Certification guidance
Pick the role. See the path.
Every role below shows the Microsoft certifications we teach, in the order that works, with our own programmes where they fit. The other certifications employers ask for sit on a side branch – named honestly, even where we don’t teach them.
- Nine Microsoft exams, taught by Microsoft Certified Trainers
- Eleven job roles, each with its own path
- Other vendors’ certifications shown too
Role to certification
Choose the job. We’ll draw the road.
The main line is the Microsoft path we teach. The dashed branch underneath is what else turns up on UK adverts for that role – so you can see the whole market, not just our part of it.
- Microsoft certification we teach
- MyCyberWay programme and badge
- Microsoft, on request
- Side branch: other certifications, not taught here
Defend
Build and run
Govern and design
Specialist paths
Defend · Entry level
We teach every step on this pathSOC analyst (Tier 1)
Works the alert queue: triages what comes in, investigates phishing and suspicious sign-ins, and escalates what matters with notes someone else can act on.
SC-900
Security, Compliance and Identity Fundamentals. The vocabulary everything else uses.
Blue Team Analyst
26 live classes, your own lab tenant, and a MyCyberWay badge for the assessed work.
SC-200
Security Operations Analyst Associate: Defender XDR, Sentinel, KQL and incident response.
If an advert names a SIEM or EDR product, its vendor certification is under tool certifications.
Defend · 2+ years in a SOC
We teach every step on this pathIncident responder and threat hunter (Tier 2 to 3)
Owns the investigation: hunts without an alert to start from, builds the breach timeline, finds the root cause and writes it up for people who weren’t there.
SC-200
If you don’t already hold it: the security operations exam on the Microsoft stack.
Blue Team Specialist
30 live classes: investigations, an advanced threat hunting workshop, breach analysis, root cause analysis and reporting. Two master assignments before the badge.
Microsoft has no certification beyond SC-200 for this role. Moving up comes from evidence of investigations you’ve owned.
Build · 3+ years in
We teach every step on this pathSecurity engineer
Builds and tunes the defences – detection rules, identity hardening, segmentation, endpoint and cloud controls – then explains the design to the people who have to live with it.
SC-200 or SC-300
SC-200 if you come from operations, SC-300 if you come from identity.
Blue Team Engineer
28 live classes across 14 modules, configured in your own tenants, with a configuration pack for your portfolio.
SC-500
Cloud and AI Security Engineer Associate: identity, networks, data, compute and AI workloads, with Defender for Cloud and Sentinel.
CISSP normally needs five years’ paid experience. Adverts that name a firewall, EDR or SIEM product want its vendor certification – see tool certifications.
Build · 2+ years in cloud or infrastructure
We teach every step on this pathCloud security engineer
Secures the platform itself: identities and keys, networks and private endpoints, workloads and containers, and the security posture of the whole estate.
AZ-900
Azure Fundamentals, if Azure is new to you.
AZ-104
Azure Administrator Associate. SC-500 expects you to administer Azure already.
SC-500
Cloud and AI Security Engineer Associate – the exam that replaced AZ-500 in 2026.
Plenty of employers run more than one cloud. The security thinking carries across; the product knowledge doesn’t, fully.
Build · Entry to mid level
We teach every step on this pathIdentity and access administrator
Decides who can sign in to what: authentication and MFA, Conditional Access, privileged roles, access reviews and application access.
SC-900
Identity, security and compliance concepts across Microsoft 365 and Azure.
SC-300
Identity and Access Administrator Associate: Entra ID, Conditional Access, Privileged Identity Management and governance.
SC-100
SC-300 is one of the routes to Cybersecurity Architect Expert, if design is where you’re heading.
Organisations on Okta or CyberArk ask for those by name – details under tool certifications.
Build · Entry to mid level
We teach every step on this pathEndpoint security administrator
Keeps the devices in line: enrolment, compliance and configuration policies, updates, and the endpoint protection that sits on top. Often the shortest certified step out of a help desk.
SC-900
The security context for every policy you’ll be asked to enforce.
MD-102
Endpoint Administrator Associate: Windows, Intune, compliance policies, updates and endpoint protection.
SC-200
When you want to move from managing endpoints to investigating what happens on them.
Govern · Entry to mid level
We teach every step on this pathData protection and compliance administrator
Turns data rules into working controls: classification and sensitivity labels, data loss prevention, retention and insider risk – and, now, what AI tools are allowed to see.
