Microsoft Certified: Security Operations Analyst Associate
Prepare for exam SC-200 by learning to detect, investigate, and respond to threats and hunt with KQL in Microsoft Defender XDR and Microsoft Sentinel.
$2,395.00
Prepare for exam SC-200 by learning to detect, investigate, and respond to threats and hunt with KQL in Microsoft Defender XDR and Microsoft Sentinel.
$2,395.00
Prepare for exam SC-200 by learning to detect, investigate, and respond to threats and hunt with KQL in Microsoft Defender XDR and Microsoft Sentinel.
This course covers the three skill areas Microsoft measures on exam SC-200: managing a security operations environment, responding to incidents, and threat hunting. You configure Microsoft Defender XDR and Microsoft Sentinel, build detections and automation, work real incident scenarios, and write KQL hunting queries. Each module ends with a lab in a trial environment.
This course is for security operations center analysts, incident responders, and IT security staff who triage alerts, investigate incidents, and hunt for threats using Microsoft security tools.
Familiarity with Microsoft 365 and Azure cloud services
General knowledge of Windows and Linux operating systems
Basic awareness of Microsoft security, compliance, and identity tools
A modern web browser for the Microsoft Defender portal and Microsoft Sentinel
An Azure subscription for Microsoft Sentinel labs; Sentinel data ingestion is paid and billed to the subscription after any free trial period
A time-limited Microsoft 365 E5 or Defender trial tenant, or paid Microsoft 365 E5 or Defender licensing, for Defender XDR labs
Exam SC-200: Microsoft Security Operations Analyst (Microsoft Certified: Security Operations Analyst Associate) (SC-200). This course prepares you for exam SC-200, and one exam attempt voucher is included. KQL fluency and hands-on time in Defender and Sentinel are needed beyond the course hours, so most learners need additional self-study and lab time plus the free Microsoft practice assessment. Passing is not guaranteed. Microsoft is updating the English exam on October 21, 2026 with a minor change to Sentinel data ingestion.
Security operations roles, Microsoft Defender XDR portal, Defender for Endpoint onboarding, Attack surface reduction settings.
Sentinel workspace design, Roles and permissions, Data retention, Data connectors, Sentinel data lake.
Scheduled analytics rules, Custom detections, Automation rules, Playbooks with Logic Apps.
Incident queue and triage, Alert investigation, Remediation actions, Security Copilot in incident response.
Device timeline, Device isolation and response actions, Audit log investigation, Identity activity.
KQL fundamentals, Advanced hunting, Hunting in Sentinel data lake, SC-200 practice assessment review.
One-on-one or small-group coaching, scheduled with your coach.
On-demand asynchronous training with online support, plus 2 hours of coaching.
Live online or in-person sessions are available for an additional fee. Email admissions@wecancodeit.org for details.
Microsoft Certified: Security Operations Analyst Associate
Reimbursement applies only to the credential approved in your TechCred application, so use the exact credential name shown on this page.
Ohio's TechCred program may reimburse eligible Ohio employers up to $1,000 per person, per credential, and up to $30,000 per application, for eligible costs such as tuition and certification costs.
TechCred's maximum is $1,000 per person, per credential, toward this price.
The current application period opens at 9:00 a.m. on October 1, 2026 and closes at 3:00 p.m. on October 30, 2026.
Training must start no earlier than the first day of the application period and be completed within 12 months of the award date.
For each learner, We Can Code IT provides an itemized per-person invoice that shows the exact credential name, and a certificate that shows the learner's name, the credential and the date earned (or the vendor's exam record for certifications). We can also send a written quote to include with your TechCred application.
Pricing is the same for all customers, whether or not you use TechCred.
We Can Code IT is an independent training provider. Being listed as an eligible TechCred provider is not an endorsement by the State of Ohio and does not guarantee funding. The Ohio Department of Development makes all TechCred decisions, so check the state's current program guidelines before you apply. Program details: the State of Ohio’s TechCred page.
Choose the number of seats, add the course to your cart and check out.
Send the form below for group enrollment or a written quote to include with your TechCred application. We reply within one business day. You can also email admissions@wecancodeit.org.
We Can Code IT, LLC, 26300 Cedar Rd, Suite 1105, Beachwood, OH 44122. Registered with the Ohio State Board of Career Colleges and Schools, Registration No. 15-03-2064T.
