The English version of Exam SC-100: Microsoft Cybersecurity Architect uses an updated skills outline as of October 21, 2026. The four major domains and their weight ranges remain unchanged, while the current outline explicitly covers secure AI adoption, agent identities, and updated Microsoft 365 and security-operations considerations.
This is not a new exam or a new certification. The code remains SC-100, Microsoft lists no retirement date, and the exam is still required for Microsoft Certified: Cybersecurity Architect Expert. Candidates already preparing should adjust their plan rather than restart it.
The official SC-100 study guide (opens in a new tab) identifies the objectives effective October 21. The official exam page (opens in a new tab) says localized versions are generally updated approximately eight weeks after English, while warning that this timing is not guaranteed.
What stays the same
The weight ranges are stable:
| SC-100 domain | Weight |
|---|---|
| Design solutions that align with security best practices and priorities | 20–25% |
| Design security operations, identity, and compliance capabilities | 25–30% |
| Design security solutions for infrastructure | 25–30% |
| Design security solutions for applications and data | 20–25% |
The overall preparation strategy therefore remains valid. Do not abandon Zero Trust, resilience, identity, multicloud posture, application security, or data protection to study only AI. The explicit AI objectives sit inside the existing security architecture.
Microsoft labels changes as minor in two subareas of its official change log: “Design solutions for security operations” and “Evaluate solutions for securing Microsoft 365.” The major domains are marked as unchanged. That wording matters: content has evolved, but the exam structure has not been overturned.
AI is now an explicit security architecture concern
The current outline expects candidates to design AI solutions aligned with the Microsoft Cloud Security Benchmark and to design a secure AI adoption strategy through the Cloud Adoption Framework and Azure Well-Architected Framework.
It is no longer enough to say that a model should be “secure.” An architect should connect decisions to controls: identity, least privilege, data protection, logging, posture, network boundaries, detection, and recovery.
A useful exercise is to select an enterprise assistant and document:
- the data it reads and generates;
- the identity used to call each tool;
- permissions and access conditions;
- logs needed for investigation;
- limits on autonomous action;
- the response process after compromise or error.
This is a personal study artifact, not an official Microsoft template. It nevertheless forces you to treat AI as a workload with assets, flows, and accountability, which matches the architect-level intent.
Microsoft Entra Agent ID belongs in the study plan
The guide explicitly asks candidates to design a solution for agent identities using Microsoft Entra Agent ID and conditional access policies. That objective connects AI agents to the identity and access portion of the 25–30% operations, identity, and compliance domain.
Ask four questions for every agent:
- Which identity represents the agent?
- Which tools and resources can it reach?
- Under what conditions should access be granted or blocked?
- How are its privileges reviewed, constrained, and removed?
Do not treat an agent as either a normal human user or a permanent API key. The architecture problem includes lifecycle, boundaries, risk evaluation, and policies consistent with Zero Trust.
This also reflects Microsoft’s broader credential direction. The OnLevelUp guide to Microsoft’s 2026 AI certifications and the AB series covers agentic solution roles. SC-100 addresses the security strategy and safeguards around those solutions.
Security operations remain central
Under “Design solutions for security operations,” the current guide retains XDR, SIEM, centralized logging, Microsoft Purview Audit, hybrid and multicloud monitoring, and SOAR with Microsoft Sentinel and Microsoft Defender XDR.
It also expects candidates to design and evaluate incident response, threat hunting, and incident management workflows, then assess detection coverage with MITRE ATT&CK matrices including Enterprise, Mobile, and industrial control systems.
The change is officially minor, but it has a practical implication: revise by decision chain instead of product list.
| Stage | Architecture question |
|---|---|
| Collection | Which sources and logs are essential? |
| Detection | How does coverage reduce blind spots? |
| Triage | Which context allows incidents to be prioritized? |
| Response | Which actions can be automated, and which require approval? |
| Audit | Which evidence explains the decision later? |
This prevents a common failure: knowing what Sentinel or Defender XDR does without being able to design how it participates in a defensive process.