SC-900
How Microsoft frames security, compliance and identity. Fast, and it makes the rest readable.
SC-401
Information Security Administrator Associate: labels, DLP, retention and insider risk in Microsoft Purview.
SC-300
Identity and access – because most data leaks are really access problems.
Govern · Any background
We teach the technical half of this pathGRC, risk and audit
Sets and checks the rules: policies, risk registers, audits against standards such as ISO/IEC 27001, and the evidence that controls actually work.
SC-900
How the controls you’ll be auditing are actually built on the Microsoft stack.
SC-401
Purview labels, DLP and retention – the evidence you’ll otherwise be asking other people for.
If one of these is your right next step, we’ll tell you – and not sell you a Microsoft course instead.
Govern · Senior
We teach every step on this pathSecurity architect
Designs security for the whole organisation – Zero Trust, ransomware resilience, and the protection of identity, infrastructure, applications, data and AI – and justifies it to the people paying for it.
An associate certification
SC-200, SC-300 or SC-500, wherever your depth already is. SC-100 needs one behind it – check Microsoft’s current list before you book.
Blue Team Engineer
If you’ve never built the controls you’d be designing. Architecture without build experience shows.
SC-100
Cybersecurity Architect Expert: Zero Trust design, resilience, and security across operations, identity, infrastructure, apps, data and AI.
Most UK architect adverts name CISSP. It normally needs five years’ paid experience, so it’s a later step, not a first one.
Specialist · Developers moving into security
We teach part of this pathApplication security and DevSecOps
Puts security into the way software is built: code scanning, secrets and dependency management, secure pipelines and hardened application platforms.
SC-500
Its compute section covers securing App Service, containers, AKS, Functions and API Management.
GH-500
GitHub Advanced Security: code scanning, secret protection and supply chain security. Delivered by Microsoft, maintained by GitHub.
We don’t run an application security programme. If this is your direction, a Career Plan Call is the honest place to start.
Specialist · Offensive security
Not taught yet – red team is comingPenetration tester (red team)
Attacks systems with permission to show where they break, then writes it up so the defenders can fix it.
Red team programme
In development. We don’t teach offensive security today, and nothing on this site says we do.
Purple team programme
Attack and defence together: run the technique, then build the detection for it.
No Microsoft certification covers offensive testing.
The honest picture
Why the main road is Microsoft. And why it isn’t the whole market.
We don’t teach every certification, and we won’t pretend the ones we teach are the only ones that count.
Microsoft is underneath most employers
Microsoft 365 and Entra ID sit underneath a large share of UK organisations. Identity, email and device security skills on Microsoft travel to most employers – even ones whose SOC runs another vendor’s tools.
Plenty of teams run something else
Splunk, CrowdStrike, SentinelOne, Palo Alto Networks, Google Security Operations, AWS. Adverts from those employers name those products and their certifications, and every role above says so.
What we advise
- Learn the job on the Microsoft stack first
- Add a vendor certification when a specific employer asks for it
- Collect evidence of work, not a longer list of badges
Tool certifications
If the advert names a product, look here.
A tool certification proves you know one vendor’s product. It matters most once you’re in a job that runs it – it’s rarely the way in. The roles above stay job-first on purpose.
