Updated 1 Nov 2026 · 5 min read
On this page
What the Microsoft SC-900 is and who it is for
The SC-900, Microsoft Security, Compliance, and Identity Fundamentals, is the one exam behind the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification. Microsoft aims it at anyone who wants the fundamentals of security, compliance and identity across cloud-based and related Microsoft services, and names three groups directly: business stakeholders, new or existing IT professionals, and students. It expects you to be familiar with Microsoft Azure and Microsoft 365 already.
It is a beginner level exam and it tests understanding, not configuration. You are asked what a product does and when it applies, rather than how to set it up.
Microsoft has announced that the English version of the exam will be updated on 21 October 2026. Its change log lists only minor changes, in two objective groups: the identity types in Microsoft Entra ID and threat protection with Microsoft Defender XDR.
Microsoft SC-900 at a glance
| Item | Detail |
|---|---|
| Exam code | SC-900 |
| Questions | Not published for this exam. Microsoft says most of its exams have 40 to 60 and the number varies |
| Time allowed | 45 minutes (Microsoft's Fundamentals exam duration), 65 minutes of seat time |
| Passing score | 700 out of 1000, scaled |
| Exam fee | US$99 in the US, priced by country or region elsewhere |
| Languages | English, Arabic, Chinese (Simplified and Traditional), French, German, Indonesian, Italian, Japanese, Korean, Portuguese (Brazil), Russian and Spanish |
| Where you sit it | Pearson VUE, online proctored or at a test centre. Students and educators can schedule through Certiport |
| Certification valid for | Does not expire |
What is on the exam
Describe the concepts of security, compliance, and identity (10 to 15%). The theory domain: the shared responsibility model, defence in depth, Zero Trust, encryption and hashing, and governance, risk and compliance. The identity half asks why identity is the primary security perimeter, the difference between authentication and authorisation, and what identity providers, directory services, Active Directory and federation are.
Describe the capabilities of Microsoft Entra (25 to 30%). Entra ID itself, the types of identity it holds (including workload identities) and hybrid identity. Then the authentication methods, multifactor authentication and password protection, followed by Conditional Access and Entra roles with role-based access control. It finishes on governance and protection: Entra ID Governance, access reviews, Privileged Identity Management and Entra ID Protection.
Describe the capabilities of Microsoft security solutions (35 to 40%). The biggest domain. It starts with Azure infrastructure security: DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation with virtual networks, network security groups, Azure Bastion and Key Vault. Then Microsoft Defender for Cloud and cloud security posture management, Microsoft Sentinel with the SIEM and SOAR concepts behind it, and the Microsoft Defender XDR family: Defender for Office 365, Endpoint, Cloud Apps and Identity, Defender Vulnerability Management, Microsoft Threat Intelligence and the Defender portal.
Describe the capabilities of Microsoft compliance solutions (20 to 25%). The Service Trust Portal and Microsoft's privacy principles, then Microsoft Purview: the Purview portal, Compliance Manager and compliance score. Data classification, Content explorer and Activity explorer, sensitivity labels, data loss prevention, records management and retention labels and policies follow. It ends with insider risk management, eDiscovery and audit.
Why people fail it
The SC-900 is less hard than tricky. Most lost marks come from products with similar names. Defender for Endpoint, Defender for Cloud and Defender for Office 365 protect very different things. Compliance Manager is a tool inside the Purview portal, not another name for it. Microsoft Sentinel and Microsoft Defender XDR both detect threats, but one is a cloud SIEM and SOAR you feed with data, and the other is the integrated suite built around Microsoft's own Defender products. The exam is built to see whether you can tell these apart in a one line scenario.
The second cause is misreading the weighting. Candidates with a general security background spend their time on the concepts they find interesting, but pure theory is only 10 to 15% of the exam. Microsoft security solutions (35 to 40%) and Entra (25 to 30%) together are well over half, and both reward specific product knowledge.
The third is underestimating it. 45 minutes is short, Microsoft Learn is not available during Fundamentals exams, and the objective list is long. A wide pass over every product beats deep knowledge of two or three.
A study plan that fits the exam
Six weeks suits most people who already use Azure or Microsoft 365. The split follows the weights: half a week on concepts, a week and a half on Entra, two weeks on security solutions, a week on compliance and a final week of timed practice.
- Week 1: concepts, then Entra ID. Shared responsibility, defence in depth, Zero Trust, encryption versus hashing, and the identity terms. Then start on Entra ID, identity types and hybrid identity. End the week with the free SC-900 practice questions to see where you stand.
- Week 2: Entra access and governance. Authentication methods, MFA, password protection, Conditional Access, roles and RBAC, access reviews, Privileged Identity Management and ID Protection. Be able to say which feature solves a given access problem.
- Week 3: Azure infrastructure and Defender for Cloud. Match each network service (DDoS Protection, Firewall, WAF, NSGs, Bastion) to the threat it answers, then Key Vault, Defender for Cloud and posture management.
- Week 4: Sentinel and Defender XDR. SIEM and SOAR in Sentinel, then each Defender XDR service and what it protects.
- Week 5: Purview and compliance. Service Trust Portal, Compliance Manager and compliance score, classification, sensitivity labels, DLP, retention and records, insider risk, eDiscovery and audit.
- Week 6: timed runs. Take Microsoft's free Practice Assessment, then work through the questions-only copy in the SC-900 practice question pack in 45 minute blocks and read the explanation for every miss, especially where two products looked right.
On exam day
You book through Pearson VUE and sit the exam either online, proctored by webcam and microphone, or at a test centre. For an online exam you can check in from 30 minutes before your appointment, and Microsoft says the launch and check-in process takes about 15 minutes, so start early.
You have 45 minutes to answer, inside 65 minutes of seat time. Five minutes of break time is built into the exam, but the clock keeps running during a break and you cannot go back to questions you saw before it, so answer or review everything first. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Frequently asked questions
What happens if I fail the SC-900?
You can retake it after 24 hours. After that, Microsoft imposes a 14 day wait between attempts, with no more than five attempts in 12 months from the first. Microsoft says you must pay to retake the exam, so it is worth being ready the first time.
Should I wait for the 21 October 2026 update?
There is no need. Microsoft rates the changes as minor and limited to two objective groups, so the same preparation serves both versions. If you sit in English after 21 October, check the Entra ID identity types and Defender XDR objectives in the study guide once more.
Is the practice pack enough on its own?
Probably not if the products are new to you. The pack is practice, not a course: it shows you how the exam asks about each product and explains why the wrong options are wrong, but it does not replace learning what Sentinel or Purview actually do. Use Microsoft's self-paced learning paths on Microsoft Learn for that, then use the 252 questions to test yourself and find the gaps.
When you are ready to test yourself properly, get the SC-900 practice questions with full explanations.
Sources
The official pages the facts in this guide were checked against.
- learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-900
- learn.microsoft.com/en-us/credentials/certifications/security-compliance-and-identity-fundamentals/
- learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
- learn.microsoft.com/en-us/credentials/certifications/exam-scoring-reports
- learn.microsoft.com/en-us/credentials/exam-pricing.json
- learn.microsoft.com/en-us/credentials/certifications/online-exams
- learn.microsoft.com/en-us/credentials/certifications/renew-your-microsoft-certification
- learn.microsoft.com/en-us/credentials/support/retake-policy