The short version
SC-900 is Microsoft’s entry-level exam on security, compliance, and identity. It tests whether you understand the ideas and know what each Microsoft service is for, not whether you can configure them. This guide uses the study guide that Microsoft lists as “Skills measured as of October 21, 2026”.
What the exam is
The full name is Microsoft Security, Compliance, and Identity Fundamentals. Passing it earns the Microsoft Certified: Security, Compliance, and Identity Fundamentals credential, which Microsoft labels as beginner level. The exam asks you to “describe” things, and that verb matters. You need to recognize a feature, say what problem it solves, and tell it apart from its neighbors.
Think of it as a vocabulary test with scenarios. If a question mentions a user who signs in from an unusual country, you should think of Conditional Access and ID Protection. If it mentions keeping or deleting documents for seven years, you should think of retention. You do not need to click through any portals.
Who it is for
Microsoft names three audiences: business stakeholders, new or existing IT professionals, and students. You should be familiar with Microsoft Azure and Microsoft 365 and want to see how Microsoft’s security, compliance, and identity tools fit together. There are no required prerequisites. The prerequisites page covers what helps.
Format at a glance
| Item | What Microsoft says |
|---|---|
| Exam code | SC-900 |
| Level | Beginner |
| Time | 45 minutes of exam time |
| Passing score | 700 or higher on a scale of 1 to 1,000 |
| Delivery | Proctored, scheduled through Pearson VUE (students and educators can use Certiport) |
| Languages | 13, including English, Spanish, French, and Portuguese (Brazil) |
| Number of questions | Not published for this exam; Microsoft says most exams have 40 to 60 |
Details, including scoring and retakes, are on the exam format page.
The four domains and their weightings
| Domain | Weighting |
|---|---|
| Describe the concepts of security, compliance, and identity | 10-15% |
| Describe the capabilities of Microsoft Entra | 25-30% |
| Describe the capabilities of Microsoft security solutions | 35-40% |
| Describe the capabilities of Microsoft compliance solutions | 20-25% |
Concepts of security, compliance, and identity
The foundations: the shared responsibility model, defense-in-depth, Zero Trust, encryption and hashing, and governance, risk, and compliance. It also covers identity basics such as authentication versus authorization, identity providers, directory services, and federation.
Microsoft Entra
Microsoft’s identity family, centered on Microsoft Entra ID. Expect identity types (including workload identities), hybrid identity, authentication methods, multifactor authentication, Conditional Access, roles, access reviews, Privileged Identity Management, and ID Protection.
Microsoft security solutions
The biggest domain. It spans Azure network and infrastructure protection (DDoS Protection, Firewall, WAF, NSGs, Bastion, Key Vault), Microsoft Defender for Cloud, Microsoft Sentinel, and the Microsoft Defender XDR family.
Microsoft compliance solutions
The Service Trust Portal, Microsoft’s privacy principles, and Microsoft Purview: Compliance Manager, data classification, sensitivity labels, data loss prevention, records management, retention, insider risk, eDiscovery, and audit.
Official source
For the vendor’s own page, see the Microsoft Learn SC-900 study guide. It is the final authority if anything here differs.
More guides for SC-900
- SC-900 Study Plan: 4-Week and 8-Week
- SC-900 Sample Questions With Answers
- Is the SC-900 Exam Hard?
- SC-900 Renewal and Retakes Explained
- Is SC-900 Worth It? An Honest Look
- SC-900 Cheat Sheet: Key Facts to Review
- AZ-900 vs SC-900: Which Exam First?
Next step
Read the domains explained page to see where your time should go. When you want to check yourself, our SC-900 practice tests are original practice sets built around these four domains.
Frequently asked questions
Does SC-900 expire?
No. Microsoft states that fundamentals certifications do not expire, so there is nothing to renew. Only associate, expert, and specialty certifications need annual renewal.
Is the exam available in English only?
No. Microsoft lists 13 languages. The English version is always updated first, and Microsoft says other languages follow about eight weeks later.
Do I need Azure experience?
You should be familiar with Azure and Microsoft 365 as concepts. Hands-on skills are not required, but a free trial tenant helps.