Microsoft Security, Compliance, and Identity Fundamentals
175 practice questions
Last reviewed: April 2026
Written from scratch against the official Microsoft exam guide
Personal notes and resource links for your study journey
Track your exams, notes, and resources day by day
Microsoft Security, Compliance, and Identity Fundamentals (SC-900) is a foundational credential that validates conceptual understanding of Microsoft's security, compliance, and identity (SCI) portfolio across Microsoft 365 and Azure. It is aimed at business stakeholders, IT generalists, sales and partner staff, compliance leads, and anyone new to security who needs a shared vocabulary for Microsoft Entra, Microsoft Defender, Microsoft Sentinel, Microsoft Purview, and Intune. The exam is conceptual rather than hands-on: expect to recognize service capabilities, identify which product addresses a given scenario (Zero Trust, DLP, conditional access, insider risk), and explain core principles of identity, encryption, and shared responsibility in plain language.
Foundational vocabulary: Zero Trust, defense in depth, the shared responsibility model, encryption and hashing basics, and the four identity pillars (administration, authentication, authorization, auditing). Lowest weight (12%) but the conceptual scaffolding the rest of the exam builds on.
Microsoft Entra ID (formerly Azure AD), external identities (B2B/B2C), conditional access, multifactor authentication, passwordless, Identity Protection, Privileged Identity Management, and Entra Permissions Management / Verified ID. About 28% of the exam - second-largest domain.
Largest domain (38%). Covers Microsoft Sentinel (cloud-native SIEM/SOAR), the Microsoft Defender XDR family (Defender for Endpoint, Office 365, Identity, Cloud Apps), Defender for Cloud, Azure network security (NSGs, Azure Firewall, DDoS Protection), and Azure Bastion. Expect scenario questions that ask which product fits which threat.
Microsoft Purview (compliance portal, information protection, DLP, insider risk management, eDiscovery, audit), Service Trust Portal, Compliance Manager, and resource governance via Azure Policy and Microsoft Purview Data Governance. About 22% of the exam.
Services you'll encounter on the exam and why each one matters.
Cloud identity and access management service that authenticates users, devices, and workloads against directory accounts, B2B/B2C external identities, and federated providers.
Why it's on the exam: Domain 2 (Capabilities of Microsoft Entra) anchors on Entra ID as the identity provider - expect questions on authentication, SSO, MFA, and tenant types.
Risk-based identity protection that detects sign-in anomalies, leaked credentials, and impossible-travel patterns, then enforces risk policies.
Why it's on the exam: Domain 2 tests risk-based conditional access; ID Protection is the named source of sign-in and user risk signals.
Decentralized identity service that issues and verifies tamper-proof digital credentials based on open standards (W3C DIDs, Verifiable Credentials).
Why it's on the exam: Domain 2 surfaces Verified ID as the decentralized-identity scenario - distinguishing claims-based verification from traditional directory lookups.
Just-in-time elevation and approval workflows for privileged roles in Entra ID, Azure resources, and Microsoft 365, with time-bound access and audit trails.
Why it's on the exam: Domain 2 tests least-privilege patterns; PIM is the named answer for "how do you grant admin access on demand without standing permissions."
Unified pre- and post-breach defense suite that correlates signals across endpoints, identities, email, cloud apps, and data into a single incident view.
Why it's on the exam: Domain 3 (Microsoft Security solutions) hinges on Defender XDR as the cross-workload incident-investigation surface.
Cloud-native application protection platform (CNAPP) that provides security posture management (CSPM) and workload protection (CWP) across Azure, AWS, and GCP.
Why it's on the exam: Domain 3 expects Defender for Cloud as the multicloud posture and workload-protection answer - secure score, regulatory compliance, and CWP plans surface in questions.
Cloud-native SIEM and SOAR built on Azure that ingests signals across the estate, hunts threats with KQL, and automates response via playbooks.