- Microsoft SentinelSC-200 Security Operations AnalystWe teach the exam
- SplunkSplunk Core Certified User and Power User; Splunk Enterprise Security Certified AdminIn our programmes
- Elastic SecurityElastic’s own certification programmeVendor’s own
- Microsoft Defender XDRSC-200 Security Operations AnalystWe teach the exam
- CrowdStrike FalconCCFA (Administrator), CCFR (Responder), CCFH (Hunter)In our programmes
- SentinelOne SingularitySentinelOne’s own trainingIn our programmes
- Palo Alto Networks CortexPalo Alto Networks’ security operations certificationsVendor’s own
- Azure network securitySC-500 Cloud and AI Security Engineer (Azure Firewall, network security groups, Private Link)We teach the exam
- Palo Alto Networks firewallsNext-Generation Firewall Engineer, which replaced PCNSE in 2025Vendor’s own
- Fortinet FortiGateFortinet Certified Professional (FCP)Vendor’s own
- CiscoCCNA; CCNP SecurityVendor’s own
- Check PointCCSA; CCSEVendor’s own
- Microsoft AzureAZ-900, AZ-104 and SC-500We teach the exam
- Amazon Web ServicesAWS Certified Security – SpecialtyIn our programmes
- Google CloudProfessional Cloud Security EngineerVendor’s own
- KubernetesCNCF CKA; CKS (Certified Kubernetes Security Specialist)Vendor’s own
- Microsoft Entra IDSC-300 Identity and Access AdministratorWe teach the exam
- OktaOkta Certified Professional; Okta Certified AdministratorVendor’s own
- CyberArkCyberArk Defender; CyberArk Sentry (privileged access)Vendor’s own
- SailPointSailPoint’s identity governance certificationsVendor’s own
- Microsoft PurviewSC-401 Information Security AdministratorWe teach the exam
- Microsoft Defender for Office 365SC-200 Security Operations AnalystWe teach the exam
- Proofpoint and MimecastEach vendor’s own trainingIn our programmes
- Tenable NessusTenable’s own certificationIn our programmes
- QualysQualys’s own training and certificatesVendor’s own
What we teach today
Nine Microsoft exams, three badges of our own.
Tutor-led preparation against Microsoft’s current exam outlines, taught by Microsoft Certified Trainers. Exam fees are paid to Microsoft and aren’t included in the course price.
FundamentalsNo prerequisites. A good first exam.
AssociateThe level most job adverts ask for.
ExpertNeeds an associate certification behind it.
Associate and Expert certifications are valid for a year. You renew them free of charge with an online assessment on Microsoft Learn.
MyCyberWay Blue Team Analyst
Our own badge, awarded for assessed work on the programme – not an exam you can buy. How our badges work.
MyCyberWay Blue Team Specialist
Awarded after every lab and two master assignments, one of them a full investigation write-up.
MyCyberWay Blue Team Engineer
Awarded for configuration work built and documented in your own tenants.
Also from Microsoft
Other Microsoft security certifications, on request.
Not on our regular timetable, but close enough to what we teach that we can prepare you for them. Ask us.
Microsoft Applied Skills – short, lab-based credentials for a single product – change often. Ask us which are current before you plan around one.
In the works
Coming, but not yet.
Listed so you can plan around them. Neither is open, and neither is on sale.
Coming soon
Red team
Offensive security: attacking the environment, with permission, to show where it breaks. We don’t teach it today, so nothing on this site claims we do.
Coming soon
Purple team
Attack and defence together: running the technique, then building the detection for it. In development alongside the red team programme.
Questions
The usual ones.
Why is the main path always Microsoft?
Because it’s what we teach, and because Microsoft 365 and Entra ID sit underneath a large share of UK employers, so the skills travel. It isn’t the only route: every role above shows the other certifications employers ask for, and the tool section shows the product-specific ones.
Do you teach CompTIA, ISC2, GIAC or CREST certifications?
No. We name them because they’re on real adverts, not because we sell them. If one of them is the right next step for you, we’ll say so.
I hold AZ-500. Do I need SC-500?
AZ-500 retired on 31 August 2026. Your certification stays on your transcript, but it can no longer be renewed, and there is no transition exam. To hold the current security engineer certification you pass SC-500.
How many certifications do I actually need?
For a first role, two is normally enough: one fundamentals exam and one associate exam. After that, evidence of work beats a longer list every time. Collecting certificates instead of building something is the most expensive mistake in this industry.
Are the exam fees included?
No. You pay Microsoft directly for the exam, and you book it when you’re ready. We’ll tell you honestly when that is.
Is a MyCyberWay badge the same as a Microsoft certification?
No, and we never present it as one. A Microsoft certification comes from passing Microsoft’s exam. Our badge is our own record that you completed and passed the assessed work on our programme. How our badges work.
Do you teach red team certifications?
Not today. Red team and purple team programmes are in development. Everything we run now is blue team: defending, detecting and responding.
Still weighing two options?
Thirty minutes and a decision you can defend.
Bring your background and the roles you’re aiming at. You leave with the order written down – including where the answer is “not that one yet”.
Microsoft, Azure, Microsoft 365, Entra, Defender, Sentinel, Purview, Intune and GitHub are trademarks of the Microsoft group of companies. Certification badges are shown only to identify the certification a course prepares you for. MyCyberWay is an independent training provider and is not affiliated with or endorsed by Microsoft.
