SC-900 Security Fundamentals Study Guide for 2026

The Microsoft Security, Compliance, and Identity Fundamentals (SC-900) certification is a common first step for IT professionals moving into security. This SC-900 study guide covers what the exam tests, domain by domain, for people changing careers into cybersecurity and for those who want to confirm what they already know.

About the SC-900 Certification

SC-900 is Microsoft's entry-level security certification. It covers the basics of security, compliance and identity. Advanced certifications expect hands-on experience; SC-900 tests concepts and knowledge of what Microsoft's security and compliance products do.

Who Should Take SC-900

The exam suits:

• IT professionals starting out in security
• Help desk and support staff moving toward security roles
• Compliance and risk management professionals
• Non-technical managers overseeing security initiatives
• Project managers working on security implementations
• Anyone preparing for advanced Azure security certifications like SC-500

Many people take SC-900 before attempting harder certifications. It also suits people in non-technical roles who need to understand security but will not implement it.

Exam Format and Scoring

Exam details:

• Duration: 45 minutes
• Question count: 40-60 questions
• Passing score: 700 out of 1000
• Question types: Multiple choice, drag-and-drop, and case studies
• Languages: Available in multiple languages
• Delivery: Online proctored or testing centre

The exam checks that you understand security principles, can pick the right Microsoft product for a need and can apply compliance concepts to realistic scenarios. Many questions describe a situation and ask you to choose the best of several solutions.

SC-900 Exam Domains Breakdown

The SC-900 exam has four domains, each with its own weighting. Use the weights to decide how to split your study time.

Domain 1: Security, Compliance, and Identity Concepts (10-15%)

This domain covers the terms and principles behind all of Microsoft's security products.

Zero Trust Architecture

Zero Trust replaces perimeter-based security with verification of every request. The core principle is "never trust, always verify": every access request must be authenticated and authorised, wherever it comes from.

Zero Trust principles:

• Verify explicitly using available data points (user identity, device, service, location, data classification)
• Use least privilege access with just-in-time and just-enough-access (JIT/JEA)
• Assume breach and minimise blast radius through segmentation and microsegmentation
• Encrypt data in transit and at rest
• Monitor and analyse all traffic and log data
• Automate remediation when possible

Traditional security models trust everything inside the network perimeter. Zero Trust keeps verifying.

Defence in Depth

Defence in depth (also called layered defence) stacks several security layers, so that if one is breached the others still protect the system. Microsoft's layers are:

• Physical security (data centre access controls)
• Network security (firewalls, DDoS protection, network segmentation)
• Application security (input validation, secure coding)
• Data security (encryption, classification, access controls)
• Identity and access management (MFA, Conditional Access)

Shared Responsibility Model

In the cloud, security is split between Microsoft and the customer, and the split depends on the service type:

For Software as a Service (SaaS) like Microsoft 365:
- Microsoft secures the infrastructure, platform, and application
- Customers secure user access, data, accounts, and devices

For Platform as a Service (PaaS) like Azure App Service:
- Microsoft secures infrastructure and platform
- Customers secure application code, data, and access

For Infrastructure as a Service (IaaS) like Virtual Machines:
- Microsoft secures physical hardware and networking
- Customers secure operating systems, applications, data, and access

Knowing this model stops you assuming Microsoft handles security that is still your job.

Domain 2: Microsoft Entra ID Capabilities (25-30%)

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's identity service. This domain carries the second-largest weighting on the exam, so it deserves a large share of your study time.

Authentication vs. Authorisation

Authentication verifies who someone is. Authorisation determines what they can access.

• Authentication: "Are you really John Smith?" (Username/password verification)
• Authorisation: "Can John Smith access the payroll system?" (Permission verification)

Authentication Methods

Passwords are only one of the options:

• Password authentication (basic but vulnerable)
• Multi-factor authentication (MFA) requiring multiple proof types
• Passwordless sign-in using Windows Hello, FIDO2 keys, or Microsoft Authenticator app
• Certificate-based authentication for devices and services

Single Sign-On (SSO)

With SSO, users sign in once and can open several applications without signing in again. After you sign into Microsoft 365, OneDrive, Teams and the other apps open without asking for credentials.

Entra ID is the identity provider for SSO, particularly for cloud applications and services integrated with Microsoft 365.

Multi-Factor Authentication (MFA)

MFA requires at least two verification methods before granting access, drawn from:

• Something you know (password or PIN)
• Something you have (phone or hardware token)
• Something you are (biometric like fingerprint or facial recognition)

MFA greatly reduces the risk of account compromise, even when a password has been stolen.

Conditional Access

Conditional Access policies set access requirements based on conditions. For example:

• Require MFA for users accessing resources from outside the corporate network
• Block access from high-risk locations
• Require compliant devices for sensitive applications
• Require password change for risky sign-ins

The requirements change with the risk of each sign-in.

Identity Governance

Identity governance keeps each user's access right for the whole time they are with the organisation:

• Onboarding: Granting necessary access when joining
• Ongoing: Keeping access appropriate as roles change
• Offboarding: Removing access when departing

Entra ID Governance provides access reviews, entitlement management, and lifecycle workflows.

