# SC-900 Study Guide: Skills Measured, Free Resources and a 2-Week Plan

> Prepare for Microsoft SC-900 with the official skills outline as of 21 October 2026, the weighting of each area, free Microsoft Learn resources and a two-week study plan.

Source: https://www.epifive.com/blog/sc-900-study-guide-security-compliance-identity · Published 2026-10-25 · EpiFive

## Key takeaways

- SC-900 gives you 45 minutes, and a score of 700 or greater is required to pass.
- The heaviest area is Microsoft security solutions at 35-40 percent, followed by Entra at 25-30 percent and compliance solutions at 20-25 percent.
- The skills outline last changed on 21 October 2026, with only minor changes to Entra identity types and Defender XDR.
- Microsoft provides free learning paths, a practice assessment and an exam sandbox, so no paid course is required to prepare.
- Use a personal Microsoft account to register, because exam records tied to a work or school account can be lost when you leave.

SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is a 45-minute beginner exam, passed with a score of 700 or higher, covering four areas: security and identity concepts, Microsoft Entra, Microsoft security solutions and Microsoft compliance solutions. You can prepare using only free material from Microsoft Learn, and about two weeks of daily study is a workable plan for someone who already knows the basics of Azure and Microsoft 365.

This guide is for business stakeholders, students and IT professionals new to security who want a clear route through the official outline. By the end you will know the exam facts, the weighting of each skill area, what to study inside each one, which free resources to use and how to spread the work over 14 days. Everything below is based on Microsoft's SC-900 certification page and study guide, with the skills measured as of 21 October 2026. Microsoft updates exams periodically, so check the study guide for the version that applies on your exam date.

## Exam facts

| Item | Detail |
|---|---|
| Exam | SC-900: Microsoft Security, Compliance, and Identity Fundamentals |
| Level | Beginner |
| Time | 45 minutes |
| Pass mark | 700 or greater |
| Delivery | Proctored; may include interactive components |
| Booking | Pearson VUE, or Certiport for students and educators |
| Languages | English, Japanese, Chinese (Simplified and Traditional), Korean, French, Spanish, Portuguese (Brazil), Russian, Arabic (Saudi Arabia), Indonesian, German and Italian |
| Price | Depends on the country or region where you take the exam |
| Retake | 24 hours after the first attempt; later waits vary |

Microsoft strongly recommends registering with a personal Microsoft account. If you register with a work or school account, your exam records will be lost if you leave the organisation and cannot be recovered. If your preferred language is not offered, the study guide says you can request an additional 30 minutes. Accommodations can be requested through Microsoft.

## Skills measured

The study guide lists four areas with these weights:

| Skill area | Weight |
|---|---|
| Describe the concepts of security, compliance, and identity | 10-15% |
| Describe the capabilities of Microsoft Entra | 25-30% |
| Describe the capabilities of Microsoft security solutions | 35-40% |
| Describe the capabilities of Microsoft compliance solutions | 20-25% |

Microsoft notes that the bullets illustrate how each skill is assessed and related topics may appear. Most questions cover generally available features, although preview features commonly used can appear.

### Concepts of security, compliance and identity (10-15%)

- Security and compliance: the shared responsibility model, defence in depth, the Zero Trust model, encryption and hashing, and governance, risk and compliance concepts.
- Identity: identity as the primary security perimeter, authentication, authorisation, identity providers, directory services and Active Directory, and federation.

This is the smallest area but supports everything else. Make sure you can explain the difference between authentication and authorisation in one sentence each.

### Microsoft Entra (25-30%)

- Entra ID functions and identity types, including workload identities, and hybrid identity.
- Authentication: methods, multifactor authentication, and password protection and management.
- Access management: Conditional Access, and Entra roles and role-based access control.
- Identity protection and governance: Entra ID Governance, access reviews, Privileged Identity Management and ID Protection.

For a practical view of the policy side, [what Conditional Access policies do when they block a sign-in](https://www.epifive.com/blog/aadsts53003-blocked-by-conditional-access) and [using the What If tool](https://www.epifive.com/blog/conditional-access-what-if-troubleshooting) show the same ideas in a live tenant.

### Microsoft security solutions (35-40%)

This is the largest area. It has four groups:

- Core Azure infrastructure security: Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation with virtual networks, network security groups, Azure Bastion and Azure Key Vault.
- Azure security management: Microsoft Defender for Cloud, cloud security posture management, how security policies, standards and recommendations improve posture, and enhanced cloud workload protection.
- Microsoft Sentinel: SIEM and SOAR concepts, and threat detection and mitigation.
- Microsoft Defender XDR: the services in the suite, including Defender for Office 365, Endpoint, Cloud Apps, Identity and Vulnerability Management, plus Microsoft Threat Intelligence and the Defender portal.

Because this is over a third of the exam, give it the most time. A useful habit is to write one line per product: what it protects and what it does.

