If you've been running Intune and Entra ID for a couple of years — deploying compliance policies, fixing Autopilot failures, writing Conditional Access rules because nobody else will — you've probably typed "cybersecurity certification path 2026" into a search bar at some point. You get back a hundred lists ranking CISSP against CEH against Security+, written for someone who has never touched a tenant. None of it tells you what to do with the identity and endpoint experience you already have.
This post is that missing piece. If you've already read our MD-102 exam guide or hold that certification, you're not starting from zero — you're starting from a genuinely useful base. The question isn't "how do I get into cybersecurity," it's "what's the next cert that actually uses what I already know." Here's the answer, in order, with the reasoning shown.
If you already run Intune and Entra ID day to day, skip SC-900 and go straight for SC-300 (Identity and Access Administrator Associate) — it's the direct extension of your current job. From there, branch: pick SC-200 if you want to move toward detection and incident response (Defender/XDR), or the new SC-500 if you want broader cloud and AI security engineering — note AZ-500 is retiring on August 31, 2026 and SC-500 is its replacement. Skip CompTIA Security+ unless you're coming from outside the Microsoft stack entirely, and skip any cert that doesn't map to a role you can actually see posted in your market.
The problem: acronym soup and no clear order
Search interest in "cybersecurity career path" and identity-focused Microsoft certifications has been climbing for a couple of years running — industry roundups (Feedspot's influencer and trend coverage among them) keep flagging identity and access management as one of the most searched-for corners of the security world, alongside general "how do I move from IT into security" content. That's not a controversial claim: LinkedIn is full of "day one of studying for X" posts, and every Microsoft-adjacent subreddit has a weekly "which cert next" thread. The demand is real. The advice given in response usually isn't.
Most of that advice defaults to one of two failure modes. Either it's generic "cybersecurity career" content that assumes you're starting from a help desk job with zero platform experience — so it sends you off to CompTIA Security+ and a pile of vendor-neutral fundamentals you've effectively already learned by running production Intune policies. Or it's acronym-chasing: a list of every SC-, AZ-, and MS- exam Microsoft has ever published, with no explanation of which ones overlap, which ones are about to be retired, and which ones actually correspond to a job you could get hired into from where you're standing today.
Why it happens: Microsoft's catalog wasn't built for your career move
Microsoft organizes its certification catalog by role and product team, not by career transition. There's no official page that says "here's what an Intune admin does next." SC-900, SC-300, SC-200, and the exam that used to be AZ-500 all sit in the same "Security" bucket on Microsoft Learn, with no ordering logic beyond "fundamentals, then associate-level, then whatever's next" — and that ordering assumes you're starting from nothing, which you aren't.
It gets messier right now because the catalog itself is mid-change. Exam AZ-500 (Azure Security Engineer Associate) — for years the default "next step up" from identity certs — is retiring on August 31, 2026, according to its own Microsoft Learn certification page. Its replacement is Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, leading to the new Microsoft Certified: Cloud and AI Security Engineer Associate credential. SC-500 covers the same ground AZ-500 did — identity, network, compute, storage, security posture — plus a new layer for securing AI workloads and agents. If you've been planning around AZ-500, that plan is out of date as of this post.
The second reason the generic advice doesn't fit: most "cybersecurity career path" content is written with a SOC analyst or penetration tester in mind, because that's what most people picture when they hear "cybersecurity." Identity and access management is a different discipline with a different hiring market — closer to platform administration than to threat hunting, even though the two increasingly overlap. An Intune admin has a much shorter runway into an identity role than into, say, a detection engineering role, purely because half the underlying platform (Entra ID) is already part of the day job.
How to verify: audit yourself against the SC-300 skills list, not a badge
Before you book anything, do an honest skills audit — against the actual exam objectives, not against a certificate you don't have yet. Microsoft publishes the full skills-measured breakdown for every exam on its SC-300 study guide. Pull it up and rate yourself honestly against each domain based on what you've actually done in production, not what you've read about.
| SC-300 domain (weight) | What it covers | Typical Intune/MD-102 admin's starting point |
|---|---|---|
| Implement and manage user identities (20–25%) | Entra roles, admin units, hybrid identity (Entra Connect Sync/Cloud Sync), external collaboration | Partial — you know user/group basics and device join, hybrid sync is often a gap |
| Implement authentication and access management (20–25%) | MFA, Conditional Access, Windows Hello for Business, ID Protection, Global Secure Access | Strong — this overlaps heavily with day-to-day Intune/Entra compliance work |
| Plan and implement workload identities (20–25%) | Managed identities, service principals, app registrations, enterprise app integration, Defender for Cloud Apps | Weak — this is usually new territory for a device-focused admin |
| Plan and automate identity governance (20–25%) | Entitlement management, access reviews, Privileged Identity Management (PIM), audit/KQL monitoring | Weak to none — PIM and access packages rarely come up in pure device management |
If that table shows you strong on two domains and weak on two, that's normal and exactly why SC-300 is worth taking rather than skipping — it fills real gaps, not decorative ones. If you score yourself weak across all four domains, you may not have the hands-on Entra exposure this post assumes, and Microsoft's SC-900 (Security, Compliance, and Identity Fundamentals) becomes a reasonable warm-up rather than a waste of a day.
