Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) is the first gate in the Microsoft security certification lineup. It is not a test of configuring firewalls or writing detection rules. It is a Fundamentals-level certification that checks whether you can tell which Microsoft service answers which threat and which tool meets which compliance requirement, so you can take it on without hands-on security experience.
This post is the guide to our 8-part SC-900 domain deep-dive series. Before getting into individual topics, it maps out the exam structure, who should take it, and where this certification sits on the Azure career path.
---
Who Is SC-900 For?
SC-900 does not ask whether you can stop an intrusion yourself. It asks whether you know which desk checks badges, which one watches the cameras, and which one manages the document retention rules. You do not have to be a security guard to use a building safely, as long as you know which desk to ask about what.
This certification is a particularly good fit for the following people.
| Target Audience | Why It Fits | |------|------| | Non-technical roles (sales, planning, legal, compliance, audit) | Connect security and compliance requirements to the right Microsoft service names in discussions | | IT newcomers and students | Get the lay of the land before starting a security career | | Microsoft 365 and Azure administrators | Put structure around the Entra ID, Defender, and Purview features you already use | | People moving into security roles | The step before Associate certifications such as SC-300 and SC-200 | | Managers and decision makers | Understand Zero Trust and the shared responsibility model well enough to justify security investments |
There are no prerequisite certifications or required courses, and Fundamentals certifications do not expire. Microsoft does assume candidates are familiar with Azure and Microsoft 365, however, so if you have never used either, it is easier to pick up the basic terms first with the AZ-900 guide.
---
Exam at a Glance
| Item | Detail | |------|------| | Exam Code | SC-900 | | Full Name | Microsoft Certified: Security, Compliance, and Identity Fundamentals | | Level | Fundamentals (beginner) | | Passing Score | 700 (out of 1,000) | | Duration | 45 minutes (65 minutes of seat time including instructions and agreements) | | Questions | Varies (Microsoft does not publish an exact question count) | | Exam Fee | Varies by country ($99 USD in the United States) | | Validity | Does not expire (no renewal needed) | | Languages | 13 languages, including English | | Delivery | Pearson VUE test center or online proctored exam | | Prerequisites | None |
With only 45 minutes, you cannot afford to linger on any single question. The safe approach is to mark a confusing question for review, move on, and come back at the end. If you fail, you can retake the exam after 24 hours; every attempt after that requires a 14-day wait, with a maximum of five attempts in a 12-month period.
---
Domain Breakdown
SC-900 is made up of four domains, and the weight of each is published as a range. The breakdown below follows the official skills outline that takes effect on October 21, 2026.
| Domain | Topic | Weight | Deep dives | |------|------|------|------| | Domain 1 | Describe the concepts of security, compliance, and identity | 10–15% | 1 post | | Domain 2 | Describe the capabilities of Microsoft Entra | 25–30% | 2 posts | | Domain 3 | Describe the capabilities of Microsoft security solutions | 35–40% | 2 posts | | Domain 4 | Describe the capabilities of Microsoft compliance solutions | 20–25% | 3 posts |
Domain 3 carries the most weight at 35–40%. It also names the most services, from Azure network security to Defender for Cloud, Microsoft Sentinel, and Defender XDR, so it deserves the largest share of your study time. Domain 1 is small at 10–15%, but the Zero Trust, authentication, and authorization concepts it covers are the foundation for the other three, so do not skip it.
!SC-900 exam domain weight breakdown across 4 domains
Domain 1: Describe the concepts of security, compliance, and identity (10–15%)
This domain tests concepts rather than services. The other three domains are all built on this vocabulary, so study it first.
Key topics: The shared responsibility model; defense in depth; Zero Trust; encryption and hashing; governance, risk, and compliance (GRC); authentication and authorization; identity providers; directory services and Active Directory; federation.
Exam tip: Verifying "who are you?" is authentication; deciding "what can you do?" is authorization. Also keep straight that encryption can be reversed with a key while hashing cannot be reversed.
Related posts: Security, Compliance, and Identity Core Concepts
Domain 2: Describe the capabilities of Microsoft Entra (25–30%)
This domain covers Microsoft Entra, Microsoft's identity and access management service. It is easiest to learn as a flow: which features get involved, in order, before a single sign-in is allowed through.