### Microsoft compliance solutions (20-25%)

- The Service Trust Portal and Microsoft's privacy principles.
- Microsoft Purview compliance management: the Purview portal, Compliance Manager and compliance score.
- Information protection, data lifecycle and governance: data classification, Content explorer and Activity explorer, sensitivity labels and policies, data loss prevention, records management, and retention policies and labels.
- Insider risk management, eDiscovery and audit in Purview.

### What changed on 21 October 2026

The study guide's change log marks only two minor changes: the Entra ID function and identity types group, and the Defender XDR group. If you used an older outline, re-read those two sections.

## Free resources

- The exam page on Microsoft Learn: it links to learning paths and modules, the study guide, and instructor-led options.
- Learning paths: the exam page lists self-paced paths aligned with the skill areas, including Introduction to security, compliance, and identity concepts and Introduction to Microsoft security solutions. Check the exam page for the Entra and compliance paths and their current titles.
- Practice assessment: free, and it shows the style, wording and difficulty of questions. Use it to find gaps, not to memorise answers.
- Exam sandbox: lets you try the question types and interface before the day.
- Documentation listed in the study guide: Microsoft security documentation, Azure security documentation, Entra ID documentation, Microsoft Sentinel, Microsoft 365 Defender, Microsoft Purview and the Service Trust Portal.
- Exam Readiness Zone and Microsoft Learn Shows for video explanations.
- Microsoft Q&A and the security, compliance and identity community hub for questions.

## A 2-week plan

This plan assumes about an hour on weekdays and a longer session at weekends. Adjust it to your experience.

| Days | Focus | Output |
|---|---|---|
| 1-2 | Concepts: shared responsibility, defence in depth, Zero Trust, encryption and hashing, identity basics | One-page glossary |
| 3-5 | Entra: identity types, hybrid identity, authentication methods, MFA, Conditional Access, roles, PIM, ID Protection | A table of each feature and what problem it solves |
| 6-9 | Security solutions: Azure network services, Key Vault, Defender for Cloud, Sentinel, Defender XDR products | One line per product: what it protects |
| 10-12 | Compliance: Service Trust Portal, Compliance Manager, sensitivity labels, DLP, retention, insider risk, eDiscovery, audit | A comparison of labels, DLP and retention |
| 13 | Take the free practice assessment under timed conditions | List of weak topics |
| 14 | Review weak topics, try the exam sandbox, check the booking details | Ready for exam day |

### Study habits that help

1. Compare similar products: sensitivity labels versus retention labels, Azure Firewall versus WAF, Defender for Cloud versus Defender for Cloud Apps.
2. Where possible, click through the portals in a trial tenant so the names stick.
3. Keep a list of terms you confuse and review it daily.
4. After the practice assessment, read the documentation on every topic you missed rather than retaking until the questions repeat.

## On exam day

Check the Pearson VUE or Certiport instructions for proctoring, ID and room requirements before the day. You have 45 minutes, so do not spend too long on a single question. If you do not pass, you can retake after 24 hours, and the retake policy page explains waits after that.

## Checklist

- Read the current skills measured in the study guide
- Register with a personal Microsoft account
- Complete the Learn paths for all four skill areas
- Build a one-line summary for every product named in the outline
- Take the practice assessment and the sandbox
- Review the two areas changed on 21 October 2026
- Confirm the booking, ID and proctoring rules

## References

- [Microsoft Certified: Security, Compliance, and Identity Fundamentals](https://learn.microsoft.com/en-us/credentials/certifications/security-compliance-and-identity-fundamentals/)
- [Study guide for Exam SC-900](https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-900)
- [Introduction to security, compliance, and identity concepts](https://learn.microsoft.com/en-us/training/paths/describe-concepts-of-security-compliance-identity/)
- [Introduction to Microsoft security solutions](https://learn.microsoft.com/en-us/training/paths/describe-capabilities-of-microsoft-security-solutions/)
- [Exam retake policy](https://learn.microsoft.com/en-us/credentials/support/retake-policy)

## Frequently asked questions

### How long is the SC-900 exam and what is the passing score?

Microsoft's exam page says you have 45 minutes to complete the assessment, and the study guide says a score of 700 or greater is required to pass. The exam is proctored and may include interactive components.

### Is there a free practice test for SC-900?

Yes. Microsoft offers a free practice assessment on the exam page, plus an exam sandbox that lets you try the question types and interface. The practice assessment shows the style and difficulty of questions but is not a copy of the exam.

### How long should I study for SC-900?

Microsoft does not publish a study time. For someone already familiar with Azure and Microsoft 365, a plan of about two weeks with daily Learn modules and a practice assessment is realistic, but adjust it to how comfortable you are with security concepts.

### Can I retake SC-900 if I fail?

Yes. Microsoft says you can retake a failed exam 24 hours after the first attempt. Waiting times for later retakes vary, so read the exam retake policy on Microsoft Learn before booking again.