Why it's on the exam: Domain 3 names Sentinel as the SIEM/SOAR answer - questions test the SIEM vs. SOAR distinction and data-connector architecture.
Enterprise endpoint detection and response (EDR) platform with attack-surface reduction, next-gen antimalware, and automated investigation across Windows, macOS, Linux, iOS, Android.
Why it's on the exam: Domain 3 tests endpoint protection capabilities; Defender for Endpoint is the named EDR for device-level threat scenarios.
Protection for Microsoft 365 mailboxes, Teams, SharePoint, and OneDrive against phishing, business email compromise, and malicious attachments via Safe Links and Safe Attachments.
Why it's on the exam: Domain 3 includes email/collaboration threat scenarios; Defender for Office 365 is the named control for Safe Links / Safe Attachments / anti-phishing policies.
Cloud access security broker (CASB) that discovers shadow IT, applies session controls, and protects sanctioned SaaS apps via API connectors and reverse proxy.
Why it's on the exam: Domain 3 frames CASB scenarios - shadow-IT discovery, conditional access app control, and SaaS DLP all point to Defender for Cloud Apps.
On-premises Active Directory threat detection that surfaces reconnaissance, lateral movement, domain dominance, and Golden Ticket attacks from domain-controller traffic.
Why it's on the exam: Domain 3 covers hybrid identity threats - Defender for Identity is the named AD-focused detection layer distinct from cloud-only Entra ID Protection.
Unified endpoint management (UEM) for device enrollment, configuration, app deployment, and compliance evaluation across Windows, macOS, iOS, Android, and Linux.
Why it's on the exam: Domain 3 ties device compliance to Conditional Access - Intune supplies the compliance signal that gates resource access.
Sensitivity labels, encryption, and content-aware classification that travel with documents and emails across Microsoft 365 and approved third-party apps.
Why it's on the exam: Domain 4 (Microsoft compliance solutions) tests how labels classify and protect data at rest, in transit, and in use.
Policy engine that detects, blocks, or audits sensitive data in motion across Microsoft 365 services, endpoints, and on-premises SharePoint/OneDrive.
Why it's on the exam: Domain 4 names DLP as the canonical answer to "stop sensitive content from leaving the tenant" scenarios across email, Teams, and endpoints.
ML-driven detection of malicious or inadvertent insider activity - data exfiltration, departing-employee theft, policy violations - with pseudonymized investigation workflows.
Why it's on the exam: Domain 4 covers insider threat as a distinct compliance pillar; Insider Risk Management is the named workload.
Legal-hold, search, and export capabilities across Microsoft 365 content for litigation, investigation, and regulatory response, with eDiscovery (Premium) custodian workflows.
Why it's on the exam: Domain 4 tests legal/regulatory hold workflows - eDiscovery is the named tooling for preservation, search, and export.
Policy-as-code service that audits and enforces resource configuration across Azure subscriptions, with Blueprints packaging policies, role assignments, and ARM templates as a deployable unit.
Why it's on the exam: Domain 1 and Domain 4 reference policy enforcement as the mechanism behind governance baselines; Azure Policy + Blueprints is the named control.
Centralized portal for Microsoft cloud compliance documentation paired with Compliance Manager, which scores tenant compliance against frameworks like ISO 27001, NIST, and GDPR.
Why it's on the exam: Domain 4 explicitly tests Service Trust Portal and Compliance Manager as the surfaces customers use to evidence compliance posture.
Policy engine that evaluates signals - user, location, device state, app, risk - and enforces controls like MFA, compliant device, or session restrictions before granting access.
Why it's on the exam: Domain 2 treats Conditional Access as the central enforcement point for Zero Trust signals; expect scenario questions on policy assignment and exclusions.
Managed service for keys, secrets, and certificates with HSM-backed key protection, customer-managed key (CMK) integration, and access policies via RBAC or vault access policies.
Why it's on the exam: Domain 3 covers protecting secrets and CMK encryption scenarios - Key Vault is the named store across Azure workloads.
