SC-900 Prerequisites and Skills Check

The short version

Microsoft lists no prerequisites for SC-900. You do not need another certification or any work experience. Microsoft does say you should be familiar with Microsoft Azure and Microsoft 365, and you should want to understand how its security, compliance, and identity tools fit together.

What Microsoft says

The certification page describes the exam for business stakeholders, new or existing IT professionals, and students. It names no required exams, years of experience, or degrees. Microsoft’s page remains the authority, so check it before you book.

Required versus recommended

Required: nothing formal. You need a way to schedule and pay for the exam, and a personal Microsoft account is recommended for your records.

Recommended:

  • Familiarity with Microsoft 365 as a user: email, Teams, SharePoint, OneDrive.
  • A basic idea of what Azure is: subscriptions, virtual machines, virtual networks, storage.
  • Comfortable reading English technical text, or choosing one of the 13 available exam languages.
  • Basic network ideas: IP addresses, subnets, firewalls.

If you have never signed in to the Azure portal or the Microsoft 365 admin center, spend an hour looking around before you begin. A free trial is enough for that.

Suggested earlier certifications

Microsoft does not list any certification that must come first. SC-900 is itself a fundamentals exam, and many people take it first. If you plan to move on to a role-based security or identity exam later, check that exam’s own page for its requirements.

Skills self-check

Tick off what you can already do. Each item you cannot explain is a topic to study.

  • I can explain the shared responsibility model for cloud services.
  • I can say what Zero Trust means in one sentence.
  • I know the difference between authentication and authorization.
  • I know why encryption and hashing are different.
  • I can explain what MFA is and give three examples of authentication methods.
  • I know what a directory service is.
  • I can say what Conditional Access does.
  • I can tell what a firewall, a network security group, and a web application firewall each protect.
  • I know what SIEM stands for and what it does.
  • I can say what a sensitivity label does.
  • I can describe what DLP aims to prevent.
  • I know the difference between keeping data and deleting data on a schedule.

If you can honestly tick eight or more, you can probably start with the study plan at a quick pace. If you tick fewer than five, choose the 8-week schedule and start with the basics.

What to learn first if you are brand new

  1. Read about the cloud: what Azure and Microsoft 365 are, and who is responsible for what.
  2. Learn about identities: users, groups, passwords, and MFA.
  3. Learn how attacks happen at a high level: phishing, stolen credentials, malware, data leaks.
  4. Then go through the four domains in the domains explained page.

You do not need to code or to memorize command syntax.

Accessibility and language

If you need accommodations, such as assistive devices or extra time, Microsoft asks you to request them before you register. If your language is not offered, Microsoft says you can request an additional 30 minutes.

More guides for SC-900

Next step

Read the exam overview to see the format, then try the SC-900 practice tests to see where your baseline sits.

Frequently asked questions

Do I need Azure certifications first?

No. Microsoft lists no required certifications for SC-900.

Is a degree needed?

No. Microsoft names students, business stakeholders, and IT professionals as the audience.

Do I need an Azure account?

It is not required, but a free trial helps you see the portals.

Try the SC-900 practice exams