Training course

This is a free, self-paced reading course for SC-900: Microsoft Security, Compliance, and Identity Fundamentals, the entry point to Microsoft’s security certification stack, and an exam that asks you to describe capabilities rather than configure them. That verb matters. SC-900 is won and lost on vocabulary: knowing that Defender for Cloud and Defender for Cloud Apps are different products solving different problems, that a sensitivity label and a retention label answer different questions about the same document, that Secure Score and Compliance Score measure different things. This course is written to build that vocabulary in order, so the distinctions land before you start drilling questions.

The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain’s published weight. That structure keeps your effort proportional to the exam’s: the Microsoft security solutions domain alone is 35-40% of SC-900, and it is the largest module here. Every lesson ends with its key terms and suggested further reading, which matters more on a concept exam than on a hands-on one. The terms are the material. The course works as a glossary you come back to as well as a syllabus you read through once.

SC-900 Fundamentals level 4 modules Domain-weighted Self-paced Free account

What the course covers

Describe the concepts of security, compliance, and identity

Module 1 · 10-15%

The foundations the rest of the exam leans on: security methodologies including Zero Trust and defense in depth, the shared responsibility model, encryption and hashing, and the basics of governance, risk, and compliance. Then the identity groundwork, authentication versus authorization, identity providers, directory services, federation, and why the perimeter moved from the network to the identity.

Describe the capabilities of Microsoft Entra

Module 2 · 25-30%

The identity control plane. Microsoft Entra ID as an identity provider; hybrid identity through password hash synchronization, pass-through authentication, and AD FS; authentication methods including MFA, FIDO2, Windows Hello for Business, and Temporary Access Pass; Conditional Access; Entra ID Protection and its sign-in and user risk signals; Privileged Identity Management, entitlement management, and access reviews; External ID for B2B collaboration; lifecycle workflows; and which capabilities sit in the Free, P1, and P2 licensing tiers.

Describe the capabilities of Microsoft security solutions

Module 3 · 35-40%

The largest domain, covered in four passes. Azure network security: DDoS Protection, Azure Firewall, Web Application Firewall, Bastion, network security groups, VNet segmentation, and Key Vault. Defender for Cloud, cloud security posture management, workload protection, Secure Score, the regulatory compliance dashboard, and multi-cloud connectors. Microsoft Sentinel as combined SIEM and SOAR, with data connectors, analytics rules, workbooks, playbooks, and KQL. And Microsoft Defender XDR: Defender for Endpoint, Office 365, Identity, and Cloud Apps, plus Defender Threat Intelligence and Vulnerability Management.

Describe the capabilities of Microsoft compliance solutions

Module 4 · 20-25%

Microsoft Purview and the wider trust posture: the Service Trust Portal, Microsoft’s privacy principles, and Compliance Manager with its Compliance Score. Then the data-governance toolkit, sensitive information types and trainable classifiers, Content explorer and Activity explorer, sensitivity labels set against retention labels, data loss prevention, records management, insider risk management, eDiscovery in its Standard and Premium forms, and Audit Standard versus Audit Premium retention.

How to use it

Read a module, then test that domain immediately rather than saving all the questions for the end. On a concept exam the gap between “I have read this” and “I can pick this out of four plausible options” is wide, and only questions expose it. The free SC-900 sample is the quickest way to see what that feels like; the full SC-900 practice exam is where you work until you are clearing every domain rather than carrying a weak one on the back of a strong one. Pay particular attention to items where two Microsoft products could both plausibly be the answer, that is where SC-900 does most of its discriminating. The course modules themselves open once you are signed in to a free Certifym account.

You do not need an Azure subscription to pass this exam, but a free tenant helps the names stick: seeing Conditional Access and a sensitivity label in the portal once turns an abstraction into an object. For exam logistics (length, question count, the 700 out of 1000 pass mark, pricing, and the renewal policy for fundamentals credentials) see the SC-900 certification guide.

SC-900: Microsoft Security, Compliance, and Identity Fundamentals

One module per SC-900 exam domain, weighted the way Microsoft weights them.

A self-paced reading course for SC-900: Microsoft Security, Compliance, and Identity Fundamentals, the entry point to Microsoft's security certification stack. SC-900 asks you to describe capabilities rather than configure them, which makes it a vocabulary exam: it is won by knowing that Defender for Cloud and Defender for Cloud Apps solve different problems, that a sensitivity label and a retention label answer different questions about the same document, and that Secure Score and Compliance Score measure different things. This course builds that vocabulary in order, so the distinctions land before you start drilling questions.