$65k-$92k-$130k USD annual
SC-900 is foundational and rarely the deciding factor in compensation - these ranges reflect early-career security and identity-adjacent roles in the US where SC-900 is one of several signals on the resume. Senior security roles (where SC-200, SC-100, AZ-500, or CISSP are expected) trend significantly higher.
Source: U.S. BLS OEWS May 2024 (15-1212 information security analysts, median ~$120k; 15-1232 computer user support, median ~$60k), levels.fyi 2025-2026 security and IT support roles. Figures are approximate; actual compensation depends on role, region, and experience.
Microsoft's security stack - Defender XDR, Sentinel, Purview, Entra, and Intune - is the default in a large share of enterprises that already run Microsoft 365 and Azure, which makes SC-900 one of the most widely-recognized entry-level security credentials. Recruiters use it as a screening signal that a candidate can speak the Microsoft security vocabulary in interviews even before they hold a hands-on role. It is especially common on resumes for help-desk, IT-generalist, compliance, and partner pre-sales staff who are pivoting toward security, and for non-technical stakeholders (project managers, account executives, GRC leads) who need credibility when discussing Zero Trust, conditional access, or DLP with security teams. By itself it does not qualify someone for analyst or engineer roles, but it pairs well with SC-200 or AZ-500 as the next step.
There are no formal prerequisites. Microsoft recommends familiarity with networking and cloud computing concepts, general IT literacy, and a basic understanding of Microsoft Azure and Microsoft 365 - but candidates with no Microsoft background regularly pass after working through the official Microsoft Learn path (~10-14 hours) and one practice assessment.
If you have never used Azure or Microsoft 365, completing AZ-900 (Azure Fundamentals) or MS-900 (Microsoft 365 Fundamentals) first will make SC-900 noticeably easier: many SC-900 questions assume you recognize core Azure resources and the M365 admin surface. The three "900-level" exams overlap meaningfully and are often taken together by candidates building a Microsoft cloud foundation. Hands-on labs are not strictly required, but a free Microsoft 365 developer tenant and an Azure free account let you click through Entra, Purview, and Defender portals, which sticks far better than reading alone.
SC-900 is rated foundational and is one of the more approachable Microsoft certifications. Plan for 20-40 hours of study over 2-4 weeks if you have no prior Microsoft cloud or security background, or 8-15 hours over a week if you already know AZ-900 / MS-900 territory. The exam runs about 45 minutes with roughly 40-60 multiple-choice and multiple-response questions; passing score is 700/1000 on a scaled scoring model.
The hardest part for most candidates is service-name recognition: the Microsoft security portfolio has been renamed and reorganized repeatedly (Azure AD became Entra ID, the Defender suite consolidated into Defender XDR, Microsoft 365 Compliance became Purview), and exam questions consistently test whether you can match the current product name to the right capability. Memorizing the role of each product - Defender for Endpoint vs. Defender for Cloud vs. Defender for Identity, Purview vs. Priva, Entra ID vs. Entra Permissions Management - is most of what separates passing from failing.
General availability April 2021 as part of the Microsoft Security, Compliance, and Identity Fundamentals track. Objectives are refreshed periodically (most recently to reflect the Azure AD → Entra rename and the Microsoft 365 Compliance → Purview rebrand); as a fundamentals exam it does not retire on a 1-year cycle and the credential does not expire.
It's Microsoft's foundational security certification - a non-coding overview of security, compliance, and identity concepts and the Microsoft solutions that deliver them (Entra ID, Microsoft Defender, Purview, and related tools). It suits anyone needing a grounding in Microsoft security, technical or business. The exam is around 40 questions in 45 minutes, passing at 700/1000. See the SC-900 hub.
It's an approachable fundamentals exam - concept-level, no hands-on, passable in one to two weeks for most people. The main work is learning the terminology across three areas (security, compliance, identity) and which Microsoft product addresses each. Practice questions are the quickest way to gauge readiness.
