LEARNING PATH

Security operations analyst path

SOC analysts and incident responders working with Microsoft Defender and Microsoft Sentinel.

Goal: Security Operations Analyst Associate (Associate). 1 to 2 exams, about 4–14 weeks with our study plans.

Where do I start? Try another goal

The path, step by step

  1. Optional start: skip if you know the basics

    SC-900: Microsoft Security, Compliance, and Identity Fundamentals

    The concepts and product names the SOC exam takes for granted. · leads to Security, Compliance, and Identity Fundamentals · study plan: 3 weeks or 6 weeks

    Cover of SC-900: Microsoft Security, Compliance, and Identity Fundamentals
  2. Required

    SC-200: Microsoft Security Operations Analyst

    Defender XDR, Microsoft Sentinel, incident response and KQL threat hunting. · leads to Security Operations Analyst Associate · study plan: 4 weeks or 8 weeks

    Cover of SC-200: Microsoft Security Operations Analyst

    Ultra Transcenders SC-200: Microsoft Security Operations Analyst

    Know which Defender, Sentinel or KQL move fits the incident in front of you, and why.

    Coming November 2026Study notes

Microsoft requires: SC-200. Everything else is our advice on the order that makes each exam easier. The time is a rough guide: the shorter plans suit people who already work with the technology, the longer ones people who are new to it. Certification details on Microsoft Learn.

Hear when a book on this path is free

An email when an Ultra Transcenders book is free on Kindle, and when a new book comes out. Sign up and you also get the free exam-day checklist: booking, ID, the online check-in and what to expect on the day.

We'll email you to confirm first. A few emails a month at most, no spam, unsubscribe any time. The list is run by Kit; see the privacy notice.