Microsoft SC-900: Security, Compliance, and Identity Fundamentals Exam Guide

Everything you need to know about the SC-900 certification exam, from preparation strategies to exam day tips.

Exam Information

60 minutes

Duration

40-60 questions

Questions

700/1000

Passing Score

$99 USD

Exam Cost

Recommended Study Plan

Week 1

Security, Compliance, and Identity Concepts

Describe the concepts of security, compliance, and identity

4-6 hours

Zero Trust model: assume breach, verify explicitly, least privilege
Shared responsibility model across cloud service types
Defense in depth: physical, identity, perimeter, network, compute, application, data
Identity as the primary security perimeter
Common threat types: phishing, ransomware, DDOS, social engineering
Encryption: symmetric, asymmetric, hashing
Authentication vs authorization
Compliance concepts: data residency, data sovereignty, data privacy

Recommended Resources:

Microsoft Learn

SC-900 Study Notes

Week 2

Microsoft Entra Capabilities

Describe the capabilities of Microsoft Entra

8-10 hours

Microsoft Entra ID (Azure AD): tenants, users, groups, licenses
Authentication methods: passwords, SSPR, MFA, FIDO2, Authenticator app
Conditional Access: signals, decisions, and policies
Microsoft Entra ID Protection: risk-based policies, sign-in risk
Entra Privileged Identity Management (PIM): just-in-time access, roles
Entitlement Management: access packages, catalogs, access reviews
External Identities: B2B collaboration, B2C
Microsoft Entra Verified ID and Permissions Management

Recommended Resources:

Microsoft Entra Docs

Microsoft Learn

Week 3

Microsoft Security Solutions

Describe the capabilities of Microsoft security solutions

10-12 hours

Azure DDoS Protection: Basic vs Standard tiers
Azure Firewall: threat intelligence filtering, FQDN rules
Web Application Firewall (WAF) on Application Gateway and Front Door
Microsoft Defender for Cloud: CSPM, CWPP, Secure Score, regulatory compliance
Microsoft Defender XDR: Defender for Endpoint, Office 365, Identity, Cloud Apps
Microsoft Sentinel: SIEM, SOAR, data connectors, analytics rules, playbooks
Azure Key Vault: secrets, keys, certificates
Microsoft Defender for DevOps and Microsoft Security Copilot

Recommended Resources:

Microsoft Defender Docs

Microsoft Sentinel Docs

Week 4

Microsoft Compliance Solutions + Review

Describe the capabilities of Microsoft compliance solutions

6-8 hours

Microsoft Purview compliance portal: overview and features
Sensitivity labels and label policies in Microsoft Purview
Data Loss Prevention (DLP): policies, endpoints, actions
Microsoft Purview Insider Risk Management
eDiscovery: Content Search, Core eDiscovery, Premium eDiscovery
Audit logs: Standard vs Premium audit
Compliance Manager: improvement actions, compliance score, assessments
Microsoft Service Trust Portal: audit reports, trust documents
Full-length practice exam and weak area review

Recommended Resources:

Microsoft Purview Docs

Service Trust Portal

CertStud Practice Exams

Exam Tips & Strategies

Focus on Service Identification

SC-900 heavily tests which Microsoft security or compliance service applies to a given scenario. Know the difference between Defender for Cloud (CSPM) vs Defender XDR (endpoint/threat detection) vs Sentinel (SIEM).

Time Management

You have 60 minutes for 40-60 questions. Budget about 1 minute per question. Flag uncertain questions and return to them — the foundational level means most questions are straightforward.

Leverage Free Microsoft Resources

The official SC-900 Microsoft Learn path covers every exam objective and is free. Attend a Microsoft Security Virtual Training Day to get a free exam voucher. Pair with CertStud practice questions.

Read Scenarios Carefully

Keywords matter: 'SIEM/SOAR' → Sentinel, 'cloud posture management' → Defender for Cloud, 'just-in-time privileged access' → PIM, 'sensitivity classification' → Purview sensitivity labels, 'compliance score' → Compliance Manager.

