The SC-730 exam is Microsoft’s newest cybersecurity certification, and it is unlike any other security exam in the catalog. Instead of testing IT professionals on technical configurations, the SC-730 puts you in the seat of a business user and asks how you would recognize, respond to, and report cybersecurity issues in your day-to-day work. After taking the beta exam myself, I wanted to share what the exam actually covers, what surprised me, and how to prepare if you plan to sit for it.
Key takeaways
- The SC-730 is the third Microsoft business user certification, following the AB-730 and AB-731, but this one focuses on cybersecurity rather than AI.
- There are no Microsoft products in the exam objectives. The SC-730 tests general cybersecurity best practices from a business user perspective.
- Any IT professional with the SC-900 or higher should be able to pass the SC-730 without studying, but the business user mindset shift is real.
- Microsoft is offering 80% off the SC-730 beta exam with code SC730Eclipse for the first 300 people who take it before May 27, 2026.
- This certification is one of the best ways to replace annual cybersecurity awareness training for non-technical employees.
What the SC-730 exam actually covers
The SC-730 exam tests four skill areas, weighted as follows:
- Understand cybersecurity concepts (25 to 30 percent)
- Understand cybersecurity risks and threats (30 to 35 percent)
- Apply basic security policies to protect the organization (25 to 30 percent)
- Report and respond to security incidents (10 to 15 percent)
The biggest thing to know up front is that there are no Microsoft technologies in the exam objectives. The SC-730 is about general cybersecurity best practices, not product configuration. You will not see questions about Microsoft Defender XDR, Microsoft Entra ID, or Microsoft Purview. You will see questions about the kind of decisions a business user has to make: what to do when a file looks suspicious, how to spot a phishing email, what to do if you lose your laptop, and which channel to use to report an incident.
The topics on the SC-730 exam include the risks of using public Wi-Fi networks, the difference between malware and ransomware, how to recognize each based on the behavior you would see on your computer, and the actions a business user should take to stop them from spreading. You will also be tested on social engineering, including what a deepfake is and how to recognize one, which is incredibly relevant in 2026.
Even though this is a cybersecurity exam and not an AI exam, you will see questions about what types of data should never be shared with public AI tools. This is one of the most practical and timely topics on the exam. We have seen too many real cases where employees, including people working in government, paste sensitive data into ChatGPT or similar tools. The SC-730 reinforces that this is something every business user needs to understand.
Why the SC-730 exam is built for business users, not IT pros
The SC-730 is the third Microsoft certification designed specifically for business users. The first two were the AB-730 AI Business Professional and the AB-731 AI Transformation Leader. Both of those focused on AI. The SC-730 follows the same pattern, but with cybersecurity as the subject.
Microsoft defines the target candidate as a business professional who uses digital tools and connected systems for their daily work, but is not a security professional. Typical roles include administrative staff, analysts, project managers, marketers, and salespeople. The exam assumes you have a non-technical background, limited formal training in cybersecurity, and high exposure to cyber risks because of the data you handle every day.
That framing matters because it changes what the exam expects you to know. You are not expected to investigate a security incident or configure a tool. You are expected to recognize when something is wrong, take the right immediate action, and report it through the correct channel.
What surprised me as an IT pro
If you have the SC-900 certification or higher, you should be able to pass the SC-730 without studying. The cybersecurity concepts on the SC-730 are foundational, and IT professionals already think about these issues every day.
That said, there were a few things that took me by surprise, and they all came from the same place: the SC-730 puts you in the business user’s seat, not the IT pro’s seat. As an IT pro, my instinct is to investigate. If a business user tells me something bad happened, I go to the audit logs, open the right tools, and start digging. For this exam, you are not the investigator. You are the business user noticing that something looks shady on your laptop and trying to figure out what to do next.
That mindset shift came up in questions like: what steps should you take when you see a weird file or unexpected pop-ups on your device? Who do you need to report it to? If you receive a phishing email, how should you report it to your IT team, and what information should you gather first? If you lose your device, what should you do immediately?
What made some of these harder is that the answers feel company-specific. In real life, every organization has a different policy on what to delete, what to report, and who is responsible for what. For the SC-730, you have to step back from any specific company’s playbook and answer based on Microsoft’s general best practices framework. Once Microsoft Learn publishes the full study content for this exam, that framework will be easier to internalize.