Microsoft 365: a minor change, not a new domain
Microsoft’s change log also identifies a minor update under “Evaluate solutions for securing Microsoft 365.” The current guide expects Microsoft 365 protection to be evaluated as part of the larger identity, data, application, and collaboration architecture.
Microsoft does not present this as a new domain and does not assign a new weight. Do not infer an exact question count. Compare your course materials with the October 21 guide and fill gaps, especially where product names and integrations have changed.
Pay attention to exam language
Microsoft updates English first. SC-100 is offered in several localized languages, including French, but the exam page warns that localized versions follow approximately eight weeks later. “Approximately” is important.
Before scheduling:
- choose the exam language;
- open the matching study guide;
- verify the objective date and version;
- preserve a copy of your revision plan;
- check the official page again shortly before the appointment.
Do not assume a localized delivery immediately includes every English change effective October 21. Conversely, do not use an older localized resource as the sole source for an English exam.
Cybersecurity Architect Expert requirements
SC-100 is the required exam, but the Cybersecurity Architect Expert certification (opens in a new tab) also requires at least one of three certifications listed by Microsoft:
- Identity and Access Administrator Associate;
- Security Operations Analyst Associate;
- Cloud and AI Security Engineer Associate.
This separates passing an exam from earning the certification. SC-100 alone is insufficient when none of the accepted prerequisite credentials is active in your profile. Verify the certification page when building your plan because Microsoft can revise credential pathways.
If you need a vendor-neutral foundation first, the French OnLevelUp article about the October 2026 ISC2 CC preparation update provides a complementary view of governance, identity, cloud security, and incident response. It does not replace Microsoft platform knowledge, but it helps distinguish security principles from vendor implementation.
A four-week revision plan
Week 1: blueprint and diagnostic
Download the current guide. Mark every objective as confident, partial, or unknown, then connect it to evidence: a diagram, decision, observed configuration, or project example. Recognizing a product name is not evidence of mastery.
Week 2: secure AI and agent identities
Build one agent use case and produce a trust diagram. Include Entra Agent ID, conditional access, secrets, data, observability, and autonomy boundaries. Test at least one compromise scenario, such as excessive privilege, a malicious tool, or data leakage.
Week 3: SecOps, infrastructure, and Microsoft 365
Design an architecture that centralizes logs, covers multiple clouds, uses XDR and SIEM, and includes response orchestration. Add application, data, and Microsoft 365 protection. Explain trade-offs rather than merely naming the selected products.
Week 4: scenarios and practice assessment
Work through architect decisions: business requirement, threat, control, solution, limitation, and evidence. Use Microsoft’s practice assessment when available, then classify every miss under the four weighted domains. Address high-weight gaps and weaknesses that affect several domains first.
A scenario-based way to revise
Suppose an organization deploys an agent that reads sensitive Microsoft 365 content and performs cloud actions. A strong SC-100 answer should not jump immediately to one product. It should identify the business outcome and data, select an agent identity, apply least privilege and access conditions, define network and data controls, design logs and detections, and preserve a human escalation path.
Then introduce failure: the agent requests an unusual privilege or produces an unexpected action. Decide which telemetry detects it, which automated response is safe, who approves containment, and what evidence remains for review. One scenario now exercises AI security, identity, operations, applications, and data—the cross-domain reasoning the expert credential is intended to validate.
FAQ
Did the weightings change on October 21?
No. The guide keeps the four ranges at 20–25%, 25–30%, 25–30%, and 20–25%.
Has SC-100 been replaced?
No. SC-100 remains active and the official page shows no retirement date.
Is AI now the whole exam?
No. The outline explicitly includes AI security and agent identities, but Zero Trust, resilience, SecOps, identity, infrastructure, applications, and data remain essential.
Does every localized exam change on the same day?
Not necessarily. Microsoft says localized versions generally follow English by approximately eight weeks, and notes that the schedule can vary. Check the guide for your selected language.
The October 21 update mainly reinforces architect-level reasoning: begin with risk, define controls, select capabilities, document trade-offs, and retain defensible evidence.