Key topics: Microsoft Entra ID; identity types, including workload identities; hybrid identity; authentication methods and MFA; password protection; Conditional Access; Entra roles and RBAC; ID Governance; access reviews; Privileged Identity Management (PIM); ID Protection.
Exam tip: "Grant admin rights only for the time they are needed" → PIM. "Automatically detect risky sign-ins" → ID Protection. "Allow or block access based on conditions" → Conditional Access.
Related posts: Microsoft Entra ID and Authentication, Access Management and Identity Governance
Domain 3: Describe the capabilities of Microsoft security solutions (35–40%)
This domain covers Azure infrastructure security services and Microsoft's threat detection and response products. The product names are similar, which makes it the easiest domain to get confused in.
Key topics: Azure DDoS Protection; Azure Firewall; Web Application Firewall (WAF); network security groups (NSGs); Azure Bastion; Azure Key Vault; Microsoft Defender for Cloud and CSPM; Microsoft Sentinel (SIEM and SOAR); Microsoft Defender XDR (Defender for Office 365, Endpoint, Cloud Apps, and Identity); the Defender portal.
Exam tip: "Collect logs from many sources, detect threats, and automate the response" → Microsoft Sentinel. "Show the security posture of Azure resources as a score and give recommendations" → Defender for Cloud. "See an attack across email, endpoints, identities, and apps as one incident" → Defender XDR.
Related posts: Azure Security Services, Microsoft Sentinel and Defender XDR
Domain 4: Describe the capabilities of Microsoft compliance solutions (20–25%)
This domain covers the tools, centered on Microsoft Purview, for classifying and protecting data and for managing your compliance posture.
Key topics: Service Trust Portal and Microsoft's privacy principles; the Purview portal; Compliance Manager and compliance score; data classification; sensitivity labels; data loss prevention (DLP); records management and retention policies; insider risk management; eDiscovery; audit.
Exam tip: "Find Microsoft's audit reports and compliance documents" → Service Trust Portal. "Assess our own organization's compliance posture as a score" → Compliance Manager. "Stop sensitive information from leaving the organization" → DLP.
Related posts: Service Trust Portal and Privacy, Purview Compliance and Information Protection, Insider Risk, eDiscovery, and Audit
---
Where SC-900 Fits in the Microsoft Security Certification Path
Microsoft security certifications also climb from Fundamentals to Associate to Expert. SC-900 is the starting point.
| Category | SC-900 | SC-300 | SC-100 | |------|------|------|------| | Level | Fundamentals | Associate | Expert | | Full Name | Security, Compliance, and Identity Fundamentals | Identity and Access Administrator Associate | Cybersecurity Architect Expert | | Main Audience | Any role, including non-technical | Administrators who design and operate identity and access with Microsoft Entra | Architects who design security strategy for the whole organization | | Prerequisite Certification | None | None | One Associate security certification required (such as SC-300 or SC-200) | | Validity | Does not expire | 1 year (free online renewal) | 1 year (free online renewal) |
The concepts you pick up in SC-900, such as Zero Trust, Conditional Access, Defender, and Purview, are assumed knowledge in the higher-level certifications. For identity and access management the next step is SC-300; for security operations, where you detect and respond to threats, it is SC-200 (Security Operations Analyst Associate). If your Azure fundamentals feel thin, read the AZ-900 guide alongside this one, and to extend into hands-on Azure operations see the AZ-104 guide.
---
Study Roadmap for Beginners
A step-by-step study order for people learning security for the first time.
Step 1 (3–5 days): Get the concepts down. Start with Domain 1's Zero Trust, defense in depth, and authentication versus authorization. It is a small domain, but everything after it uses these terms.
Step 2 (Week 2): Learn Microsoft Entra. Sketch how a single access request gets through in order (sign-in → MFA → Conditional Access → role assignment), then layer PIM, access reviews, and ID Protection on top.
Step 3 (Weeks 3–4): Sort out the security solutions. This is the heaviest domain. Build a table organized by "what does it protect?" covering Azure network security (DDoS Protection, Firewall, NSGs, Bastion), Defender for Cloud, Sentinel, and Defender XDR.
Step 4 (Week 5): Compliance and practice questions. Organize Purview's capabilities in the order "classify → protect → retain → investigate," then use the Practice Assessment on Microsoft Learn to find your weak domains.
The most common mistake is memorizing everything named Defender as o