NEW Microsoft Cybersecurity Certification for Business Users (What We Know So Far)

Microsoft is expanding its business user credential portfolio once again. After launching the AI Business Professional (AB-730) and AI Transformation Leader (AB-731) certifications in late 2025, a new Microsoft cybersecurity certification for business users is officially on the way. The Microsoft Certified: Cybersecurity Business Professional certification (Exam SC-730) will enter beta in April 2026, with training expected in May 2026 and the exam going live in July 2026. This one is not for IT pros or security specialists. Instead, it targets everyday professionals who handle sensitive data without formal security training.

Key takeaways

• Microsoft has confirmed the Cybersecurity Business Professional certification (Exam SC-730) as part of a new wave of cloud, AI, and security certifications (opens in a new tab) announced in March 2026.
• The SC-730 beta exam is expected in April 2026, with training in May 2026 and the exam going live in July 2026.
• The exam targets non-technical business users such as analysts, project managers, marketers, and salespeople, not IT pros or security specialists.
• Four skill domains are proposed: cybersecurity concepts, risks and threats, basic security practices, and incident reporting and response.
• The blueprint includes modern topics like deepfakes, AI data handling risks, and social engineering alongside traditional threats like ransomware and phishing.
• No Microsoft-specific products appear in the current blueprint, making this unusually vendor-agnostic for a Microsoft certification.

How the SC-730 cybersecurity certification for business users started

The first signs of this certification appeared back in August 2025, when Microsoft’s Security Skilling Portfolio Manager posted on the Microsoft Tech Community asking for feedback on a potential cybersecurity certification aimed specifically at business users. At the time, Microsoft had not yet launched any business user certifications, so many community members responded positively but were unsure where such a credential would fit in the portfolio.

By January 2026, Microsoft had made solid progress. A detailed blueprint emerged with a defined target audience, audience characteristics, and proposed skills measured. This follows the same pattern Microsoft used with other recent certifications like the Copilot Studio AB-610 and AB-620 exams, where community feedback preceded formal development.

Then in March 2026, Microsoft made it official. In a Skills Hub blog post (opens in a new tab) announcing a new wave of cloud, AI, and security certifications, Microsoft confirmed the Microsoft Certified: Cybersecurity Business Professional certification with Exam SC-730. According to Microsoft, this certification “validates your ability to recognize security risks, apply secure practices, and make informed business decisions that reduce organizational exposure while enabling productivity and AI adoption.”

The SC-730 is part of a larger batch of new certifications that includes exams for MLOps engineers (AI-300), Azure Databricks data engineers (DP-750), SQL AI developers (DP-800), and more. The SC-730 beta is expected in April 2026, with training materials arriving in May 2026 and the exam going live in July 2026.

Who is the target audience?

Microsoft defines the target audience clearly: this exam is intended for business users who rely on digital tools and connected systems to perform their daily tasks but are not dedicated security professionals. The roles specifically called out include administrative staff, analysts, project managers, marketers, and salespeople.

Candidates should have foundational knowledge in cybersecurity awareness, privacy protection, and incident response. However, the expectation is that they understand basic security concepts and can apply simple, role-relevant practices to reduce risks and maintain compliance.

Microsoft also outlined four characteristics of the intended audience. These professionals frequently use computers, mobile devices, cloud services, and collaboration platforms. They do not have a technical background and have limited formal cybersecurity training. They regularly handle sensitive data across networks, often unaware of potential cyber risks. And they are accountable for safeguarding personal and organizational information in compliance with company policies.

Honestly, Microsoft seems to be going out of its way to emphasize that this is not an IT professional certification. The audience characteristics essentially describe nearly every knowledge worker today. However, the point is clear: Microsoft wants to encourage as many business users as possible to pursue this credential.

The four proposed skills measured

Microsoft has outlined four main skill domains for this exam. These are still proposed and could change before the certification launches, but they give a strong indication of what to expect.

Understand cybersecurity concepts

This domain covers foundational knowledge including the cybersecurity shared responsibility model, employee participation in security awareness initiatives, and accountability practices. It also includes applying simple organizational policies and data handling standards. One interesting inclusion: identifying types of data that should not be shared with AI tools. Even though this is a cybersecurity certification, AI awareness is woven into the objectives.

Additional topics include describing the benefits of using a password manager to protect credentials, understanding MFA, identifying business processes targeted by adversaries, understanding risks of remote work environments, the importance of software updates, and the impact of security events like ransomware.

