SC-100: How I Passed the Microsoft Cybersecurity Architect Exam
The SC-100 is Microsoft's most senior security certification — a design-led exam that expects you to think like an architect, not a button-clicker. Here is the study path I wish I had when I sat (and passed) it, written for engineers stepping up from SC-200, AZ-500, or AWS/GCP security backgrounds.
What the SC-100 actually tests
The SC-100 is not a product exam. It tests your ability to design a security strategy across identity, infrastructure, applications, data, and operations — and to defend that strategy against business constraints. Expect 40–60 questions, a couple of case studies, and around 120 minutes. The passing score is 700/1000.
Prerequisite knowledge is heavy. Microsoft expects you to already have one of the associate-level certs (SC-200, SC-300, AZ-500, or MS-500) before attempting it. If you don't, the case studies will feel like a foreign language.
The four exam domains
Design solutions that align with security best practices and priorities
20–25%- Translate the Microsoft Cybersecurity Reference Architecture (MCRA) into customer-specific recommendations.
- Map business priorities to Zero Trust pillars (identity, endpoints, apps, data, infrastructure, network).
- Use the Cloud Adoption Framework (CAF) Secure methodology to scope strategy work.
Design security operations, identity, and compliance capabilities
20–25%- Architect Microsoft Sentinel + Defender XDR for unified SecOps with clear playbook ownership.
- Design Entra ID conditional access, PIM, and workload identities for hybrid + multi-cloud.
- Plan Microsoft Purview controls for data classification, DLP, and insider risk.
Design security for infrastructure
20–25%- Apply Defender for Cloud across Azure, AWS, and GCP — multi-cloud security posture is on the exam.
- Design segmentation, private endpoints, and key/secret management (Key Vault, HSM, Managed HSM).
- Plan for OT/IoT, endpoint, and server workloads with Defender for Endpoint and Defender for Servers.
Design security for applications and data
20–25%- Embed security in SDLC: threat modelling (STRIDE), DevSecOps pipelines, GitHub Advanced Security.
- Design API and microservice security with Azure API Management, WAF, and managed identities.
- Protect data with encryption choices (CMK vs PMK), tokenisation, and Purview Information Protection.
Resources I actually used
- Microsoft Learn — SC-100 study path
- Microsoft Cybersecurity Reference Architectures (MCRA)
- Cloud Adoption Framework — Secure
- Zero Trust deployment plans
- John Savill's SC-100 study cram (YouTube)
I deliberately kept this list short. The MCRA poster and the CAF Secure methodology alone cover ~60% of the design questions you'll see — if you can explain both end to end on a whiteboard, you are most of the way there.
Field-tested tips
- Read every question twice — SC-100 is a design exam, so the right answer is rarely the most technical one. It's the one that matches the stated business priority.
- Anchor every answer to Zero Trust. If a choice violates 'verify explicitly', 'least privilege', or 'assume breach', it's wrong.
- Know which Microsoft product owns which capability cold (Defender XDR vs Defender for Cloud vs Sentinel vs Purview vs Entra). Distractors love to swap them.
- Practice case-study pacing. Each case study eats ~25 minutes; budget the rest for standalone questions.
- Don't memorise — recognise patterns. Hub-and-spoke, landing zones, Sentinel data connectors, and PIM workflows show up over and over.
A note from me
The SC-100 changed how I think about security architecture. It pushed me to stop designing for technology and start designing for outcomes — risk reduction, regulatory posture, and operational reality. If you're studying right now and want to compare notes, I'd genuinely love to hear from you.
About the author →