptbooks to accelerate incident investigation