Cybersecurity Architect Expert (SC-100) Study Plan for 2026

Topics

• • Zero Trust principles: verify explicitly, least privilege, assume breach
• • Microsoft Cybersecurity Reference Architectures (MCRA) and how they map to exam scenarios
• • Microsoft Cloud Security Benchmark (MCSB) controls and how to evaluate alignment
• • Business resiliency goals, threat prioritization, and BCDR for hybrid and multicloud environments
• • Ransomware mitigation strategies, including BCDR and privileged access prioritization

Activities

• • Read the [Zero Trust adoption framework](https://learn.microsoft.com/en-us/security/zero-trust/) end-to-end and map its six pillars to a real enterprise scenario you know.
• • Review the MCRA poster and write a one-sentence summary of each major architecture pattern (identity, network, endpoint, data, app, infrastructure).
• • Map the MCSB controls to three Azure services you use and note which controls each service satisfies out of the box vs. requires configuration.
• • Take an ExamOS Mock Exam in Rookie mode. Record your baseline score per domain.
• • Write a one-page ransomware response strategy for a mid-size enterprise with hybrid infrastructure, covering backup, privileged access, and incident response.

Topics

• • Cloud Adoption Framework (CAF) security and governance modules
• • Azure Well-Architected Framework security pillar
• • Azure landing zones and their security design patterns
• • DevSecOps integration within the CAF, including pipeline security controls
• • Secure AI adoption strategy and the Microsoft Cloud Security Benchmark for AI workloads

Activities

• • Study the CAF security module and create a decision matrix mapping each CAF governance stage to specific Azure Policy and Defender for Cloud configurations.
• • Review the Well-Architected Framework security pillar and write three architecture trade-offs where security conflicts with cost or performance.
• • Design a secure Azure landing zone for a financial services organization with regulatory requirements, specifying management group hierarchy, policy initiatives, and network topology.
• • Write a DevSecOps pipeline design that integrates SAST, DAST, secret scanning, and container image scanning into a CI/CD workflow.
• • Complete a Daily Sprint in Challenger mode on Domain 1. Repeat until you pass two consecutive sprints.

Topics

• • XDR and SIEM integration design using Microsoft Defender XDR and Microsoft Sentinel
• • Centralized logging and auditing architecture, including Microsoft Purview Audit
• • SOAR design with Sentinel playbooks and Defender XDR automated response
• • MITRE ATT&CK mapping for threat detection coverage across Enterprise, Mobile, and ICS matrices
• • Incident response, threat hunting, and incident management workflow design
• • Hybrid and multicloud monitoring architecture

Activities

• • Design a security operations architecture that integrates Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Purview Audit for a multinational enterprise with on-premises and multicloud workloads.
• • Map the MITRE ATT&CK Enterprise matrix to Microsoft Defender components and identify three detection gaps you would close with Sentinel analytics rules.
• • Write a SOAR playbook design for a phishing incident that automates triage, containment, and evidence collection across email, endpoint, and identity signals.
• • Architect a centralized logging solution that ingests security logs from Azure, AWS, and on-premises sources into a single Sentinel workspace with appropriate RBAC and retention.
• • Complete a Daily Sprint in Challenger mode on security operations. Repeat until you pass two consecutive sprints.

Topics

• • Microsoft Entra ID design for hybrid and multicloud environments, including Entra Agent ID for AI agent identities
• • Conditional Access strategy, continuous access evaluation, risk scoring, and protected actions
• • External identities: B2B federation, decentralized identity, and cross-tenant access
• • Privileged access design: enterprise access model, PIM, entitlement management, access reviews
• • AD DS hardening and resilience to common attacks (Pass-the-Hash, Kerberoasting, DCSync)
• • Microsoft Purview compliance solutions and Azure Policy for regulatory alignment
• • Secrets, keys, and certificate management with Azure Key Vault

Activities

• • Design a Conditional Access strategy for a hybrid workforce that includes employees, B2B partners, and AI agent identities, with risk-based policies and protected actions for sensitive operations.
• • Architect a privileged access model using the enterprise access model with PIM just-in-time activation, separate admin accounts, and secure workstation requirements.
• • Write an AD DS hardening plan that addresses Pass-the-Hash, Kerberoasting, and DCSync attacks with specific Group Policy and configuration changes.
• • Map three regulatory frameworks (e.g., NIST 800-53, ISO 27001, SOC 2) to Azure Policy initiatives and Defender for Cloud regulatory compliance dashboards.
• • Design a secrets management architecture using Azure Key Vault with managed identity integration, rotation policies, and access policies aligned to least privilege.
• • Complete a Daily Sprint in Challenger mode on identity and compliance. Repeat until you pass two consecutive sprints.

