The short version
This sheet is a review aid, not a full course. It follows the four domains in Microsoft’s “Skills measured as of October 21, 2026” and focuses on the pairs and rules that cost people points. It does not cover everything on the exam, so keep the Microsoft study guide next to it.
Exam facts at a glance
| Item | Fact |
|---|---|
| Level | Beginner |
| Exam time | 45 minutes (65 minutes seat time) |
| Pass mark | 700 on a scale of 1 to 1,000 (scaled, not 70%) |
| Wrong answers | No penalty, so answer everything |
| Domain weights | Concepts 10-15%, Entra 25-30%, Security 35-40%, Compliance 20-25% |
| Retakes | 24 hours after the first fail, then 14 days apart, five attempts in 12 months |
| Expiry | None for fundamentals |
More detail is on the exam format and renewal and retakes pages.
Domain 1: Concepts (10-15%)
Key concepts
- Shared responsibility: the cloud provider and the customer split duties. The more the provider runs for you (SaaS rather than IaaS), the fewer duties stay with you. Data and access decisions always stay with the customer.
- Defense-in-depth: several layers, so one failure does not expose everything.
- Zero Trust: verify explicitly, use least privilege, assume breach.
- GRC: governance sets the rules, risk is what could go wrong, compliance is meeting external or internal requirements.
Look-alike pairs
- Encryption is reversible with a key. Hashing is one-way.
- Authentication proves who you are. Authorization decides what you may do.
- A directory service stores identities. An identity provider vouches for them at sign-in.
- Federation lets one provider trust the sign-in done by another.
Decision rules
- Scenario about who patches or secures what: think shared responsibility.
- Scenario about checking every request, not just the network edge: think Zero Trust.
- Scenario about storing passwords safely: think hashing.
Domain 2: Microsoft Entra (25-30%)
Key concepts
- Entra ID is the cloud identity and access service. Identity types include users, devices, groups, and workload identities (for apps and services).
- Hybrid identity connects on-premises directories with the cloud.
- MFA asks for more than one proof. Passwordless methods remove the password step.
- Roles and RBAC give people only the permissions their job needs.
Look-alike pairs
| This | Does this |
|---|---|
| Conditional Access | Applies if-then rules to sign-ins (conditions, then allow, block, or require more proof) |
| ID Protection | Detects risky users and sign-ins, and feeds signals into policy |
| Privileged Identity Management | Gives time-limited, approved access to privileged roles |
| Access reviews | Ask owners or users to confirm access is still needed |
| ID Governance | The wider set of controls over who has access over time |
Decision rules
- “Only when needed, only for a few hours”: PIM.
- “Review who still needs this each quarter”: access reviews.
- “Require MFA when signing in from outside the office”: Conditional Access.
- “The sign-in looks unusual or a credential leaked”: ID Protection.
Domain 3: Security solutions (35-40%)
This is the biggest domain, so give it the most review time.
Azure network and infrastructure
| Service | Remember it as |
|---|---|
| DDoS Protection | Defends against flood-style attacks on public resources |
| Azure Firewall | Managed, central network firewall |
| Web Application Firewall | Filters web application attacks such as injection |
| Network security group | Allow and deny rules on a subnet or network interface |
| Bastion | Browser-based remote access to virtual machines without public IP addresses |
| Key Vault | Safe storage for secrets, keys, and certificates |
Posture, SIEM, XDR
- Defender for Cloud improves posture (CSPM: recommendations and policies) and protects running workloads (workload protection).
- Sentinel is a SIEM (collects and analyzes security data) and a SOAR (automates responses).
- Defender XDR coordinates detection and response across Defender products.
| Defender product | Protects |
|---|---|
| Defender for Office 365 | Email and collaboration tools |
| Defender for Endpoint | Devices |
| Defender for Cloud Apps | Cloud apps and how people use them |
| Defender for Identity | On-premises Active Directory signals |
| Vulnerability Management | Finds and prioritizes weaknesses |
Decision rules
- Many data sources, one place to hunt and automate: Sentinel.
- Phishing in email: Defender for Office 365.
- Unmanaged cloud apps: Defender for Cloud Apps.
- Secure score and recommendations: Defender for Cloud.
Domain 4: Compliance solutions (20-25%)
Key concepts
- Service Trust Portal: where Microsoft publishes compliance and audit documents.
- Compliance Manager and compliance score: track progress on improvement actions. A higher score is not a legal verdict.
- Data classification finds and tags data. Content explorer shows where labeled items are, and Activity explorer shows what happened to them.
Look-alike pairs
- Sensitivity labels classify and protect (for example encryption and markings). Retention labels keep or delete after a period.
- Retention policy applies broadly. Retention label applies to chosen items.
- Records management locks items as business records. Retention alone just keeps or deletes.
- DLP blocks or warns about sharing sensitive data. Insider risk looks at risky user activity.
- eDiscovery finds and holds content for a case. Audit shows who did what.
Decision rules
- “Encrypt and mark confidential”: sensitivity label.
- “Keep contracts for a fixed time”: retention.
- “Stop credit card numbers leaving by email”: DLP.
- “Legal team needs content for an investigation”: eDiscovery.
- “Who changed this setting last week”: audit.
Common traps
- Picking a service from the name alone. Several names start with Defender, so read what the scenario protects.
- Mixing up prevent, detect, and respond. Ask which one the question wants.
- Using old names. Study with the names in the current guide.
- Reading “label” and not asking which kind.
- Assuming a high compliance score means you meet the law.
Last-day checklist
- Read your own look-alike notes once, aloud.
- Re-do the questions you missed in earlier practice, and explain why the right answer wins.
- Check the date and version of the skills list that applies to your language.
- Test your equipment and room if you take the exam online. Our exam day guide has a full list.
- Sleep. A rested mind sorts look-alike names better than one more hour of reading.
More guides for SC-900
- SC-900 Study Plan: 4-Week and 8-Week
- Is the SC-900 Exam Hard?
- SC-900 Prerequisites and Skills Check
- Is SC-900 Worth It? An Honest Look
- AZ-900 vs SC-900: Which Exam First?
Next step
Turn the sheet into questions with the sample questions, or review the domains explained page for the reasoning behind each rule. For a full timed check, try our SC-900 practice tests.