SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is a 45-minute beginner exam, passed with a score of 700 or higher, covering four areas: security and identity concepts, Microsoft Entra, Microsoft security solutions and Microsoft compliance solutions. You can prepare using only free material from Microsoft Learn, and about two weeks of daily study is a workable plan for someone who already knows the basics of Azure and Microsoft 365.
This guide is for business stakeholders, students and IT professionals new to security who want a clear route through the official outline. By the end you will know the exam facts, the weighting of each skill area, what to study inside each one, which free resources to use and how to spread the work over 14 days. Everything below is based on Microsoft's SC-900 certification page and study guide, with the skills measured as of 21 October 2026. Microsoft updates exams periodically, so check the study guide for the version that applies on your exam date.
Exam facts
| Item | Detail |
|---|---|
| Exam | SC-900: Microsoft Security, Compliance, and Identity Fundamentals |
| Level | Beginner |
| Time | 45 minutes |
| Pass mark | 700 or greater |
| Delivery | Proctored; may include interactive components |
| Booking | Pearson VUE, or Certiport for students and educators |
| Languages | English, Japanese, Chinese (Simplified and Traditional), Korean, French, Spanish, Portuguese (Brazil), Russian, Arabic (Saudi Arabia), Indonesian, German and Italian |
| Price | Depends on the country or region where you take the exam |
| Retake | 24 hours after the first attempt; later waits vary |
Microsoft strongly recommends registering with a personal Microsoft account. If you register with a work or school account, your exam records will be lost if you leave the organisation and cannot be recovered. If your preferred language is not offered, the study guide says you can request an additional 30 minutes. Accommodations can be requested through Microsoft.
Skills measured
The study guide lists four areas with these weights:
| Skill area | Weight |
|---|---|
| Describe the concepts of security, compliance, and identity | 10-15% |
| Describe the capabilities of Microsoft Entra | 25-30% |
| Describe the capabilities of Microsoft security solutions | 35-40% |
| Describe the capabilities of Microsoft compliance solutions | 20-25% |
Microsoft notes that the bullets illustrate how each skill is assessed and related topics may appear. Most questions cover generally available features, although preview features commonly used can appear.
Concepts of security, compliance and identity (10-15%)
- Security and compliance: the shared responsibility model, defence in depth, the Zero Trust model, encryption and hashing, and governance, risk and compliance concepts.
- Identity: identity as the primary security perimeter, authentication, authorisation, identity providers, directory services and Active Directory, and federation.
This is the smallest area but supports everything else. Make sure you can explain the difference between authentication and authorisation in one sentence each.
Microsoft Entra (25-30%)
- Entra ID functions and identity types, including workload identities, and hybrid identity.
- Authentication: methods, multifactor authentication, and password protection and management.
- Access management: Conditional Access, and Entra roles and role-based access control.
- Identity protection and governance: Entra ID Governance, access reviews, Privileged Identity Management and ID Protection.
For a practical view of the policy side, what Conditional Access policies do when they block a sign-in and using the What If tool show the same ideas in a live tenant.
Microsoft security solutions (35-40%)
This is the largest area. It has four groups:
- Core Azure infrastructure security: Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation with virtual networks, network security groups, Azure Bastion and Azure Key Vault.
- Azure security management: Microsoft Defender for Cloud, cloud security posture management, how security policies, standards and recommendations improve posture, and enhanced cloud workload protection.
- Microsoft Sentinel: SIEM and SOAR concepts, and threat detection and mitigation.
- Microsoft Defender XDR: the services in the suite, including Defender for Office 365, Endpoint, Cloud Apps, Identity and Vulnerability Management, plus Microsoft Threat Intelligence and the Defender portal.
Because this is over a third of the exam, give it the most time. A useful habit is to write one line per product: what it protects and what it does.
Microsoft compliance solutions (20-25%)
- The Service Trust Portal and Microsoft's privacy principles.
- Microsoft Purview compliance management: the Purview portal, Compliance Manager and compliance score.
- Information protection, data lifecycle and governance: data classification, Content explorer and Activity explorer, sensitivity labels and policies, data loss prevention, records management, and retention policies and labels.
- Insider risk management, eDiscovery and audit in Purview.
What changed on 21 October 2026
The study guide's change log marks only two minor changes: the Entra ID function and identity types group, and the Defender XDR group. If you used an older outline, re-read those two sections.
Free resources
- The exam page on Microsoft Learn: it links to learning paths and modules, the study guide, and instructor-led options.
- Learning paths: the exam page lists self-paced paths aligned with the skill areas, including Introduction to security, compliance, and identity concepts and Introduction to Microsoft security solutions. Check the exam page for the Entra and compliance paths and their current titles.
- Practice assessment: free, and it shows the style, wording and difficulty of questions. Use it to find gaps, not to memorise answers.
- Exam sandbox: lets you try the question types and interface before the day.
- Documentation listed in the study guide: Microsoft security documentation, Azure security documentation, Entra ID documentation, Microsoft Sentinel, Microsoft 365 Defender, Microsoft Purview and the Service Trust Portal.
- Exam Readiness Zone and Microsoft Learn Shows for video explanations.
- Microsoft Q&A and the security, compliance and identity community hub for questions.
A 2-week plan
This plan assumes about an hour on weekdays and a longer session at weekends. Adjust it to your experience.
| Days | Focus | Output |
|---|---|---|
| 1-2 | Concepts: shared responsibility, defence in depth, Zero Trust, encryption and hashing, identity basics | One-page glossary |
| 3-5 | Entra: identity types, hybrid identity, authentication methods, MFA, Conditional Access, roles, PIM, ID Protection | A table of each feature and what problem it solves |
| 6-9 | Security solutions: Azure network services, Key Vault, Defender for Cloud, Sentinel, Defender XDR products | One line per product: what it protects |
| 10-12 | Compliance: Service Trust Portal, Compliance Manager, sensitivity labels, DLP, retention, insider risk, eDiscovery, audit | A comparison of labels, DLP and retention |
| 13 | Take the free practice assessment under timed conditions | List of weak topics |
| 14 | Review weak topics, try the exam sandbox, check the booking details | Ready for exam day |
Study habits that help
- Compare similar products: sensitivity labels versus retention labels, Azure Firewall versus WAF, Defender for Cloud versus Defender for Cloud Apps.
- Where possible, click through the portals in a trial tenant so the names stick.
- Keep a list of terms you confuse and review it daily.
- After the practice assessment, read the documentation on every topic you missed rather than retaking until the questions repeat.
On exam day
Check the Pearson VUE or Certiport instructions for proctoring, ID and room requirements before the day. You have 45 minutes, so do not spend too long on a single question. If you do not pass, you can retake after 24 hours, and the retake policy page explains waits after that.
Checklist
- Read the current skills measured in the study guide
- Register with a personal Microsoft account
- Complete the Learn paths for all four skill areas
- Build a one-line summary for every product named in the outline
- Take the practice assessment and the sandbox
- Review the two areas changed on 21 October 2026
- Confirm the booking, ID and proctoring rules
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.