The course is organized as one module per official exam domain, in the order Microsoft publishes them, with each module carrying the domain's published weight. You work through the foundational security, compliance, and identity concepts; the Microsoft Entra identity control plane, from hybrid identity and authentication methods through Conditional Access and identity governance; the Microsoft security solutions domain, covering Azure network security, Defender for Cloud, Microsoft Sentinel, and Defender XDR; and finally Microsoft Purview and the compliance solutions built on it. Every lesson ends with its key terms and further reading, so the course works as a glossary you come back to as well as a syllabus you read once.

No hands-on administration experience is assumed, and you do not need an Azure subscription to follow along, though a trial tenant helps the product names stick. Pair the reading with practice questions by domain rather than saving them all for the end, because on a concept exam the gap between recognizing a term and choosing it out of four plausible options is wide. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation.

Module 1: Describe the concepts of security, compliance, and identity 12% of exam

The vocabulary the rest of SC-900 assumes. You start with the security methodologies Microsoft builds its products around — the shared responsibility model, defense in depth, and Zero Trust — then the cryptography that underpins nearly every control you will meet later: symmetric and asymmetric encryption, hashing, and digital signatures.The second half covers governance, risk, and compliance as a discipline, and then the identity concepts that carry more weight on this exam than any other foundation topic: authentication versus authorization, identity providers and directory services, federation and single sign-on, and why Microsoft describes identity as the primary security perimeter.

1.1 The shared responsibility model 5 min 🔒
1.2 Defense in depth and the CIA triad 5 min 🔒
1.3 The Zero Trust model 5 min Free preview
1.4 Encryption, hashing, and digital signing 5 min 🔒
1.5 Governance, risk, and compliance concepts 4 min 🔒
1.6 Identity as the primary security perimeter 5 min 🔒

Module 2: Describe the capabilities of Microsoft Entra 28% of exam

The identity control plane, and the domain where SC-900 spends most of its questions on named capabilities. You start with Microsoft Entra ID itself — what a tenant is, what the wider Entra product family contains, and the identity types it manages — then hybrid identity, where password hash synchronization, pass-through authentication, and federation each answer the same problem differently.The second half is access management: authentication methods from passwords through multifactor and passwordless, Conditional Access as the Zero Trust policy engine, Entra ID Protection and its risk signals, and the governance capabilities — Privileged Identity Management, entitlement management, access reviews, and lifecycle workflows — that keep access proportional over time. The module closes on the Free, P1, and P2 capability tiers, which the exam does test.

2.1 Microsoft Entra ID and the Entra product family 5 min 🔒
2.2 Identity types: users, workload identities, devices, and groups 5 min 🔒
2.3 External ID: B2B collaboration and customer identity 5 min 🔒
2.4 Hybrid identity: synchronization and federation 5 min 🔒
2.5 Authentication methods in Microsoft Entra ID 5 min 🔒
2.6 Multifactor authentication and going passwordless 5 min 🔒
2.7 Self-service password reset and password writeback 5 min 🔒
2.8 Conditional Access 5 min 🔒
2.9 Microsoft Entra ID Protection 5 min 🔒
2.10 Microsoft Entra roles and Azure role-based access control 5 min 🔒
2.11 Privileged Identity Management 5 min 🔒
2.12 Entitlement management and access packages 5 min 🔒
2.13 Access reviews and identity governance in practice 5 min 🔒
2.14 Microsoft Entra licensing tiers and capability boundaries 5 min 🔒

Module 3: Describe the capabilities of Microsoft security solutions 38% of exam

The largest domain on SC-900, covered in four passes. Azure network security comes first — DDoS Protection, Azure Firewall, the Web Application Firewall, network security groups and virtual network segmentation, Azure Bastion, and Azure Key Vault — followed by Microsoft Defender for Cloud, where posture management, Secure Score, the regulatory compliance dashboard, workload protection plans, and multicloud connectors are treated in turn.The second half is security operations. Microsoft Sentinel is examined as combined SIEM and SOAR, from data connectors and Kusto Query Language through analytics rules, incidents, behavioral analytics, playbooks, workbooks, and hunting. Microsoft Defender XDR then covers Defender for Endpoint, Office 365, Identity, and Cloud Apps, with cross-domain correlation, Defender Vulnerability Management, and Defender Threat Intelligence. Several product pairs in this domain are deliberately easy to confuse, and the module separates them explicitly.

