Training course
This is a free, self-paced reading course for SC-900: Microsoft Security, Compliance, and Identity Fundamentals, the entry point to Microsoft’s security certification stack, and an exam that asks you to describe capabilities rather than configure them. That verb matters. SC-900 is won and lost on vocabulary: knowing that Defender for Cloud and Defender for Cloud Apps are different products solving different problems, that a sensitivity label and a retention label answer different questions about the same document, that Secure Score and Compliance Score measure different things. This course is written to build that vocabulary in order, so the distinctions land before you start drilling questions.
The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain’s published weight. That structure keeps your effort proportional to the exam’s: the Microsoft security solutions domain alone is 35-40% of SC-900, and it is the largest module here. Every lesson ends with its key terms and suggested further reading, which matters more on a concept exam than on a hands-on one. The terms are the material. The course works as a glossary you come back to as well as a syllabus you read through once.
What the course covers
Describe the concepts of security, compliance, and identity
Module 1 · 10-15%The foundations the rest of the exam leans on: security methodologies including Zero Trust and defense in depth, the shared responsibility model, encryption and hashing, and the basics of governance, risk, and compliance. Then the identity groundwork, authentication versus authorization, identity providers, directory services, federation, and why the perimeter moved from the network to the identity.
Describe the capabilities of Microsoft Entra
Module 2 · 25-30%The identity control plane. Microsoft Entra ID as an identity provider; hybrid identity through password hash synchronization, pass-through authentication, and AD FS; authentication methods including MFA, FIDO2, Windows Hello for Business, and Temporary Access Pass; Conditional Access; Entra ID Protection and its sign-in and user risk signals; Privileged Identity Management, entitlement management, and access reviews; External ID for B2B collaboration; lifecycle workflows; and which capabilities sit in the Free, P1, and P2 licensing tiers.
Describe the capabilities of Microsoft security solutions
Module 3 · 35-40%The largest domain, covered in four passes. Azure network security: DDoS Protection, Azure Firewall, Web Application Firewall, Bastion, network security groups, VNet segmentation, and Key Vault. Defender for Cloud, cloud security posture management, workload protection, Secure Score, the regulatory compliance dashboard, and multi-cloud connectors. Microsoft Sentinel as combined SIEM and SOAR, with data connectors, analytics rules, workbooks, playbooks, and KQL. And Microsoft Defender XDR: Defender for Endpoint, Office 365, Identity, and Cloud Apps, plus Defender Threat Intelligence and Vulnerability Management.
Describe the capabilities of Microsoft compliance solutions
Module 4 · 20-25%Microsoft Purview and the wider trust posture: the Service Trust Portal, Microsoft’s privacy principles, and Compliance Manager with its Compliance Score. Then the data-governance toolkit, sensitive information types and trainable classifiers, Content explorer and Activity explorer, sensitivity labels set against retention labels, data loss prevention, records management, insider risk management, eDiscovery in its Standard and Premium forms, and Audit Standard versus Audit Premium retention.
How to use it
Read a module, then test that domain immediately rather than saving all the questions for the end. On a concept exam the gap between “I have read this” and “I can pick this out of four plausible options” is wide, and only questions expose it. The free SC-900 sample is the quickest way to see what that feels like; the full SC-900 practice exam is where you work until you are clearing every domain rather than carrying a weak one on the back of a strong one. Pay particular attention to items where two Microsoft products could both plausibly be the answer, that is where SC-900 does most of its discriminating. The course modules themselves open once you are signed in to a free Certifym account.
You do not need an Azure subscription to pass this exam, but a free tenant helps the names stick: seeing Conditional Access and a sensitivity label in the portal once turns an abstraction into an object. For exam logistics (length, question count, the 700 out of 1000 pass mark, pricing, and the renewal policy for fundamentals credentials) see the SC-900 certification guide.
Microsoft Defender for Cloud
Microsoft Defender for Cloud is the product that answers a question every organization running cloud infrastructure eventually asks: is any of this configured securely, and how would we know? It combines posture management with workload protection, and SC-900 examines both halves.
Two jobs in one product
Defender for Cloud does two distinct things, and keeping them apart makes the whole topic easier.
Cloud security posture management (CSPM) continuously assesses configuration. It answers "what is misconfigured or missing," produces prioritized recommendations, and measures improvement over time with a score. It is preventive: it finds weaknesses before anyone exploits them.
Cloud workload protection (CWPP) detects active threats against running resources. It answers "what is happening right now that should not be," generating security alerts about suspicious behavior on virtual machines, databases, storage accounts, containers, and other services. It is detective and responsive.
The distinction maps neatly onto the exam's phrasing. A question about recommendations, hardening, or a score is CSPM. A question about an alert on a specific resource — anomalous access, suspicious process execution, malware — is CWPP.
Posture management in practice
Defender for Cloud continuously collects configuration data from connected resources and evaluates it against a set of security standards. The default baseline is the Microsoft cloud security benchmark, a Microsoft-authored set of controls that maps to widely used industry frameworks.
