Microsoft Security, Compliance, and Identity Fundamentals (SC-900)
SC-900
An entry-level Microsoft certification that validates foundational knowledge of security, compliance, and identity concepts and how they map to Microsoft solutions. It covers Microsoft Entra identity and access, Microsoft security solutions (Microsoft Defender, Microsoft Sentinel), and Microsoft Purview compliance solutions.
100
60 min
700/ 1000
206+
Target Audience
Anyone starting with cloud security — beginners, students, business stakeholders, and non-technical roles who want to understand Microsoft security, compliance, and identity fundamentals.
Prerequisites
None. No coding or prior cloud experience required; general familiarity with Microsoft cloud services is helpful.
Question Types
Language & Recognition
Official Exam Languages
PasslyExam Languages
Recognition Scope
Microsoft Certified: Security, Compliance, and Identity Fundamentals — a lifetime, globally recognized entry-level credential.
Exam Domains
Describe the concepts of security, compliance, and identity
Describe the capabilities of Microsoft Entra
Describe the capabilities of Microsoft security solutions
Describe the capabilities of Microsoft compliance solutions
Recommended Study Plan
- Week 1 · Overview and vocabulary. SC-900 is fundamentals (no experience required): pass 700/1000, ~60 minutes. Four domains: security/compliance/identity concepts (12%), Microsoft Entra (28%), Microsoft security solutions (38%), Microsoft compliance solutions (22%). Learn the product-family map first: Microsoft Entra = identity and access, Microsoft Defender = threat protection, Microsoft Purview = compliance and data governance, Microsoft Sentinel = SIEM/SOAR.
- Week 2 · Concepts and Microsoft Entra. Shared responsibility model, defense-in-depth, Zero Trust, encryption vs hashing, authentication vs authorization. Then Microsoft Entra ID identity types and hybrid identity, MFA and password protection (SSPR, smart lockout), Conditional Access, RBAC, Privileged Identity Management (PIM), access reviews, and Entra ID Protection.
- Week 3 · Microsoft security solutions (the largest domain). Azure infrastructure security (NSGs, Azure Firewall, Web Application Firewall, DDoS Protection, Azure Bastion, Azure Key Vault); Microsoft Defender for Cloud (CSPM and secure score); Microsoft Sentinel (SIEM and SOAR); and the Microsoft Defender XDR workloads (Office 365, Endpoint, Cloud Apps, Identity).
- Week 4 · Microsoft compliance and Purview. Service Trust Portal and Microsoft privacy principles; Compliance Manager and compliance score; sensitivity labels vs retention labels vs data loss prevention (DLP); and eDiscovery, audit, and insider risk management.
- Final days · Timed practice exams. Drill the confusable families — Defender for Cloud vs Defender XDR vs Sentinel; Conditional Access vs PIM vs access reviews vs ID Protection; sensitivity vs retention labels vs DLP — and lock in the 'Which Microsoft solution?' recognition pace.
Question Validation Process
Try the practice set directly and judge real-exam similarity yourself.
Frequently Asked Questions
Q. What is the SC-900 exam format, and do I need experience?
A. No experience is required — it is a Microsoft fundamentals certification. The exam is multiple-choice plus Yes/No and drag-and-drop items, about 60 minutes, passing at 700/1000. A great first step into Microsoft security, compliance, and identity.
Q. Which domain carries the most weight?
A. Microsoft security solutions is the largest at 35-40%, followed by Microsoft Entra (25-30%), Microsoft compliance/Purview (20-25%), and the concepts domain (10-15%). It is Microsoft-ecosystem specific — Entra, Defender, Purview, and Sentinel.
Q. Do I need to know Azure or Microsoft 365 in depth?
A. It helps, but SC-900 tests conceptual recognition, not configuration: knowing which Microsoft solution or capability fits a need (for example Conditional Access vs PIM, or sensitivity labels vs DLP). There is no implementation detail.
Q. How do practice questions and the timed mock exam differ?
A. Practice questions are solved by topic with answer explanations to shore up weak areas; the timed mock exam is taken like the real thing. Both use original questions with AI tutor explanations.
Q. Is this similar to exam dumps?
A. PasslyExam does not provide leaked dumps. Our content is built from official guides and public exam objectives, then tuned to reflect realistic question patterns and difficulty distribution. The focus is practical readiness with explanation-based learning, not memorization of leaked items.
View dump-alternative guide