Key Topics to Master

Zero Trust model principles: verify explicitly, least privilege, assume breach

Shared responsibility model across IaaS, PaaS, SaaS

Microsoft Entra ID: authentication, MFA, SSPR, Conditional Access

Entra PIM: just-in-time role activation and access reviews

Microsoft Defender for Cloud: Secure Score, CSPM, CWPP

Microsoft Defender XDR suite: Endpoint, Office 365, Identity, Cloud Apps

Microsoft Sentinel: SIEM, SOAR, analytics rules, playbooks

Azure network security: DDoS Protection, Azure Firewall, WAF, NSG

Microsoft Purview: sensitivity labels, DLP, Compliance Manager

Service Trust Portal and compliance documentation resources

Recommended Study Plan

Week 1

Security, Compliance, and Identity Concepts

Describe the concepts of security, compliance, and identity

4-6 hours

Zero Trust model: assume breach, verify explicitly, least privilege
Shared responsibility model across cloud service types
Defense in depth: physical, identity, perimeter, network, compute, application, data
Identity as the primary security perimeter
Common threat types: phishing, ransomware, DDOS, social engineering
Encryption: symmetric, asymmetric, hashing
Authentication vs authorization
Compliance concepts: data residency, data sovereignty, data privacy

Recommended Resources:

Microsoft Learn

SC-900 Study Notes

Week 2

Microsoft Entra Capabilities

Describe the capabilities of Microsoft Entra

8-10 hours

Microsoft Entra ID (Azure AD): tenants, users, groups, licenses
Authentication methods: passwords, SSPR, MFA, FIDO2, Authenticator app
Conditional Access: signals, decisions, and policies
Microsoft Entra ID Protection: risk-based policies, sign-in risk
Entra Privileged Identity Management (PIM): just-in-time access, roles
Entitlement Management: access packages, catalogs, access reviews
External Identities: B2B collaboration, B2C
Microsoft Entra Verified ID and Permissions Management

Recommended Resources:

Microsoft Entra Docs

Microsoft Learn

Week 3

Microsoft Security Solutions

Describe the capabilities of Microsoft security solutions

10-12 hours

Azure DDoS Protection: Basic vs Standard tiers
Azure Firewall: threat intelligence filtering, FQDN rules
Web Application Firewall (WAF) on Application Gateway and Front Door
Microsoft Defender for Cloud: CSPM, CWPP, Secure Score, regulatory compliance
Microsoft Defender XDR: Defender for Endpoint, Office 365, Identity, Cloud Apps
Microsoft Sentinel: SIEM, SOAR, data connectors, analytics rules, playbooks
Azure Key Vault: secrets, keys, certificates
Microsoft Defender for DevOps and Microsoft Security Copilot

Recommended Resources:

Microsoft Defender Docs

Microsoft Sentinel Docs

Week 4

Microsoft Compliance Solutions + Review

Describe the capabilities of Microsoft compliance solutions

6-8 hours

Microsoft Purview compliance portal: overview and features
Sensitivity labels and label policies in Microsoft Purview
Data Loss Prevention (DLP): policies, endpoints, actions
Microsoft Purview Insider Risk Management
eDiscovery: Content Search, Core eDiscovery, Premium eDiscovery
Audit logs: Standard vs Premium audit
Compliance Manager: improvement actions, compliance score, assessments
Microsoft Service Trust Portal: audit reports, trust documents
Full-length practice exam and weak area review

Recommended Resources:

Microsoft Purview Docs

Service Trust Portal

CertStud Practice Exams

Exam Tips & Strategies

Focus on Service Identification

Time Management

You have 60 minutes for 40-60 questions. Budget about 1 minute per question. Flag uncertain questions and return to them — the foundational level means most questions are straightforward.

Leverage Free Microsoft Resources

The official SC-900 Microsoft Learn path covers every exam objective and is free. Attend a Microsoft Security Virtual Training Day to get a free exam voucher. Pair with CertStud practice questions.

Read Scenarios Carefully

Key Topics to Master

Zero Trust model principles: verify explicitly, least privilege, assume breach

Shared responsibility model across IaaS, PaaS, SaaS

Microsoft Entra ID: authentication, MFA, SSPR, Conditional Access

Entra PIM: just-in-time role activation and access reviews

Microsoft Defender for Cloud: Secure Score, CSPM, CWPP

Microsoft Defender XDR suite: Endpoint, Office 365, Identity, Cloud Apps

Microsoft Sentinel: SIEM, SOAR, analytics rules, playbooks

Azure network security: DDoS Protection, Azure Firewall, WAF, NSG

Microsoft Purview: sensitivity labels, DLP, Compliance Manager

Service Trust Portal and compliance documentation resources

Quick Feedback

Microsoft SC-900: Security, Compliance, and Identity Fundamentals Exam Guide

Exam Information

Recommended Study Plan

Exam Tips & Strategies

Focus on Service Identification

Time Management

Leverage Free Microsoft Resources

Read Scenarios Carefully

Key Topics to Master

Microsoft SC-900: Security, Compliance, and Identity Fundamentals Exam Guide

Exam Information

Recommended Study Plan

Exam Tips & Strategies

Focus on Service Identification

Time Management

Leverage Free Microsoft Resources

Read Scenarios Carefully

Key Topics to Master