Each failing check produces a recommendation — a specific, actionable statement such as enabling encryption on a storage account, restricting management ports on a virtual machine, or requiring multifactor authentication for subscription owners. Recommendations carry a severity, an explanation of the risk, and remediation steps. Many offer quick fix remediation that applies the change directly, and some support automated remediation at scale.
Recommendations are grouped into security controls — related sets of actions addressing one risk area — and each control contributes points to Secure Score, a single percentage expressing how much of the recommended posture an environment has achieved. The next lesson covers scoring in detail.
Additional posture capabilities worth naming: attack path analysis, which chains individual weaknesses into the routes an attacker could actually take, so a low-severity finding that completes a path to sensitive data can be prioritized correctly; and a security graph that supports querying relationships across the environment. These address the biggest weakness of raw recommendation lists, which is that they treat every finding as independent when attackers combine them.
Workload protection in practice
Workload protection is delivered as a set of plans, each covering a resource type and enabled separately, so an organization can protect its most sensitive workloads without paying for coverage everywhere. Plans exist for servers, storage, SQL and other databases, containers and Kubernetes, App Service, Key Vault, APIs, and more.
The plan for servers integrates Microsoft Defender for Endpoint, so virtual machines receive full endpoint detection and response rather than server-specific checks alone. It also provides file integrity monitoring, adaptive application controls that learn which applications normally run on a machine and alert on deviations, and just-in-time virtual machine access, which keeps management ports closed and opens them only for an approved request, for a limited window, from a specified source address.
Alerts from all plans are correlated into incidents so that related activity across resources is presented as one investigation rather than a stream of individual events.
Multicloud and hybrid coverage
Defender for Cloud is not limited to Azure. It connects to Amazon Web Services and Google Cloud accounts through native connectors, assessing their resources against equivalent benchmarks and producing recommendations in the same interface. On-premises and other-cloud servers are onboarded through Azure Arc, which projects them into Azure as manageable resources.
This matters more than it first appears. Most organizations of any size run more than one cloud, often unintentionally, and the practical difficulty is not securing any single platform but seeing all of them at once. A unified posture view with one score and one recommendation list is the value proposition, and it is the kind of statement SC-900 asks you to recognize.
Regulatory compliance
The same assessment data is projected against regulatory frameworks in a compliance dashboard, showing how the environment measures against standards such as ISO/IEC 27001, PCI DSS, and various national baselines. Additional standards can be added, and evidence can be exported for auditors. That view is covered alongside Secure Score in the next lesson.
What to carry forward
Defender for Cloud is the posture and workload protection layer for infrastructure. Distinguish it carefully from Microsoft Defender for Cloud Apps, which despite the similar name is a cloud access security broker for SaaS applications and appears later in this module. Confusing the two is among the most common SC-900 mistakes, and it is worth fixing the difference in mind now: Defender for Cloud protects the infrastructure you run, Defender for Cloud Apps governs the applications your people use.
Frequently asked questions about the SC-900 training course
Is the SC-900 training course free?
Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.
How is the course structured?
One module per official SC-900 exam domain, in Microsoft’s published order, with each module weighted to the domain’s published percentage range. Within each module the material is broken into short lessons, followed by key terms and further reading. Because SC-900 is a vocabulary exam, the key-term sections carry more of the load here than they would on a hands-on course.
Does this replace Microsoft’s official training?
No. Microsoft Learn publishes free official learning paths for SC-900, and they are the authoritative source. This course is an independent study companion, written to be read quickly and to slot alongside practice questions, not a substitute for the official study guide.
Do I need security or Azure experience before starting?
No. SC-900 requires no hands-on administration experience, and the course assumes none. It is written for people entering the field, aspiring security analysts, IT staff moving into security-adjacent work, compliance and audit professionals learning the Microsoft cloud, and decision-makers who need shared vocabulary with a security team. AZ-900 is a peer fundamentals exam, not a prerequisite, though the AZ-900 course gives useful context for the Azure networking topics in module 3.
What should I do after finishing the course?
Move to the SC-900 practice exam and work until your weakest domain is comfortable, not just your average. After the exam, the usual next step is a role-based security credential. SC-500 for security operations work, or an associate-tier Azure credential if you are heading toward administration.
Is the course current with the latest SC-900 outline?
The course is built against the four-domain outline and weightings published on the SC-900 credential page, including the Microsoft Entra naming that replaced Azure Active Directory. Microsoft can revise the outline at any time; verify the current study guide on Microsoft Learn before you sit the exam.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft®, Microsoft Certified®, Microsoft Entra™, Microsoft Defender™, Microsoft Purview™, Microsoft Sentinel™, and SC-900 are trademarks or registered trademarks of Microsoft Corporation. Use of these marks is solely to identify the certification for which these study materials are intended. The SC-900 exam objectives and skill outline are the property of Microsoft Corporation; candidates should review the official, current study guide directly on Microsoft Learn.
All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual Microsoft training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by Microsoft and may change; always verify current details on Microsoft Learn before scheduling your exam.