Certification guide
SC-100Microsoft Cybersecurity Architect Expert: the honest guide
SC-100 is Microsoft's security architecture exam. It does not ask you to configure anything: every question describes an organization, its constraints and its existing estate, and asks which design best meets them. Zero Trust is the frame the whole exam is written in.
It is an expert certification with a gate. Microsoft awards Cybersecurity Architect Expert only to candidates who already hold Azure Security Engineer Associate, Identity and Access Administrator Associate, or Security Operations Analyst Associate, so the prerequisite decision comes before the study plan.
Who Cybersecurity Architect is for
A good fit if
- You hold SC-200, SC-300 or the Azure Security Engineer certification and your work has moved from implementing to recommending.
- You advise on security strategy across an estate rather than owning one product inside it.
- You work in consulting or pre-sales and have to defend a design to somebody who will pay for it.
- Your organization needs an expert-level Microsoft security credential for a partner competency.
Probably not, if
- You hold none of the three qualifying associate certifications. You may sit the exam, and the expert certification will not be awarded until one of them is held.
- You want to learn Microsoft's security products. The associate exams teach those; this one assumes them and asks what to do with them.
- You prefer questions with a single provably correct answer. Several designs work in most SC-100 items and you are choosing the best fit against stated constraints.
Is Cybersecurity Architect worth it?
For a security professional whose job has become advisory, it is one of the few certifications that tests the actual work. Reading a scenario for its regulatory obligation, its existing investment and its appetite for change, and then recommending accordingly, is the job rather than a proxy for it.
It is also cheap to prepare for by expert-exam standards. There is no lab, because there is nothing to build, so the whole budget is the $165 exam and the prerequisite behind it.
It is the wrong exam if you are still building. An architect credential held by somebody who has not implemented the controls it recommends is thin, and Microsoft's prerequisite structure exists to prevent exactly that.
What the exam actually asks you to do
Multiple choice and multiple response, plus drag-and-drop ordering, hot area items where you click a region of a screenshot, and case studies that hold one scenario across several linked questions.
Item formats
- Multiple choice
- Multiple response
- Drag and drop
- Hot area
- Case study
The highlighted formats are the ones you cannot answer from memory alone. Microsoft Learn, exam duration and question types ↗
Domain breakdown and official weightings
From the official Microsoft Learn study guides. Design security operations, identity, and compliance capabilities is the heaviest domain at 27 percent, followed by Design security solutions for infrastructure at 27 percent.
- Design solutions that align with security best practices and priorities23%
- Design security operations, identity, and compliance capabilities27%
- Design security solutions for infrastructure27%
- Design security solutions for applications and data23%
Study plans by experience level
Holding SC-200 or SC-300
5 to 6 weeksat 6 hours
- 1Week 1: read Microsoft's Zero Trust guidance end to end. The exam's recommended answers are derived from it, and this is the cheapest alignment available.
- 2Weeks 2 to 3: the two design domains outside your specialism. If you came from SC-300, that is security operations and infrastructure; if from SC-200, identity and compliance.
- 3Week 4: the Cloud Adoption Framework's security guidance and the Well-Architected security pillar, which is where the governance and posture questions come from.
- 4Weeks 5 to 6: the free practice assessment twice, a week apart, reading every explanation rather than only the score.
Azure security engineer moving to architecture
8 to 10 weeksat 6 hours
- 1Weeks 1 to 2: the shift in question type. Practice reading scenarios for constraints, because the exam rewards the design that fits, not the one that is strongest in isolation.
- 2Weeks 3 to 5: the four skill areas in order, all weighted between 23 and 27 percent, so none of them can be skipped.
- 3Weeks 6 to 7: compliance and governance, usually the thinnest area for an engineer: regulatory frameworks, data residency and what a control owner actually needs from you.
- 4Weeks 8 to 10: the practice assessment, plus one written exercise per domain where you design for a fictional organization and justify each choice in two sentences.
Security architect from another platform
10 to 12 weeksat 8 hours
- 1Weeks 1 to 3: Microsoft's product set, honestly. Defender for Cloud, Sentinel, Entra ID, Purview and Intune, at the level of what each one is for and where its boundaries are.