Be honest about the SC-900 question specifically, because this is where people waste the most time. SC-900 is a 45-minute, beginner-level exam covering the basic vocabulary of security, compliance, and identity — described on its own Microsoft Learn certification page as being for "business stakeholders, new or existing IT professionals, or students" who want to "familiarize" themselves with the fundamentals. If you can already explain what Conditional Access does, what Entra ID Protection risk scoring is, and the difference between authentication and authorization without looking it up, you already know more than SC-900 tests. Skip it and go straight to SC-300.
The fix: the actual order, given you already know Intune
Here's the sequencing, assuming you're working full time as an Intune/endpoint admin and studying around a job — not quitting to study for two years.
That's roughly two to three months to SC-300 studying part-time, then a branch decision three to five months out — not a two-year plan. The reason this works is that SC-300's authentication and access management domain is largely a formalization of what a competent Intune/Entra admin already does; you're not starting from a blank page the way a help-desk-to-security newcomer would be.
Now the blunt part: what to actively ignore. CompTIA Security+ is a legitimate baseline certification, and if you're reading this as someone with no Microsoft platform background at all — coming from a general helpdesk or networking role with no Intune or Entra experience — it's a reasonable place to build vendor-neutral fundamentals before jumping into Microsoft's associate-level exams. But if you already hold MD-102 or work daily in Intune and Entra, Security+ tests ground you've already covered from the Microsoft side, at a lower altitude. Don't add it to the plan just because it appears on every "top certifications" listicle.
Proof it worked: what the move actually looks like
Here's what this transition looks like in practice for admins who've made it — not a personal success story, just the pattern that shows up consistently. Before: your title is Endpoint Administrator or Intune Administrator. Your day is device compliance policies, app deployment, Autopilot troubleshooting, and the occasional Conditional Access tweak because someone has to own it. Identity work is a side effect of your job, not the center of it.
After SC-300 and six months of applying it: you own Conditional Access design rather than just tweaking existing policies. You've built at least one access package in entitlement management instead of manually adding people to security groups. You've configured PIM for at least one privileged role instead of leaving people permanently assigned as Global Admin because "it's easier." You can read a sign-in log and explain why Entra ID Protection flagged a session as risky, not just that it did. That's the before/after that shows up in interviews — specific, demonstrable capabilities, not just a credential line on a CV.
| Capability | Intune/MD-102 admin (before) | Identity and access admin (after SC-300 + practice) |
|---|---|---|
| Conditional Access | Applies existing policies, adjusts device compliance conditions | Designs new policies, uses authentication context and continuous access evaluation |
| Access to resources | Adds users to security groups manually | Builds access packages and catalogs in entitlement management |
| Privileged accounts | Standing admin role assignments | Time-bound, approval-gated access via PIM |
| Risk signals | Relies on device compliance status only | Reads and acts on Entra ID Protection risky sign-in/user reports |
| Job title on the market | Endpoint Administrator, Intune Administrator | Identity and Access Administrator, Identity Security Engineer |
The title change is the visible marker, but it's downstream of the capability change, not the other way around. Nobody hires you into an identity role because you have a badge; they hire you because you can now do the four things in that right-hand column, and the badge is how they verify it before the interview.
References
- Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) — Microsoft Learn
- Microsoft Certified: Identity and Access Administrator Associate (SC-300) — Microsoft Learn
- Study guide for Exam SC-300 — Microsoft Learn
- Microsoft Certified: Security Operations Analyst Associate (SC-200) — Microsoft Learn
- Microsoft Certified: Azure Security Engineer Associate (AZ-500, retiring August 31, 2026) — Microsoft Learn
- Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500) — Microsoft Learn
Microsoft MVP community deep-dives
| Author | Post | What it adds |
|---|---|---|
| Nathan McNulty | Managing Restricted Groups with Access Packages | Hands-on walkthrough of entitlement management and administrative units working together — exactly the "identity governance" domain that's usually the weakest spot for admins coming from a device-management background |