Topics

• • Microsoft Defender for Cloud posture evaluation, including MCSB alignment and Secure Score
• • Microsoft Security Exposure Management: attack paths, attack surface reduction, security insights
• • Defender External Attack Surface Management (EASM)
• • Azure Arc integration for hybrid and multicloud security management
• • Endpoint security requirements: servers, mobile devices, clients, IoT, and OT/ICS
• • Windows LAPS, security baselines, and endpoint hardening
• • Defender for IoT for operational technology and industrial control systems

Activities

• • Design a posture management process that uses Defender for Cloud recommendations, Secure Score, and Exposure Management attack paths to prioritize remediation across a hybrid estate.
• • Architect an Azure Arc deployment that extends Defender for Cloud and Azure Policy to on-premises servers and AWS/GCP resources.
• • Write endpoint security requirements for a mixed environment (Windows servers, Linux containers, iOS/Android mobile, IoT sensors) with specific hardening baselines per platform.
• • Evaluate Windows LAPS implementation for a domain-joined environment and document the rollout plan including pilot, phased deployment, and monitoring.
• • Design a Defender for IoT deployment for a manufacturing facility with OT networks, specifying sensor placement, segmentation, and alerting integration with Sentinel.
• • Complete a Daily Sprint in Challenger mode on infrastructure posture and endpoints. Repeat until you pass two consecutive sprints.

Topics

• • Network security design: Azure Firewall, Network Security Groups, Web Application Firewall
• • Security Service Edge (SSE) with Microsoft Entra Internet Access and Microsoft Entra Private Access
• • Secure web gateway design and cross-tenant Microsoft service access
• • Security baselines for SaaS, PaaS, and IaaS services
• • Container and container orchestration security (AKS, Azure Container Instances)
• • Azure AI services security requirements
• • Web workload and API security design

Activities

• • Design a network security architecture for a multi-region enterprise that combines Azure Firewall, WAF, and Microsoft Entra Internet Access for secure web gateway functionality.
• • Architect a Security Service Edge solution using Microsoft Entra Private Access to replace legacy VPN for a hybrid workforce accessing on-premises applications.
• • Write security baselines for three PaaS services (App Service, Azure SQL, AKS) and three SaaS services (Microsoft 365, Salesforce, ServiceNow) with specific configuration requirements.
• • Design container security for an AKS cluster covering image scanning, network policies, pod security standards, runtime protection, and secrets management.
• • Evaluate Azure AI services security requirements for a generative AI application, including content filtering, data residency, and managed identity integration.
• • Complete a Daily Sprint in Challenger mode on network security and workload protection. Repeat until you pass two consecutive sprints.

Topics

• • Application security posture evaluation and threat modeling for business-critical applications
• • Application security lifecycle: SAST, DAST, SCA, container scanning, and DevSecOps integration
• • Workload identity design for Azure resource authentication
• • API management and security with Azure API Management
• • Azure Web Application Firewall (WAF) design for web workloads
• • Data discovery and classification with Microsoft Purview
• • Data encryption: at rest, in transit, infrastructure encryption, Azure Key Vault integration
• • Data security for Azure SQL, Cosmos DB, Synapse Analytics, and Azure Storage
• • Defender for Storage and Defender for Databases deployment design
• • Microsoft 365 security: Defender for Office 365, Defender for Cloud Apps, Intune, Purview data security
• • Copilot for Microsoft 365 data security and compliance controls

Activities

• • Design an application security lifecycle for a microservices platform that integrates SAST in CI pipelines, DAST in staging, container image scanning, and runtime protection with Defender for Cloud.
• • Write a threat model for a customer-facing web application using STRIDE and map each threat to specific Azure security controls.
• • Architect a data classification and protection strategy using Microsoft Purview for an organization handling PII, financial data, and intellectual property across Azure SQL, Cosmos DB, and Storage.
• • Design encryption architecture for a multi-region application covering data at rest (customer-managed keys), in transit (TLS 1.3), and infrastructure encryption with Azure Key Vault managed HSM.
• • Evaluate Microsoft 365 security posture using Secure Score and design improvements for Defender for Office 365, Defender for Cloud Apps, and Intune device compliance policies.
• • Complete a Daily Sprint in Challenger mode on application and data security. Repeat until you pass two consecutive sprints.

Topics

• • Cross-domain architecture scenarios combining Zero Trust, SecOps, identity, infrastructure, and application security
• • Case study analysis technique: identifying binding constraints and eliminating options
• • Time management strategy for 40-60 questions in 120 minutes
• • Final gap analysis and targeted review

Activities

• • Retake the free official Microsoft practice assessment and compare your score to Week 1. Identify remaining weak domains.
• • Complete at least three Mock Exams. After each, review every wrong answer and write one sentence on the architectural principle behind the correct answer.
• • Design an end-to-end security architecture for a financial services organization that spans Zero Trust strategy, SecOps with Sentinel and Defender XDR, Entra ID with PIM, hybrid infrastructure with Azure Arc, and data protection with Purview.
• • Run one full simulation under real conditions: no phone, no breaks, 120 minutes, same time of day as your scheduled exam.
• • For every missed Mock Exam question, write one sentence explaining the architectural principle behind the correct answer.
• • Book your exam when your readiness score is stable and above 80, and you have covered every domain at least once.