Chapter 2 of 4 · Microsoft SC-100

Design security operations, identity, and compliance capabilities

XDR, SIEM, SOAR, Entra identity, privileged access and regulatory compliance.

  • 7topics
  • 40 minfast track
  • 3diagrams and exhibits
  • 25–30%of the exam
Start with Detection and Response with XDR and SIEM

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Detection and Response with XDR and SIEMSC-100 detection and response: Microsoft Defender XDR, Microsoft Sentinel as SIEM, connectors, analytics rules, UEBA and…Diagram6 min
  2. 2Logging, Auditing, SOAR and Threat HuntingSC-100 operations: central logging, Purview Audit, hybrid and multicloud monitoring, Sentinel SOAR, incident response, hunting…6 min
  3. 3Identity and Access Solutions with Microsoft EntraSC-100 identity design: Entra ID tenants, hybrid identity with Connect and Cloud Sync, and access to SaaS, PaaS, IaaS and…5 min
  4. 4Modern Authentication, Conditional Access and External IdentitiesSC-100 authentication: Conditional Access design, continuous access evaluation, risk scoring, protected actions, B2B, External ID…Diagram6 min
  5. 5Agent Identities, Secrets and AD DS HardeningSC-100 identity: Microsoft Entra Agent ID for AI agents, secrets and keys with Key Vault and Managed HSM, and hardening Active…6 min
  6. 6Securing Privileged AccessSC-100 privileged access: the enterprise access model, PIM, entitlement management, access reviews, CIEM and privileged access…Diagram6 min
  7. 7Regulatory Compliance with Purview, Azure Policy and Defender for CloudSC-100 compliance: turning requirements into controls with Purview Compliance Manager, Azure Policy initiatives and Defender for…5 min

About this chapter

What this chapter covers

This is the largest domain on the exam, worth 25 to 30 percent. It covers four areas an architect designs around: security operations (detection, logging, response and hunting), identity and access management (Microsoft Entra, Conditional Access, external and agent identities, secrets, Active Directory), securing privileged access, and regulatory compliance (turning rules into controls and measuring them).

The key skill is choosing the right Microsoft service for a requirement and explaining how the pieces connect: Defender XDR and Microsoft Sentinel for operations, Entra for identity, PIM for privilege, and Purview with Azure Policy and Defender for Cloud for compliance.

How the topics fit together

IdentityEntra, Conditional AccessPrivileged accessPIM, access reviewsOperationsXDR, SIEM, SOARCompliancePurview, Policy, Defender
  • Detection and response with XDR and SIEM covers how Defender XDR and Microsoft Sentinel work together.
  • Logging, auditing, SOAR and threat hunting covers central logs, Purview Audit, automation, incident response and MITRE ATT&CK coverage.
  • Identity and access solutions with Microsoft Entra covers hybrid identity and access to SaaS, PaaS, IaaS and multicloud resources.
  • Modern authentication, Conditional Access and external identities covers CAE, risk, protected actions, B2B and verified IDs.
  • Agent identities, secrets and AD DS hardening covers Entra Agent ID, Key Vault and protecting on premises Active Directory.
  • Securing privileged access covers the enterprise access model, PIM, access reviews and secure workstations.
  • Regulatory compliance covers translating requirements, Purview Compliance Manager, Azure Policy and Defender for Cloud.
Exam tip

In this domain, "which service" answers usually split cleanly: Defender XDR for correlated Microsoft detections, Sentinel for SIEM and SOAR across everything, Entra for identity, PIM for just in time privilege.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with examples and tables.
  • What to remember for the exam: the facts to memorise and how questions are phrased.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Ready for more practice?

The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.