SC-900 Domains Explained

The short version

SC-900 has four domains. Security solutions (35-40%) and Entra (25-30%) together make up most of the exam. This page follows Microsoft’s study guide, “Skills measured as of October 21, 2026”. The vendor’s guide is the authority, and wording of bullets can change.

Domain 1: Concepts of security, compliance, and identity (10-15%)

What it covers. Security and compliance ideas: the shared responsibility model, defense-in-depth, Zero Trust, encryption and hashing, and governance, risk, and compliance. Identity ideas: identity as the primary security perimeter, authentication, authorization, identity providers, directory services and Active Directory, and federation.

In practice. Who patches the operating system in a virtual machine versus a SaaS app? Which layer of defense stops which attack? What does “verify explicitly” mean?

Typical traps.

  • Mixing up authentication (who are you) and authorization (what may you do).
  • Thinking hashing can be reversed. Encryption can be reversed with a key. Hashing is one-way.
  • Treating federation as the same thing as syncing accounts. Federation trusts another provider to sign users in.

What to practice. Explain each term in one sentence, then give a workplace example.

Domain 2: Microsoft Entra (25-30%)

What it covers. Four areas:

  • Entra ID functions and identity types, including workload identities and hybrid identity.
  • Authentication: methods, multifactor authentication, password protection and management.
  • Access management: Conditional Access, and roles with role-based access control.
  • Identity protection and governance: ID Governance, access reviews, Privileged Identity Management, and ID Protection.

In practice. A user signs in from a new country and is asked for MFA. A contractor’s access needs a review every quarter. An admin needs a role only for two hours.

Typical traps.

  • Conditional Access applies conditions and decisions to sign-ins. ID Protection detects risk. They work together, but they are different services.
  • PIM gives time-limited, approval-based access to roles. Access reviews check whether access is still needed. Both belong to governance, but they do different jobs.
  • A workload identity is for an app or service, not a person.

What to practice. Build a comparison table of the four identity-protection and governance services.

Domain 3: Microsoft security solutions (35-40%)

What it covers.

  • Azure infrastructure security: DDoS Protection, Azure Firewall, Web Application Firewall, virtual network segmentation, network security groups, Bastion, Key Vault.
  • Security management: Defender for Cloud, cloud security posture management, security policies and recommendations, and cloud workload protection.
  • Sentinel: SIEM and SOAR concepts, threat detection and mitigation.
  • Defender XDR: Defender for Office 365, Endpoint, Cloud Apps, and Identity, plus Vulnerability Management, Threat Intelligence, and the Defender portal.

In practice. Which tool filters web traffic for application attacks? Which one gives secure remote desktop access without public IP addresses? Which one collects logs from many sources and runs playbooks?

Typical traps.

  • Azure Firewall (a managed, centralized firewall) versus NSG (rules on subnets or network interfaces) versus WAF (web application attacks).
  • Sentinel (a SIEM and SOAR across sources) versus Defender XDR (coordinated detection and response across Microsoft’s Defender products).
  • CSPM improves posture before something goes wrong. Workload protection detects threats on running resources.
  • Mapping each Defender product to its target: email and collaboration, devices, SaaS apps, or on-premises identity.

What to practice. Because this domain is the largest, give it the most time. Make a “what is protected” column for every product.

Domain 4: Microsoft compliance solutions (20-25%)

What it covers.

  • Service Trust Portal and Microsoft’s privacy principles.
  • Purview portal, Compliance Manager, and compliance score.
  • Information protection and lifecycle: data classification, Content explorer and Activity explorer, sensitivity labels and policies, DLP, records management, retention policies, retention labels and label policies.
  • Insider risk management, eDiscovery, and audit.

In practice. A document must be encrypted and marked confidential. Contracts must be kept for a fixed period. A legal team needs evidence. An admin wants to know who changed a label.

Typical traps.

  • Sensitivity labels classify and protect. Retention labels keep or delete. Both are labels, so the words blur.
  • Content explorer shows where labeled content is. Activity explorer shows what people did with it.
  • Compliance score measures progress in Compliance Manager. It does not certify that you comply with a law.

What to practice. Match each Purview feature to a business request in plain words.

More guides for SC-900

Next step

Use the study plan to schedule these domains, then test yourself with the SC-900 practice tests, which are tagged by domain so you can see your weakest one.

Frequently asked questions

Which domain should I study first?

Start with the concepts. They are the shortest and the vocabulary shows up everywhere else.

Do I need to know licensing?

Microsoft’s guide does not list licensing as a skill. Learn what each service does first.

Are preview features tested?

Microsoft says most questions cover generally available features, though commonly used preview features may appear.

Try the SC-900 practice exams