The short version
Most beginners need roughly 15 to 30 hours in total, spread over four to eight weeks. Spend the most time on Microsoft security solutions (35-40% of the exam) and Entra (25-30%). Your own background changes these numbers a lot, so treat them as a starting point.
Before you start
Open the Microsoft Learn SC-900 study guide and keep it beside you. This plan follows the version titled “Skills measured as of October 21, 2026”. Create a free Microsoft account and, if you can, a trial tenant so you can look at the real portals. Looking is enough. You do not need to build anything.
Use a simple notes table with one row per service: what it does, what it does not do, and the service people confuse it with. You will fill it in as you go. Our how to study guide has more on note-taking and spacing.
The 4-week plan (about 6 to 8 hours per week)
Week 1: Concepts and identity basics. Cover the shared responsibility model, defense-in-depth, Zero Trust, encryption versus hashing, and GRC. Then authentication versus authorization, identity providers, directories, and federation. About 6 hours. Finish with a short self-quiz on definitions.
Week 2: Microsoft Entra. Work through Entra ID, identity types including workload identities, hybrid identity, authentication methods, MFA, password protection, Conditional Access, roles and RBAC, ID Governance, access reviews, Privileged Identity Management, and ID Protection. About 8 hours. Write down how Conditional Access differs from ID Protection.
Week 3: Security solutions. Azure network protection (DDoS Protection, Firewall, WAF, virtual networks, NSGs, Bastion, Key Vault), Defender for Cloud and CSPM, Sentinel (SIEM and SOAR), and the Defender XDR products. About 9 hours. This is the heaviest week for a reason.
Week 4: Compliance, then review. Service Trust Portal, privacy principles, Purview portal, Compliance Manager, classification, sensitivity labels, DLP, records management, retention, insider risk, eDiscovery, audit. About 7 hours, with the last two sessions spent on your weak spots.
The 8-week plan (about 3 to 4 hours per week)
| Week | Focus |
|---|---|
| 1 | Security and compliance concepts: shared responsibility, defense-in-depth, Zero Trust, encryption and hashing, GRC |
| 2 | Identity concepts, then Entra ID, identity types, hybrid identity |
| 3 | Authentication methods, MFA, password protection, Conditional Access, roles |
| 4 | ID Governance, access reviews, PIM, ID Protection; recap of the Entra domain |
| 5 | Azure infrastructure security: DDoS Protection, Firewall, WAF, NSGs, Bastion, Key Vault, Defender for Cloud |
| 6 | Sentinel and the Defender XDR family, Threat Intelligence, the Defender portal |
| 7 | Service Trust Portal, privacy, Compliance Manager, labels, DLP, retention, records |
| 8 | Insider risk, eDiscovery, audit, then full review and timed practice |
The slower pace suits people who work full time or have never touched Azure or Microsoft 365 administration.
How to use practice exams
- Early check (week 1 or 2): take one short set cold. Do not worry about the score. You are looking for the weak domain.
- After each domain: answer questions on that domain only and read every explanation, including for options you did not pick.
- Two weeks out: take a full-length timed set in one sitting.
- Final week: repeat full sets until your scores stay consistently above your target. One lucky result proves little.
Practice exams measure readiness. They do not replace the Microsoft Learn material. Our practice tests are original questions, so they will not match the real exam wording, and that is on purpose. Read how we write our questions if you are curious.
The last 3 days
- Three days out: one full timed practice set. Review every miss and write one line per miss in your notes table.
- Two days out: reread only the “confused pairs” in your notes: Sentinel versus Defender XDR, sensitivity labels versus retention labels, Azure Firewall versus NSG, Conditional Access versus ID Protection.
- The day before: light review for 30 to 45 minutes. Check your ID, your booking, and, for an online exam, your room and computer. Sleep.
On the day, read our exam day guide. You get 45 minutes, so keep a steady pace and answer every question. Microsoft does not deduct points for wrong answers.
Watch the date
Microsoft says the English exam updates on October 21, 2026. If you are studying across that date, recheck the study guide for new wording, especially the identity types and Defender XDR areas.
More guides for SC-900
- SC-900 Exam Format, Scoring and Retakes
- SC-900 Sample Questions With Answers
- Is the SC-900 Exam Hard?
- SC-900 Prerequisites and Skills Check
- SC-900 Renewal and Retakes Explained
- Is SC-900 Worth It? An Honest Look
- SC-900 Cheat Sheet: Key Facts to Review
- AZ-900 vs SC-900: Which Exam First?
Next step
Go through domains explained while you follow the plan, and use the SC-900 practice tests at the checkpoints above.
Frequently asked questions
How many hours do I need?
Many beginners land between 15 and 30 hours, but this varies. People who already work with Microsoft 365 or Azure may need less.
Should I do hands-on labs?
They help you remember what the portals look like, but the exam tests understanding more than clicking.
Is a 4-week plan enough?
It works if you can give 6 to 8 hours a week. Otherwise choose the 8-week plan.