Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals is Microsoft's entry-level security certification. It checks that you understand Zero Trust, identity and core security concepts, and what Microsoft's tools do: Microsoft Entra for identity, Defender XDR, Defender for Cloud and Sentinel for security, and Microsoft Purview for compliance. The skills measured were last updated on 21 October 2026. Students, freshers and non-IT professionals can take it without prior experience.
This guide follows the official study guide: four skill areas with weights, a simple map of Microsoft's security products, a 3-week plan and 15 original practice questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Certification | Microsoft Certified: Security, Compliance, and Identity Fundamentals |
| Level | Fundamentals (no prerequisites) |
| Passing score | 700 |
| Skills measured | As of 21 October 2026 (minor changes to Entra identity types and Defender XDR) |
| Practice | Free Practice Assessment on Microsoft Learn |
| Price | Based on the country where you take the exam (Pearson VUE); students often qualify for discounts |
Read the official SC-900 study guide before booking.
Who should take SC-900?
- Students and freshers starting a cyber security or cloud career.
- Non-IT graduates moving into IT. See our non-IT to software jobs page.
- Anyone planning SC-200, SC-300 or SC-500 later.
Skills measured and weights
| Skill area | Weight |
|---|---|
| Describe the concepts of security, compliance and identity | 10–15% |
| Describe the capabilities of Microsoft Entra | 25–30% |
| Describe the capabilities of Microsoft security solutions | 35–40% |
| Describe the capabilities of Microsoft compliance solutions | 20–25% |
1. Concepts (10–15%)
- Security and compliance: the shared responsibility model; defence in depth; Zero Trust (verify explicitly, least privilege, assume breach); encryption and hashing; governance, risk and compliance (GRC).
- Identity: identity as the main security perimeter; authentication vs authorisation; identity providers; directory services and Active Directory; federation.
2. Microsoft Entra (25–30%)
- Entra ID; identity types, including workload identities; hybrid identity.
- Authentication methods; MFA; password protection and management.
- Conditional Access; Entra roles and RBAC.
- ID Governance; access reviews; Privileged Identity Management; ID Protection.
3. Microsoft security solutions (35–40%)
The largest area. Know which product does what:
| Product | What it does |
|---|---|
| Azure DDoS Protection | Protects Azure resources from denial-of-service attacks |
| Azure Firewall | Managed, stateful network firewall |
| Web Application Firewall (WAF) | Blocks web attacks such as SQL injection and XSS |
| NSGs and VNet segmentation | Allow or deny traffic between subnets and VMs |
| Azure Bastion | RDP/SSH to VMs through the browser without public IPs |
| Azure Key Vault | Stores secrets, keys and certificates |
| Defender for Cloud | Cloud security posture management (CSPM) and workload protection |
| Microsoft Sentinel | Cloud SIEM and SOAR |
| Defender XDR | Unified protection across Office 365, Endpoint, Cloud Apps and Identity, plus Vulnerability Management and Threat Intelligence |
4. Microsoft compliance solutions (20–25%)
- Service Trust Portal; Microsoft's privacy principles.
- Microsoft Purview portal; Compliance Manager and compliance score.
- Data classification; Content explorer and Activity explorer; sensitivity labels; data loss prevention (DLP); records management; retention policies and labels.
- Insider risk management; eDiscovery; audit.
3-week study plan
| Week | Focus | Practice |
|---|---|---|
| 1 | Concepts (Zero Trust, shared responsibility, encryption) and Microsoft Entra | Microsoft Learn SC-900 path, modules 1–2; enable MFA on a free tenant |
| 2 | Azure security services, Defender for Cloud, Sentinel, Defender XDR | Learn path module 3; explore Defender for Cloud recommendations |
| 3 | Purview: labels, DLP, retention, insider risk, eDiscovery, audit | Learn path module 4; free Practice Assessment twice; book the exam |
15 practice questions with answers
These are original practice questions written for this guide, not exam questions.
1. In SaaS, who is always responsible for the data and identities?
The customer.
2. Which Zero Trust principle says "limit access to only what is needed"?
Use least-privilege access.
3. Proving who you are is called what?
Authentication. (Deciding what you can do is authorisation.)
4. Which service is Microsoft's cloud identity provider?
Microsoft Entra ID.
5. Access should require MFA only when users sign in from outside the office. Which feature?
Conditional Access.
6. Admins should get elevated roles only when needed, for a limited time. Which feature?
Privileged Identity Management (PIM).
7. Which service stores application secrets and certificates securely?
Azure Key Vault.
8. You need RDP access to VMs without exposing public IP addresses. Which service?
Azure Bastion.
9. Which service gives a secure score and recommendations for Azure resources?
Microsoft Defender for Cloud.
10. Which Microsoft product is a cloud-native SIEM and SOAR?
Microsoft Sentinel.
11. Which Defender product protects email from phishing?
Microsoft Defender for Office 365.
12. Documents marked Confidential should be encrypted wherever they go. What do you use?
Sensitivity labels in Microsoft Purview.
13. Credit card numbers must not be emailed outside the company. Which feature?
Data loss prevention (DLP).
14. Legal must find all emails about a case and place them on hold. Which solution?
eDiscovery in Microsoft Purview.
15. Where can you read Microsoft's audit reports and compliance documents?
The Service Trust Portal.
After SC-900
- Choose a role-based path: SC-200 (SOC analyst), SC-300 (identity) or SC-500 (cloud security). For a vendor-neutral option, see CompTIA Security+.
- Read AI, cloud and cyber security skills.
- See live jobs for freshers.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches cyber security, Azure security and SOC operations for freshers and non-IT learners with hands-on labs. See the APEX AI, ML, Cloud and Cyber Security program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
Is SC-900 good for freshers?
Yes. It is a fundamentals exam with no prerequisites, aimed at students, new IT professionals and business stakeholders.
What is the SC-900 passing score?
700.
Which SC-900 skill area has the most weight?
Describe the capabilities of Microsoft security solutions, at 35–40%.
When were the SC-900 skills last updated?
The current skills measured apply as of 21 October 2026.
What should I take after SC-900?
A role-based exam such as SC-200 (SOC analyst), SC-300 (identity) or SC-500 (cloud and AI security).
Does SC-900 cover Microsoft Purview?
Yes. Compliance solutions, including sensitivity labels, DLP, retention, insider risk, eDiscovery and audit, are 20–25% of the exam.
