Microsoft's skills measured for SC-200 as of October 21, 2026, mapped to the chapters of Ultra Transcenders SC-200: Microsoft Security Operations Analyst.
| Objective | Chapters |
|---|---|
| Manage a security operations environment (40–45%) | |
| Configure automation for Microsoft Defender XDR and Microsoft Sentinel | 1. Microsoft Defender XDR: portal, alerts and incidents; 2. Configuring Microsoft Defender for Endpoint; 3. Automation: Microsoft Sentinel automation rules and playbooks; 8. Email and data threats: Defender for Office 365 and Microsoft Purview alerts; 11. Threat hunting with KQL and Advanced hunting |
| Configure the Microsoft Sentinel SIEM and platform | 1. Microsoft Defender XDR: portal, alerts and incidents; 5. Microsoft Sentinel: workspace, roles, retention, workbooks and optimisation |
| Ingest data into the Microsoft Sentinel SIEM and platform | 6. Ingesting data into Microsoft Sentinel |
| Configure detections | 7. Detections: custom detection rules and Sentinel analytics |
| Respond to security incidents (35–40%) | |
| Respond to alerts and incidents in Microsoft Defender XDR | 1. Microsoft Defender XDR: portal, alerts and incidents; 8. Email and data threats: Defender for Office 365 and Microsoft Purview alerts; 9. Cloud, app and identity threats; 10. Investigating incidents across Microsoft 365 and with Security Copilot |
| Respond to alerts and incidents in Microsoft Defender for Endpoint | 4. Responding on devices with Defender for Endpoint |
| Investigate Microsoft 365 activities to identify threats | 10. Investigating incidents across Microsoft 365 and with Security Copilot |
| Perform threat hunting (20–25%) | |
| Detect threats by using Microsoft Defender XDR | 11. Threat hunting with KQL and Advanced hunting |
| Detect threats by using the Microsoft Sentinel platform | 12. Hunting on the Microsoft Sentinel platform |
The full list of tasks under each objective is in the official SC-200 study guide and practice assessment. The book is organised by technology, so one chapter often serves several objectives.