× × × × ×
× × × × ×
– Defend against cyberthreats with Microsoft's security operations platform
Course Description
SC-200T00A: Microsoft Security Operations Analyst Course Curriculum
SEO Metadata
- Title tag (≤60 chars): Microsoft Security Operations Analyst Course (SC-200)
- Meta description (≤155 chars): Learn to detect, investigate and respond to threats with Microsoft Sentinel and Defender XDR. Prepare for the SC-200 exam with hands-on training.
- Primary keyword: SC-200 Microsoft Security Operations Analyst course
- Secondary keywords: SC-200 exam prep, Microsoft Sentinel training, Microsoft Defender XDR, KQL for security, threat hunting course, SOC analyst certification, Microsoft Defender for Cloud
- Suggested URL slug:
/sc-200-microsoft-security-operations-analyst-course
Course Overview (H1: Microsoft Security Operations Analyst Course (SC-200))
Learn to defend against cyberthreats with Microsoft’s security operations platform. You’ll investigate, respond to and hunt for threats using Microsoft Sentinel, Microsoft Defender XDR and Microsoft Defender for Cloud, and learn to reduce organizational risk by rapidly remediating active attacks.
Course Curriculum
-
SOC role
-
threat landscape
-
Microsoft security platform overview
-
MITRE ATT&CK
-
Kusto Query Language basics
-
log analysis
-
query building
-
Incidents and alerts
-
Defender for Endpoint
-
Office 365
-
dentity and Cloud Apps
-
Cloud workload protection
-
security alerts
-
posture and recommendations
-
Workspace setup
-
data connectors
-
analytics rules
-
watchlists
-
Incident triage
-
investigation
-
entity behavior analytics
-
threat intelligence
-
Hunting queries
-
bookmarks
-
livestream
-
notebooks
-
Playbooks
-
Logic Apps
-
automation rules
Course Eligibility
Audience Profile
The Microsoft Security Operations Analyst collaborates with organizational stakeholders to secure
information technology systems for the organization. Their goal is to reduce organizational risk by
rapidly remediating active attacks in the environment, advise on improvements to threat protection
practices, and referring violations of organizational policies to appropriate stakeholders.
Responsibilities include threat management, monitoring, and response by using a variety of security
solutions across their environment. The role primarily investigates, responds to, and hunts for threats
Trainer Preparation Guide: SC-200T00A: Security Operations Analyst April 2026
Page 2
using Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Defender XDR, and third-party
security products. Since the Security Operations Analyst consumes the operational output of these
tools, they are also a critical stakeholder in the configuration and deployment of these technologies.
Audience Prerequisites
• Basic understanding of Microsoft 365
• Fundamental understanding of Microsoft security, compliance, and identity products
• Intermediate understanding of Microsoft Windows
• Familiarity with Azure services, specifically Azure SQL Database and Azure Storage
• Familiarity with Azure virtual machines and virtual networking
• Basic understanding of scripting concepts.
Reviews