The domain also covers defining terms like vulnerability, threat, risk, encryption, and exploit, as well as describing what deepfakes are. Microsoft is blending traditional security concepts with emerging threats, which makes a lot of sense for a 2026 certification.

Understand cybersecurity risks and threats

This domain focuses on identifying common risks such as public Wi-Fi vulnerabilities and social engineering techniques including phishing, pretexting, and baiting. It also covers detecting indicators of malicious activity like malware symptoms, potential insider threats, and abnormal system behavior.

The section on evaluating digital communications is particularly practical. Candidates should be able to identify suspicious emails, malicious links, and unexpected attachments. They should also verify the legitimacy of requests for access, payments, or sensitive data. For business users who receive dozens of emails daily, these are critically important skills.

There is also a sub-section on applying access controls, which asks candidates to identify appropriate controls to limit access to systems and data. This objective may be slightly ambitious for the described audience, since most business users do not have the authority to configure access controls. However, understanding why those controls exist is still valuable.

Apply basic security practices to protect the organization

This domain covers securing devices, accounts, and workspaces, including understanding strong passwords, multifactor authentication, and securing remote and mobile devices. It also addresses protecting sensitive and proprietary data, with topics like recognizing and classifying sensitive data, understanding document sensitivity labeling, and understanding rights management.

The sensitivity labeling section is worth noting. While understanding sensitivity labels is universally valuable, knowing when to apply each label can be highly company-specific. Every organization has different label names and classification rules. It will be interesting to see how Microsoft evaluates this at a general level.

The domain also includes safe internet and data handling practices, covering data collection, use, transfer, storage, retention, and destruction. Some of these responsibilities, particularly data destruction and retention, typically fall under IT administration rather than business user tasks. Similarly, the backup and recovery sub-section asks candidates to understand recovery measures and follow basic steps for data loss, which may go beyond what the typical target audience would handle independently.

Report and respond to security incidents

The final domain is arguably the most practical one. It covers identifying situations that require reporting, such as phishing attempts, lost devices, and unauthorized access. Candidates should know what information to include in a report (date, type of incident, affected data) and how to choose the appropriate reporting channel, whether that is email, help desk, or an incident form.

IT professionals everywhere will appreciate this section. Better incident reports from business users mean faster resolution times and fewer back-and-forth exchanges. As someone who has authored 100+ Pluralsight courses on Microsoft technologies, I can confirm that bridging the communication gap between business users and IT teams is one of the most impactful things an organization can do.

The domain also covers taking appropriate action during data breaches, including following basic steps like stopping data sharing, disconnecting devices, notifying IT, and recognizing when escalation is required.

A surprisingly vendor-agnostic certification

One of the most notable aspects of this certification blueprint is the complete absence of Microsoft-specific products. There is no mention of Microsoft Defender, Microsoft Purview, Microsoft Entra, or any other Microsoft security tool. The objectives read more like a vendor-neutral cybersecurity awareness certification, similar in spirit to CompTIA’s foundational offerings but at a more introductory level.

This is unusual for a Microsoft certification. Whether Microsoft will add product-specific content as the exam moves closer to release remains to be seen, but the current blueprint focuses entirely on universal cybersecurity concepts and practices.

What this means for you

If you are a business user, this certification could be a great way to formalize your cybersecurity awareness. The skills covered are genuinely practical, from recognizing phishing emails to understanding why your IT department requires MFA. Unlike the AI-focused AB-730 and AB-731 business user certifications, which validated Copilot and AI skills, this one addresses security fundamentals that every professional needs.

If you are an IT professional or security specialist, this certification probably is not something you need to take yourself. However, it could become a powerful tool for your organization’s security awareness program. Instead of running yet another mandatory training session, you could encourage business users to study for and pass this certification. The motivation of earning a credential often drives deeper engagement with the material than passive training alone.

With the SC-730 beta expected in April 2026 and official training materials arriving in May 2026, now is the time to start planning. Keep an eye on the Microsoft Skills Hub Blog (opens in a new tab) for beta registration announcements and subscribe to my newsletter to stay updated.

Ready to plan your 2026 Microsoft certification path? While we wait for the cybersecurity business user certification to launch, explore the current landscape of Microsoft Copilot and AI credentials with my complete breakdown of the AB-900, AB-100, AB-730, and AB-731 certifications.