3.1 Azure DDoS Protection 5 min 🔒
3.2 Azure Firewall 5 min 🔒
3.3 Web Application Firewall 5 min 🔒
3.4 Network segmentation and network security groups 5 min 🔒
3.5 Azure Bastion and Azure Key Vault 5 min 🔒
3.6 Microsoft Defender for Cloud 5 min Free preview
3.7 Secure Score and the regulatory compliance dashboard 5 min 🔒
3.8 Workload protection plans and multicloud connectors 5 min 🔒
3.9 Microsoft Sentinel as SIEM and SOAR 5 min 🔒
3.10 Data connectors, workspaces, and KQL 5 min 🔒
3.11 Analytics rules, incidents, and behavioral analytics 5 min 🔒
3.12 Playbooks, automation rules, workbooks, and hunting 5 min 🔒
3.13 Microsoft Defender XDR 5 min 🔒
3.14 Microsoft Defender for Endpoint 5 min 🔒
3.15 Microsoft Defender for Office 365 5 min 🔒
3.16 Microsoft Defender for Identity 5 min 🔒
3.17 Microsoft Defender for Cloud Apps 5 min 🔒
3.18 Microsoft Defender Vulnerability Management 5 min 🔒
3.19 Microsoft Defender Threat Intelligence and the Defender portal 5 min 🔒

Module 4: Describe the capabilities of Microsoft compliance solutions 22% of exam

Microsoft Purview and the trust posture around it. You start outside the product with the Service Trust Portal and Microsoft's privacy principles, then Compliance Manager and its Compliance Score, which is the third and most often confused of the Microsoft scores.The rest of the module is data governance in the order the work actually happens: knowing what you hold through sensitive information types, trainable classifiers, and the content and activity explorers; protecting it with sensitivity labels; controlling its movement with data loss prevention; keeping and disposing of it with retention labels, retention policies, and records management; and then the investigative capabilities — insider risk management, eDiscovery in its Standard and Premium forms, and Audit in its Standard and Premium tiers.

4.1 The Service Trust Portal and Microsoft privacy principles 5 min 🔒
4.2 Compliance Manager and Compliance Score 5 min 🔒
4.3 Microsoft Purview and the shape of data governance 5 min 🔒
4.4 Sensitive information types and trainable classifiers 4 min 🔒
4.5 Content explorer and Activity explorer 5 min 🔒
4.6 Sensitivity labels and label policies 5 min 🔒
4.7 Data loss prevention 5 min 🔒
4.8 Retention labels, retention policies, and records management 5 min 🔒
4.9 Insider risk management 5 min 🔒
4.10 eDiscovery, Standard and Premium 5 min 🔒
4.11 Audit Standard and Audit Premium 5 min 🔒

Frequently asked questions about the SC-900 training course

Is the SC-900 training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official SC-900 exam domain, in Microsoft’s published order, with each module weighted to the domain’s published percentage range. Within each module the material is broken into short lessons, followed by key terms and further reading. Because SC-900 is a vocabulary exam, the key-term sections carry more of the load here than they would on a hands-on course.

Does this replace Microsoft’s official training?

No. Microsoft Learn publishes free official learning paths for SC-900, and they are the authoritative source. This course is an independent study companion, written to be read quickly and to slot alongside practice questions, not a substitute for the official study guide.

Do I need security or Azure experience before starting?

No. SC-900 requires no hands-on administration experience, and the course assumes none. It is written for people entering the field, aspiring security analysts, IT staff moving into security-adjacent work, compliance and audit professionals learning the Microsoft cloud, and decision-makers who need shared vocabulary with a security team. AZ-900 is a peer fundamentals exam, not a prerequisite, though the AZ-900 course gives useful context for the Azure networking topics in module 3.

What should I do after finishing the course?

Move to the SC-900 practice exam and work until your weakest domain is comfortable, not just your average. After the exam, the usual next step is a role-based security credential. SC-500 for security operations work, or an associate-tier Azure credential if you are heading toward administration.

Is the course current with the latest SC-900 outline?

The course is built against the four-domain outline and weightings published on the SC-900 credential page, including the Microsoft Entra naming that replaced Azure Active Directory. Microsoft can revise the outline at any time; verify the current study guide on Microsoft Learn before you sit the exam.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft®, Microsoft Certified®, Microsoft Entra™, Microsoft Defender™, Microsoft Purview™, Microsoft Sentinel™, and SC-900 are trademarks or registered trademarks of Microsoft Corporation. Use of these marks is solely to identify the certification for which these study materials are intended. The SC-900 exam objectives and skill outline are the property of Microsoft Corporation; candidates should review the official, current study guide directly on Microsoft Learn.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual Microsoft training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by Microsoft and may change; always verify current details on Microsoft Learn before scheduling your exam.