Certification guide
SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is the entry-level credential in Microsoft’s security certification stack. It validates conceptual understanding of security, compliance, and identity across the Microsoft cloud ecosystem — Microsoft Entra, Defender, Purview, and Sentinel — without requiring hands-on administration experience.
The certification is designed for candidates entering the field: aspiring security analysts, IT staff moving into security-adjacent roles, compliance and audit professionals learning the Microsoft cloud landscape, and business decision-makers who need shared vocabulary with security teams. It is a common first step before role-based Microsoft security certifications such as SC-500 (Security Operations Analyst) or SC-100 (Cybersecurity Architect).
The exam is organized into four domains that intersect in every real-world security discussion: identity as the modern security perimeter, security solutions that protect endpoints and workloads, compliance solutions that govern data throughout its lifecycle, and the connective concepts that tie them together.
Describe the concepts of security, compliance, and identity
Domain 1 · 10–15%Foundations that recur throughout the exam: security methodologies (Zero Trust, defense in depth), the shared responsibility model, encryption and hashing, GRC basics, and identity concepts — authentication versus authorization, identity providers, directory services, federation, and the shift from network perimeter to identity perimeter.
Describe the capabilities of Microsoft Entra
Domain 2 · 25–30%The identity control plane: Microsoft Entra ID as an IdP, hybrid identity (PHS, PTA, AD FS), authentication methods (MFA, FIDO2, Windows Hello for Business, Temporary Access Pass), Conditional Access, Entra ID Protection (sign-in and user risk), Privileged Identity Management, entitlement management, access reviews, External ID (B2B), lifecycle workflows, and the Free / P1 / P2 licensing tier map.
Describe the capabilities of Microsoft security solutions
Domain 3 · 35–40%The largest domain: Azure network security (DDoS Protection, Firewall, WAF, Bastion, NSG, VNet segmentation, Key Vault), Defender for Cloud (CSPM, workload protection, Secure Score, regulatory compliance dashboard, multi-cloud connectors), Microsoft Sentinel (SIEM + SOAR, data connectors, analytics rules, workbooks, playbooks, KQL), and Microsoft Defender XDR — Defender for Endpoint, Office 365, Identity, Cloud Apps, plus Defender Threat Intelligence and Vulnerability Management.
Describe the capabilities of Microsoft compliance solutions
Domain 4 · 20–25%Microsoft Purview and the trust posture: Service Trust Portal, Microsoft’s privacy principles, Compliance Manager and Compliance Score, sensitive information types and trainable classifiers, Content and Activity explorer, sensitivity labels versus retention labels, DLP, records management, insider risk management, eDiscovery (Standard and Premium), and Audit (Standard versus Premium retention).
Because SC-900 tests conceptual understanding rather than configuration, exam success rests on precise vocabulary and the ability to distinguish overlapping products — Defender for Cloud versus Defender for Cloud Apps, sensitivity labels versus retention labels, Secure Score versus Compliance Score. A large practice bank exposes candidates to the full range of scenarios and disambiguations that appear on test day. The 700/1000 pass mark is the honest raw-score equivalent of about 70% — comfortable prep gets you well past it, not luck in the heavy ones.
Microsoft Security Compliance and Identity Fundamentals - Practice Exam
A comprehensive practice bank aligned to the SC-900 exam objectives. Random draws of 60 questions per attempt model the real exam length. Ten vertical scenario sets…
Subscribe to startFrequently asked questions
Is SC-900 worth pursuing in 2026?
For anyone entering security, compliance, or identity — or transitioning into a Microsoft cloud role — SC-900 provides a structured foundation. It is especially valuable for GRC analysts, IT support staff, and career changers who need to demonstrate cloud-security literacy before pursuing role-based certifications such as SC-500 or SC-100. Employers commonly recognize it as evidence of baseline Microsoft security fluency.
How hard is the SC-900 exam?
SC-900 sits at Microsoft’s fundamentals tier — its easiest classification. It tests recognition and conceptual understanding rather than hands-on configuration. Most candidates with 20–30 hours of focused study pass on the first attempt. Difficulty concentrates in distinguishing similarly named products (Defender for Cloud versus Defender for Cloud Apps) and applying the right Purview capability to the right compliance goal (sensitivity labels versus retention labels versus DLP versus records management).
What is the SC-900 passing score, and how is it calculated?
Passing score is 700 on a scaled 1000-point scale, which corresponds to roughly 70% raw accuracy. Microsoft uses scaled scoring, so raw-to-scaled mapping can vary slightly by exam form. Aim for 80% or higher on realistic practice banks to build a comfortable margin.
How long is the exam and how much does it cost?
The exam runs approximately 45–60 minutes and contains 40–60 questions (Microsoft no longer publishes fixed numbers). Cost is $99 USD in most regions, with local pricing and taxes elsewhere. Expect multiple-choice, multiple-response, and drag-and-drop question formats.
Does the SC-900 certification expire?
Microsoft fundamentals certifications, including SC-900, do not expire on a fixed schedule under the current policy. They remain valid unless Microsoft formally retires the exam. This differs from role-based Microsoft certifications (SC-500, AZ-305, and others), which expire annually and require a free online renewal assessment.
Should I take AZ-900 before SC-900?
Not required. SC-900 and AZ-900 are peer fundamentals — either can be first, and neither is a prerequisite for the other. AZ-900 focuses on Azure infrastructure and services; SC-900 focuses on security, compliance, and identity across the broader Microsoft ecosystem. AZ-900 first gives useful Azure context (particularly for Domain 3 networking topics), but SC-900 stands alone as an entry point.
What certifications should I pursue after SC-900?
Common next steps: SC-500 (Microsoft Security Operations Analyst — the SC-200 successor) for SOC-track roles; SC-100 (Microsoft Cybersecurity Architect) for architecture roles; SC-400 for depth in compliance and information protection; or vendor-neutral options like ISC2 Certified in Cybersecurity or CompTIA Security+. Compliance-focused careers often pair SC-900 with ISACA CRISC or ISC2 CGRC.
How does the Certifym SC-900 practice bank work?
The Certifym SC-900 bank contains 1000 original questions spanning ten vertical scenarios — enterprise, healthcare, financial services, manufacturing, federal, retail, SaaS, higher education, energy, and telecom. Each attempt draws 60 questions at random with a 60-minute time limit and 70% pass mark, modeling the real exam length. Every item includes a detailed explanation that justifies the correct answer and identifies why the near-miss distractors fall short.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. “SC-900”, “Microsoft Certified”, “Microsoft Entra”, “Microsoft Defender”, “Microsoft Purview”, “Microsoft Sentinel”, and related marks are trademarks or registered trademarks of Microsoft Corporation. All references are used descriptively to identify the certification exam that this study material covers.
All practice questions, explanations, and preparation content on Certifym.net are original works authored independently by Certifym Exam Services, LLC. We do not reproduce or distribute actual exam content, and we do not represent that any question on this platform will appear on the live exam.