Yes, if you're moving toward security, compliance, or identity work, or need to prove baseline security literacy - it's cheap, quick, and a natural first step toward the role-based SC certs (SC-200, SC-300, SC-100). On its own it's foundational; see how it compares on our State of Certifications report.
It doesn't expire - like all Microsoft Fundamentals certifications, SC-900 is permanent once earned. (Only the role-based SC certs, such as SC-200 and SC-100, expire after 12 months and need free online renewal.)
Around 40 questions in 45 minutes, mostly multiple-choice and multiple-response (a few drag-and-drop or matching items can appear). You need a scaled 700/1000 to pass, and there's no penalty for wrong answers.
No - it costs $99 USD. Microsoft Learn study content is free and some events distribute exam vouchers, but the exam itself is paid. There's no permanently free version.
$99 USD, plus local tax. A failed attempt requires a 24-hour wait before retaking (14 days for further attempts). Scheduling and ID details are on our Microsoft exam info page.
No. It's a proctored, closed-book exam - at a test center or online with webcam monitoring - so no notes, internet, or outside help, and a room scan precedes an online attempt.
Register through the Microsoft Learn certification dashboard, which routes to Pearson VUE to choose a test center or online proctored slot. Our Microsoft exam info page walks through registration and ID requirements.
Follow the free Microsoft Learn "SC-900" paths to cover the three domains, then drill practice questions until you're consistently above 80%. Our SC-900 question bank covers every topic with explanations, and the Playbook distills the security, compliance, and identity concepts the exam emphasizes.
Common next steps are the role-based security certs: SC-200 (Security Operations Analyst), SC-300 (Identity and Access Administrator), or the SC-100 Cybersecurity Architect expert cert once you have more experience. Browse the full Microsoft security track to plan your path.
SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is a considered an entry-level exam testing breadth of conceptual understanding rather than hands-on depth Foundational-level exam. Most candidates need 30-80 hours of study spread over 3-6 weeks for foundational-level exams. Most candidates who score consistently above the passing threshold on practice exams pass on their first attempt.
Most candidates need 30-80 hours of study spread over 3-6 weeks for foundational-level exams. Time-to-pass varies widely by prior experience. Engineers with hands-on production experience in the underlying technology typically need less; candidates new to the platform should plan toward the upper end of that range.
Yes - for cloud engineers, architects, and consultants who work with Microsoft, SC-900 is generally worth it. It is a recognized credential that signals validated knowledge to employers, recruiters, and clients; whether the time and fee pay off for you depends on your role and goals.
The passing score for SC-900 is 700 / 1000. The exam contains 40 questions and lasts 45 min.
The SC-900 exam fee is $99 USD. Fees are set by Microsoft and may vary by region; always confirm the current price on the official Microsoft certification page before booking.
Microsoft fundamentals certifications never expire (AZ-900, AI-900, DP-900, SC-900).
Yes. You can take the exam online (proctored via the provider's secure browser, available 24/7 in most regions) or at an in-person Pearson VUE test center during business hours. Both formats use the same questions, time limit, and passing score.
The SC-900 exam-simulation mode on CertLabPro mirrors the real exam: 40 questions in 45 min, with the same 700 / 1000 passing threshold. You also get 15 study modes in total, and Browse mode renders every question with its answer and explanation statically.
$65k-$130k USD is the typical US salary range for roles that value SC-900, per U.S. BLS OEWS May 2024 (15-1212 information security analysts, median ~$120k; 15-1232 computer user support, median ~$60k), levels.fyi 2025-2026 security and IT support roles. Actual pay depends on seniority, location, and role - senior and architect positions trend higher, entry-level lower.
Yes - a focused month is realistic for most candidates. Most candidates need 30-80 hours of study spread over 3-6 weeks for foundational-level exams. If the Microsoft platform is new to you, give yourself more time; with hands-on experience you may need less.
Not really - SC-900 is an entry-level exam that assumes no prior hands-on experience, which makes it a common first certification.