Domain 3: Microsoft Security Solutions (35-40%)

This is the largest domain. It covers Microsoft's security products for endpoints, cloud infrastructure and threat intelligence.

Microsoft Defender Suite Overview

Microsoft Defender is a family of products that share signals:

Defender for Cloud

Defender for Cloud protects workloads in Azure, on-premises and in other clouds. It provides:

• Continuous vulnerability assessment for VMs and container registries
• Security posture management showing compliance gaps
• Cloud security posture management (CSPM) analysing misconfigurations
• Threat protection detecting suspicious activities
• Regulatory compliance tracking against standards like PCI-DSS and HIPAA

Defender for Endpoint

Defender for Endpoint protects devices (Windows, Mac, Linux) through:

• Behavioural threat detection identifying suspicious actions
• Automated investigation and remediation reducing response time
• Threat and vulnerability management identifying weaknesses
• Attack surface reduction blocking attack vectors before exploitation
• Device discovery finding and inventorying all devices on the network

Defender for Office 365

Defender for Office 365 protects Microsoft 365 against threats:

• Safe Attachments detects malware in email attachments before they reach inboxes
• Safe Links protects against malicious URLs in emails and documents
• Anti-phishing policies identify spoofed senders and suspicious messages
• Anti-spam filtering reduces unwanted email volume

Defender for Cloud Apps

Defender for Cloud Apps provides visibility and control over cloud applications:

• Cloud Discovery identifies shadow IT applications users access
• Information protection preventing data leakage
• Threat detection identifying suspicious behaviour
• Risk-based access controls adjusting permissions based on risk

Defender for Identity

Defender for Identity uses on-premises signals to detect identity-based attacks:

• Lateral movement detection identifying suspicious movement between systems
• Compromise assessment identifying exposed credentials and weak protocols
• Domain dominance detection preventing complete network compromise

Security Information and Event Management (SIEM) and Extended Detection and Response (XDR)

Microsoft Sentinel is Microsoft's SIEM. It collects security data from across the environment. Microsoft's XDR (extended detection and response) correlates signals from the Defender products so threats can be seen across all of them.

Threat Intelligence and Attack Simulation

Microsoft's threat intelligence is built into its security products. Attack simulation tools let organisations test security controls and user awareness without a real attack.

Domain 4: Microsoft Compliance Solutions (20-25%)

Organisations have to meet regulatory requirements and industry standards. Microsoft Purview is Microsoft's compliance product family.

Microsoft Purview Overview

Purview brings together compliance management, information protection and data governance:

Compliance Manager

Compliance Manager tracks regulatory requirements and compliance status:

• Shows compliance gaps against standards (GDPR, HIPAA, PCI-DSS, ISO 27001, etc.)
• Provides detailed improvement actions with guidance
• Tracks control implementation progress
• Generates compliance reports for auditors and regulators
• Calculates compliance score showing overall posture

Information Protection and Data Lifecycle Management

Organisations need to protect sensitive data and control how long it is kept:

• Sensitive information types identify data patterns (credit card numbers, social security numbers, medical records)
• Sensitivity labels classify information (Public, Internal, Confidential, Highly Confidential)
• Automatic labelling applies labels based on content patterns
• Content retention policies maintain data according to legal holds and regulations
• Records management declares data as records preventing deletion until retention expires

Data Loss Prevention (DLP)

DLP prevents accidental or intentional data exposure:

• Policy rules identify sensitive data in emails and documents
• Automatic enforcement blocks transmission or alerts users
• Endpoint DLP extends protection to devices
• Reports show policy violations, which helps identify problem behaviour

Data Governance with Purview Data Map

Purview Data Map catalogues data across the organisation:

• Automated scanning discovers data sources
• Classification automatically applies sensitivity labels
• Lineage tracking shows data flow from source to consumption
• Asset ownership assignment ensures accountability
• Access management controls who can view and modify data

eDiscovery Solutions

For legal proceedings and investigations, eDiscovery tools:

• Search for potentially relevant data across email, SharePoint, OneDrive
• Collect and preserve findings while maintaining legal hold
• Review content with advanced filtering
• Generate compliance reports for legal teams

Concepts the SC-900 Exam Tests Most

These concepts come up often on the exam and are worth knowing well.

Zero Trust Principles in Practice

Zero Trust questions usually describe a scenario and ask which solution fits. For example: "An organisation wants to ensure remote workers cannot access sensitive data from personal devices."

Zero Trust response: Conditional Access that requires managed devices and MFA. Checking device compliance on every request follows "never trust, always verify".

Shared Responsibility in Different Service Models

Expect questions on who is responsible for what in each service type. With a SaaS product like Microsoft 365, Microsoft takes on more of the security work than with IaaS. Getting this wrong is a common exam mistake.

Authentication Scenarios

The exam asks you to recommend authentication solutions for specific situations:

• Scenario: "Users frequently forget passwords." Solution: Implement passwordless sign-in using Windows Hello or Authenticator app.
• Scenario: "Competitors are in the same building." Solution: Implement location-based Conditional Access policies.
• Scenario: "Finance staff access from various locations." Solution: Implement MFA for sensitive application access.