How sensitivity labels and rights management are tested
The only place the SC-730 exam gets close to Microsoft technology is around sensitivity labels and rights management, and even there, it stays generic. There is no mention of Microsoft Purview. There is no mention of sensitivity labels by name. You will not be asked how to add a sensitivity label to a Word document or how to configure permission levels in SharePoint.
What you do need to know are the concepts. You need to understand why labeling content matters and that business users should apply labels based on their organization’s policy. You need to understand rights management at a conceptual level, including why giving someone more permissions than they need creates unnecessary risk. The exam frames these as principles, not product features.
Who should take the SC-730 and why managers should care
My honest take is that the SC-730 is one of the most universally useful Microsoft certifications in the catalog. If you work with a computer connected to the internet, you should consider taking this exam. The content is exactly what every employee in a modern organization needs to understand, and the certification gives the learning real weight.
If you are a manager, the SC-730 is a much better motivator than the standard annual cybersecurity awareness training video. Instead of asking your team to sit through another mandatory training module, you can challenge them to pass a Microsoft recognized certification. The content is the same kind of material the training videos cover, but the certification gives employees a credential they can put on LinkedIn, share with their network, and feel good about earning. People are far more motivated to learn when there is a real reward at the end of it, and your organization benefits because your team is genuinely more aware of how to handle threats.
This is also the easiest entry point to the Microsoft certification ecosystem for a non-technical employee. The AB-730 and AB-731 both assume some familiarity with Microsoft 365 Copilot. The SC-730 does not assume any product knowledge at all. It only asks that you understand how to work safely online.
How to get 80% off the SC-730 exam
Microsoft posted an 80% off discount code for the SC-730 beta exam on the Skills Hub blog. The promo code is SC730Eclipse, and you enter it during checkout when you register for the exam. The catch is that the discount is limited to the first 300 people, and you must take the exam on or before May 27, 2026. General availability of the certification is expected in July 2026.
If you are reading this close to the publish date, the code is worth trying. It is a single step at checkout, and if it has already been claimed by 300 other people, you will see that during the payment step before you commit to anything.
What this means for you
The SC-730 is more than just another certification announcement. It is a signal that Microsoft is taking business user cybersecurity awareness seriously enough to put a credential behind it. If you are an IT professional, this is a tool you can hand to your leadership team to replace tired annual training cycles. If you are a manager, it is a way to turn mandatory cybersecurity awareness into something your team will actually engage with. If you are a business user, it is a low-effort way to add a Microsoft certification to your profile while learning skills that will protect your organization and your career.
The action item is simple. If you are an IT pro with SC-900 or higher, grab the discount code and take the SC-730 before May 27, 2026. If you manage a team, send them the certification page and the discount code together. And if you are a business user looking for your first Microsoft credential, this is the easiest one to start with.
Frequently asked questions
How hard is the SC-730 exam?
The SC-730 exam is foundational. The content is not technically difficult, but the questions are framed from a business user perspective, which can trip up IT professionals who are used to thinking like investigators. If you have the SC-900 or higher, you should be able to pass without studying, as long as you are comfortable answering questions about how a business user should respond to incidents.
Do I need to know any Microsoft products for the SC-730?
No. The SC-730 exam objectives do not include any Microsoft products. The exam tests general cybersecurity best practices, not product configuration. The closest the exam comes to Microsoft technology is the concept of content labeling and rights management, but both are framed generically with no mention of Microsoft Purview or sensitivity labels by name.
How does the SC-730 compare to the SC-900?
The SC-900 is a fundamentals certification for people who want to understand how Microsoft security, compliance, and identity solutions work together. It is product-aware and includes coverage of services like Microsoft Defender, Microsoft Entra ID, and Microsoft Purview. The SC-730 is product-agnostic and built for business users who need to recognize and respond to security issues in their daily work. If you are an IT pro, take the SC-900. If you are a business user, take the SC-730.
When will the SC-730 be generally available?
General availability is expected later in 2026 once the beta period closes.. Until then, the exam is in beta, which is why the 80% discount code is available. Beta exam results take longer to receive than standard exam results, but the certification you earn is the same once results are released.
Prefer video? Watch my full SC-730 exam review on my YouTube channel.
Ready to prepare for your next Microsoft security certification? If you want to build a stronger foundation in Microsoft security, compliance, and identity, my Microsoft Security, Compliance, and Identity Fundamentals (SC-900) Exam Prep course on Pluralsight is the natural next step for IT professionals who want product-level depth after the SC-730.