- 2Weeks 4 to 6: Microsoft's Zero Trust model specifically, because the exam's frame is Microsoft's and generic architecture experience answers differently.
- 3Weeks 7 to 9: hybrid and multicloud scenarios, which is where an experienced architect gains the most from this curriculum.
- 4Weeks 10 to 12: the prerequisite associate exam if you have not taken one yet, then the practice assessment.
Common mistakes
- Sitting it without a qualifying associate
- Cybersecurity Architect Expert requires Azure Security Engineer Associate, Identity and Access Administrator Associate or Security Operations Analyst Associate. Passing SC-100 alone leaves you with an exam result and no certification, and the AZ-500 route closes when Microsoft retires that exam on 31 August 2026.
- Answering as an engineer
- The most common failure on this exam is choosing the technically strongest control rather than the one that fits the organization described. If the scenario names a budget constraint, an existing license estate or a regulatory obligation, those are the marking criteria and not scene-setting.
- Skipping Microsoft's own architecture guidance
- The Zero Trust deployment material, the Cloud Adoption Framework and the Well-Architected security pillar are free, and the exam's preferred answers align with them. Candidates who study products instead of guidance find several answers defensible and no way to choose.
- Assuming one weak domain can be carried
- The four skill areas sit between 23 and 27 percent, which is the flattest weighting in the Microsoft catalog. There is no small domain to sacrifice, and a candidate strong in three areas and absent in the fourth is close to the pass mark by arithmetic alone.
- Preparing with an outdated study guide
- The English version of this certification was updated on 28 July 2026. Material written before that describes a different skills outline, and on a design exam the changes tend to be about emphasis, which is exactly what a study guide is supposed to get right.
What comes after passing
The certification is valid for one year and renews free through an unproctored assessment on Microsoft Learn, opening six months before expiry.
You are carrying two renewal dates, because the qualifying associate expires annually as well.
For most people this is a terminal certification in the Microsoft security track rather than a step toward another. What follows is usually breadth: CISSP for the vendor-neutral governance vocabulary, or a cloud architecture certification on a second platform.
The durable skill is constraint-first reasoning. Reading for the obligation and the existing investment before reaching for a control is what separates an architecture recommendation from a product preference, and it outlives any single vendor's exam.
Costs across the full renewal cycle are on the Cybersecurity Architect cost page.
Frequently asked questions
Do I need another certification before SC-100?
To be awarded Cybersecurity Architect Expert, yes. Microsoft requires at least one of Azure Security Engineer Associate, Identity and Access Administrator Associate, or Security Operations Analyst Associate. You may sit SC-100 first, but the certification is only granted once a qualifying associate is held.
Which prerequisite should I take now that AZ-500 is retiring?
SC-300 or SC-200. Microsoft retires the AZ-500 exam and the Azure Security Engineer Associate certification on 31 August 2026, which leaves Identity and Access Administrator and Security Operations Analyst as the routes that remain earnable, and both are covered in this catalog.
Is there a lab for SC-100?
No, and that is unusual for an expert exam. Every question is a design decision rather than a configuration task, so preparation is reading, reasoning and practice questions. It makes SC-100 one of the cheapest expert certifications to prepare for.
Why do several answers look correct?
Because they are. The exam presents workable designs and asks for the best fit against the constraints in the scenario, which is how architecture decisions actually get made. The discipline that moves marks is reading the scenario for its obligations and limits before looking at the options.
Keep reading
- Cybersecurity Architect practice questions
Free sample questions with the full explanation on every answer.
- Free Cybersecurity Architect practice test
10 original questions, playable now. No account, no card.
- Cybersecurity Architect exam format
How many questions, how long, what the items look like, and how long it stays valid.
- Cybersecurity Architect passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is Cybersecurity Architect?
An honest difficulty read from the format, the clock and the weights.
- What Cybersecurity Architect costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice Cybersecurity Architect for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free Cybersecurity Architect questions