AZ-900 vs SC-900: Which Exam First?

The short version

Take AZ-900 first if you want to understand Azure as a whole. Take SC-900 first if your interest is security, identity, or compliance in Microsoft services, since it does not require AZ-900. If you will take both, AZ-900 first is the gentler order, because SC-900 expects you to be familiar with Azure and Microsoft 365. Facts below were checked on Microsoft Learn on October 22, 2026.

At a glance

Item	AZ-900	SC-900
Full name	Microsoft Azure Fundamentals	Microsoft Security, Compliance, and Identity Fundamentals
Level	Beginner	Beginner
Audience	Technology professionals wanting foundational cloud and Azure knowledge	Business stakeholders, new or existing IT professionals, students
Focus	Azure services, architecture, cost, governance, monitoring	Security, compliance, and identity concepts and Microsoft solutions
Domains	3: 25-30%, 35-40%, 30-35%	4: 10-15%, 25-30%, 35-40%, 20-25%
Exam time	45 minutes	45 minutes
Passing score	700 of 1,000	700 of 1,000
Delivery	Proctored, Pearson VUE or Certiport	Proctored, Pearson VUE or Certiport
Languages	13	13
Expiry	Does not expire	Does not expire
Skills as of	July 20, 2026	October 21, 2026

What each exam is about

AZ-900 covers the platform. Cloud models, IaaS, PaaS, and SaaS, Azure regions and the subscription hierarchy, compute, networking, storage, identity basics, cost tools, Azure Policy, locks, Arc, and monitoring.

SC-900 covers protecting things and proving you did it. Its domains are the concepts of security, compliance, and identity; Microsoft Entra (authentication, Conditional Access, governance, ID Protection); Microsoft security solutions (network protection, Defender for Cloud, Sentinel, and the Defender XDR family); and Microsoft compliance solutions (Service Trust Portal, Purview, sensitivity labels, data loss prevention, retention, insider risk, eDiscovery, and audit).

The English SC-900 exam changed on October 21, 2026, one day before we checked, so look at the current study guide if you use older notes. Microsoft’s change log marks only two sub-areas as minor.

Where they overlap

Same level, same time limit, same pass mark, same retake rule: 24 hours after a first failure, 14 days after that, five attempts in 12 months.
Shared ideas: the shared responsibility model, Zero Trust, defense in depth, Microsoft Entra, Conditional Access, role-based access control, and Microsoft Defender for Cloud all appear in the skills lists of both exams.
Both are mostly “describe” exams: you recognize services and choose the right one, not configure them.

Where they differ

Breadth versus focus. AZ-900 touches many Azure areas lightly. SC-900 stays inside security, compliance, and identity, but names many more products in that area.
Microsoft 365. SC-900 expects familiarity with Azure and Microsoft 365, and a lot of its compliance content (Purview, labels, retention) lives in the Microsoft 365 world. AZ-900 does not.
Cost and operations. Pricing, tags, and resource organization appear in AZ-900 but not SC-900.
Weighting. SC-900’s biggest domain, security solutions, is 35-40%. AZ-900’s biggest is Azure architecture and services, also 35-40%.

How to choose

If you are…	Start with
New to cloud	AZ-900
Interested in a security career	SC-900, preferably after a basic look at AZ-900
Working in compliance, risk, or audit	SC-900
An IT admin who wants broad Azure vocabulary	AZ-900
A business stakeholder in a Microsoft 365 company	SC-900
Planning both	AZ-900, then SC-900

If you do both, you can reuse about the first week of ideas. The identity and Zero Trust topics you meet in AZ-900 are expanded into a full domain in SC-900.

Which is harder?

Difficulty depends on background. People with Azure experience often find SC-900’s compliance domain new, because the products (Purview, sensitivity labels, eDiscovery) are less familiar. People from security often find AZ-900’s cost and governance topics unfamiliar. Read is AZ-900 hard and is SC-900 hard for more.