SC-900 is the starting point for Microsoft's security, compliance and identity certifications, and it suits both IT people and non-technical stakeholders. This guide follows the skills outline updated October 21, 2026.
Exam at a glance
| Skill area | Weight |
|---|---|
| Concepts of security, compliance and identity | 10-15% |
| Capabilities of Microsoft Entra | 25-30% |
| Capabilities of Microsoft security solutions | 35-40% |
| Capabilities of Microsoft compliance solutions | 20-25% |
A score of 700 or above passes.
1. Concepts (10-15%)
Short section, easy points:
- Shared responsibility model
- Defense in depth
- Zero Trust (verify explicitly, least privilege, assume breach)
- Encryption versus hashing: encryption is reversible with a key, hashing is one-way
- Governance, risk and compliance (GRC)
- Identity as the primary security perimeter, plus authentication versus authorization, identity providers, directory services and federation
2. Microsoft Entra (25-30%)
- Identity types: users, groups, devices, workload identities, and hybrid identity
- Authentication: methods, MFA, password protection
- Access management: Conditional Access and Entra roles with RBAC
- Protection and governance: ID Governance, access reviews, Privileged Identity Management (PIM) and ID Protection
A simple way to keep them apart:
| Feature | Question it answers |
|---|---|
| Conditional Access | Under what conditions may this sign-in proceed? |
| PIM | Can admin rights be granted only when needed, and for a limited time? |
| Access reviews | Does this person still need this access? |
| ID Protection | Is this sign-in or user risky? |
3. Security solutions (35-40%)
The largest section. Group it by layer:
- Azure infrastructure security: DDoS Protection, Azure Firewall, WAF, NSGs, network segmentation, Bastion and Key Vault
- Security management: Microsoft Defender for Cloud, CSPM and workload protection
- Sentinel: know SIEM versus SOAR and what detection and response look like
- Defender XDR: Defender for Office 365, Endpoint, Cloud Apps, Identity, Vulnerability Management, threat intelligence and the Defender portal
Exam trick: match the product to the thing it protects. Email and collaboration points to Office 365, devices to Endpoint, SaaS apps to Cloud Apps, on-premises AD signals to Identity.
4. Compliance solutions (20-25%)
- Service Trust Portal and Microsoft's privacy principles
- Purview compliance management: the Purview portal, Compliance Manager and compliance score
- Information protection and governance: data classification, content and activity explorer, sensitivity labels and policies, DLP, records management, retention policies and labels
- Insider risk, eDiscovery and audit
Tip: sensitivity labels classify and protect content, while retention labels control how long it is kept.
Hands-on in a free tenant
A Microsoft 365 developer or trial tenant is enough to look at:
- Entra admin center: create a user, review authentication methods and a Conditional Access policy (use report-only mode)
- Defender portal: browse the dashboards and incidents view
- Purview portal: browse sensitivity labels and Compliance Manager
Even five minutes in each portal makes exam wording much easier to picture.
Study plan (2-3 weeks)
- Read the skills outline and mark anything unfamiliar.
- Work through the Microsoft Learn path.
- Build a one-page cheat sheet mapping each product to its purpose.
- Take the free practice assessment and review every miss.
Verify weights on the official SC-900 study guide before you book.
Which product do you mix up most: Sentinel, Defender XDR or Purview? Let me know below.
