SC-900: Microsoft Security, Compliance, and Identity Fundamentals
Demonstrate foundational knowledge of Microsoft security, compliance, and identity (SCI) concepts, Entra ID access management, Microsoft Defender, Microsoft Sentinel, and Purview governance.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Recommended Study Guides & Exam Preparation Blueprints
Reinforce your knowledge with domain breakdowns, trap question analyses, and architectural cheat sheets:
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The SC-900 exam consists of 40-60 multiple-choice questions over 45-60 minutes. The registration fee is $99 USD, and the passing score is 700/1000 (70%).
The exam tests four functional pillars: (1) Describe security and compliance concepts (~10-15%), (2) Describe Microsoft identity and access management solutions (~25-30%), (3) Describe Microsoft security solutions (~35-40%), and (4) Describe Microsoft compliance solutions (~20-25%).
Zero Trust operates under three core principles: (1) Verify explicitly (always authenticate and authorize based on all available data points), (2) Use least privilege access (limit user access with Just-In-Time and Just-Enough-Access), and (3) Assume breach (minimize blast radius and segment access).
On-premises Active Directory uses Kerberos, NTLM, and LDAP protocols within internal corporate perimeters. Microsoft Entra ID is a cloud identity service using modern protocols (SAML, WS-Federation, OpenID Connect, OAuth 2.0) designed for internet-accessible SaaS, cloud resources, and mobile devices.
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that evaluates configurations against security benchmarks and detects real-time threats across Azure, AWS, GCP, and on-premises hybrid servers.
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests enterprise-wide telemetry, analyzes threats using machine learning, and automates incident remediation using playbooks.
Conditional Access serves as the intelligent policy engine for Zero Trust. It evaluates incoming signals (user identity, IP location, device compliance, client app, risk score) and applies controls like requiring MFA, blocking access, or requiring compliant devices.
Microsoft Entra Privileged Identity Management (PIM) provides time-based and approval-based role activation (Just-In-Time access). Administrators must request activation for privileged roles (e.g., Global Admin), complete MFA, and provide justification rather than having perpetual administrative rights.
Microsoft Purview is a comprehensive suite of data governance and compliance solutions that provides data classification, sensitivity labels, Data Loss Prevention (DLP), insider risk management, eDiscovery, and compliance auditing across multicloud data estates.
Sensitivity labels classify and protect documents and emails by applying visual markings (watermarks, headers/footers) and encrypting files so that only authorized users can open them, regardless of where the file travels.
Like all Microsoft Fundamentals certifications, SC-900 does not expire and does not require annual renewal.
SC-900 is ideal for IT professionals, business decision makers, security administrators, and students looking to establish a comprehensive foundational understanding of cybersecurity, identity, and compliance across Microsoft environments.