Defender Product Distinctions

The Defender products have similar names. Learn which product handles which threat:

• Detecting malware in email attachments? Defender for Office 365 Safe Attachments
• Protecting virtual machines? Defender for Cloud or Defender for Endpoint
• Detecting lateral movement attacks? Defender for Identity
• Protecting cloud applications? Defender for Cloud Apps

Compliance Standards and Regulations

You need to know what each regulation is for, not its detailed text:

• GDPR (General Data Protection Regulation): Protects personal data of EU residents
• HIPAA (Health Insurance Portability and Accountability Act): Protects health information
• PCI-DSS (Payment Card Industry Data Security Standard): Protects payment card data
• SOX (Sarbanes-Oxley): Ensures financial record accuracy

Know which Purview features address specific compliance needs.

Study Resources and Preparation Strategy

Microsoft Learn SC-900 Path

Microsoft's free official SC-900 learning path covers every exam domain. It is self-paced and includes:

• Video explanations of security concepts
• Interactive knowledge checks validating understanding
• Hands-on labs (limited in SC-900) exploring Azure services
• Downloadable study guides for offline review

Find it on Microsoft Learn under "Security, Compliance, and Identity Fundamentals."

AzurePrep Practice Tests

Practice tests are the other half of preparation. AzurePrep offers practice questions for every live certification, with a free preview of SC-900 before you subscribe and SC-900 questions for every domain. AzurePrep's SC-900 practice tests give you:

• Questions reflecting actual exam format and difficulty
• Detailed explanations for correct and incorrect answers
• Performance analytics identifying weak areas
• Multiple practice sets, so you cannot simply memorise specific questions

AzurePrep practice tests run under exam conditions, so you find your gaps before exam day. Many users find that pairing Microsoft Learn with AzurePrep practice questions works best.

Recommended Study Schedule

For someone with basic IT knowledge:

• Week 1: Complete Microsoft Learn SC-900 path (15-20 hours)
• Week 2: Review complex domains (Entra ID and Defender products)
• Week 3: Complete 2-3 full-length AzurePrep practice tests
• Week 4: Review weak areas and take final practice tests
• Exam day: Take the official SC-900 exam

For someone with security background:

• Week 1: Skim Microsoft Learn for unfamiliar Microsoft-specific concepts
• Week 2: Complete AzurePrep practice tests identifying gaps
• Week 3: Study weak areas in depth using Microsoft Learn
• Exam day: Take the official SC-900 exam

Total preparation typically takes 3-4 weeks (around 20-30 hours) for most candidates.

Supplementary Resources

Beyond Microsoft Learn and AzurePrep:

• YouTube channels covering SC-900 concepts with visual explanations
• Microsoft security documentation for more detail on specific topics
• Official exam guide from Microsoft describing domains and objectives
• Study groups and forums discussing difficult concepts

Common Exam Mistakes

Zero Trust Misunderstandings

Many candidates think Zero Trust means denying all access. Zero Trust requires:

• Verification (not denial) of every request
• Least privilege (minimum necessary access, not no access)
• Continuous monitoring (not just initial verification)

In Zero Trust scenario questions, the correct answer usually involves verification and monitoring rather than blocking access.

Shared Responsibility Confusion

Candidates often overestimate how much security Microsoft handles in SaaS scenarios. Remember:

• In Microsoft 365 (SaaS), users still control user access, data, and devices
• Microsoft handles underlying infrastructure and platform security
• Customers bear responsibility for enabling security features like MFA

Product Feature Attribution

Candidates lose marks by assigning a capability to the wrong Defender product:

• Safe Attachments (Office 365) not Endpoint
• Attack surface reduction (Endpoint) not Cloud
• Behavioural threat detection (Endpoint) not Identity

Review each product's capabilities before the exam.

Compliance Solutions Confusion

The Purview features are also easy to mix up:

• Compliance Manager shows compliance status and gaps
• DLP prevents data loss
• Information protection labels and protects data
• eDiscovery finds and preserves data for legal matters

Conditional Access Limitations

Candidates sometimes assume Conditional Access covers more than it does. It applies to cloud applications, with limits:

• Cannot enforce policies on legacy on-premises applications
• Requires properly configured Entra ID tenant
• Device compliance checks require Intune enrolment for personal devices

Rule out answers that ask Conditional Access to do something outside these limits.

Final Preparation Tips

Practice Under Exam Conditions

Use AzurePrep practice tests in exam mode: timed, with no review until you finish. This builds stamina and speeds up your decisions.

Focus on Scenario Questions

SC-900 questions often describe a business scenario and ask for a solution. Practise choosing the best answer from several similar options.

Understand the "Why"

Learn why each solution fits the problem it solves, instead of memorising facts. That reasoning carries over to question wordings you have not seen.

Review Weak Areas Early

Use practice tests to find the topics you struggle with, and work on them well before the exam instead of cramming at the end.

Take Care of Basics

• Get adequate sleep the week before
• Eat well the day of the exam
• Arrive early to reduce stress
• Read questions carefully before answering

SC-900 confirms foundational security knowledge that applies across IT roles.