CertiOverview
Exam format, the 700 passing score, domain weights, and a study plan.
Study guide · Core notes
Security, Compliance, and Identity Fundamentals Notes: concepts and services
Reference notes for SC-900: the ideas behind security and identity, then the Microsoft Entra, security, and Purview services the exam expects you to tell apart.
How to read these notes: Items tagged Extra sit outside the October 21, 2026 skill list emphasis, such as license SKUs and step-by-step portal design. Learn the unmarked items first. New to the exam? Start with the overview for the format and domain weights. Shared cloud vocabulary is on the Azure Fundamentals notes.
Domain 1: Security and compliance concepts
Start from the idea. The product name comes second.
| Idea | What to remember | Common mix-up |
|---|---|---|
| Shared responsibility | Customers own data, identities, and access. Microsoft owns the physical cloud. The customer share grows from SaaS to IaaS. | Treating every service model as the same split. |
| Defense in depth | Physical, identity, perimeter, network, compute, application, and data layers. | Relying on one firewall and calling the design finished. |
| Zero Trust | Verify explicitly, use least privilege, and assume breach. | Trusting a device because it sits on the office network. |
| Encryption | Reversible with a key. Protects confidentiality. Symmetric uses one key; asymmetric uses a key pair. | Calling a hash a form of reversible encryption. |
| Hashing | One-way digest for integrity checks. Password storage requires a purpose-built, salted password-hashing scheme, not a plain fast hash. | Expecting to decrypt a hash back to the original text. |
| GRC | Governance sets policy, risk management treats threats, and compliance checks requirements. | Using compliance score as a synonym for the whole GRC program. |
Extra License names such as Entra ID P1 or P2 are useful when you build a tenant. The study guide asks you to describe capabilities, not to memorize SKUs.
Apply shared responsibility to a concrete workload
Compare three versions of a small business application. On an Azure virtual machine, the customer maintains the guest operating system and application. With a managed application platform, Microsoft operates the underlying platform while the customer still secures application code and configuration. In a ready-made Microsoft 365 service, the customer still decides who has access, how information is shared, and which data controls are required. Moving to a managed service changes the task split; it does not transfer ownership of business decisions.
In a question, identify the service model and the specific component before choosing an owner. A physical host and a guest operating system are different components. A provider's audit report does not validate a customer's sharing settings. See Microsoft's shared responsibility guidance.
Confidentiality, integrity, and availability
Encryption helps keep content confidential. An integrity check helps reveal changes. Availability concerns keeping authorized access possible. These goals complement one another: an encrypted document can still be deleted, and a correctly hashed file can still be visible to the wrong people. A checksum is meaningful only when the expected value comes from a trusted source; replacing both a file and its published hash can defeat a naive comparison. Encoding such as Base64 is reversible representation, not encryption.
Identity concepts
Identity is the primary security perimeter because cloud resources are reached from many networks. A correct password still needs an authorization decision.
| Term | Meaning |
|---|---|
| Authentication | Proves who is asking. Passwords, authenticator apps, and security keys are methods. |
| Authorization | Decides what that identity may do after authentication succeeds. |
| Identity provider | Creates, maintains, and authenticates identity information for apps that trust it. |
| Directory service | A structured store of identities. Active Directory is the Microsoft on-premises directory. |
| Federation | A trust so users authenticate at their home identity provider and access a partner app. |
Domain 2: Microsoft Entra ID
Cloud identity for Azure, Microsoft 365, and apps that trust the tenant.
| Type | Who or what | Remember |
|---|---|---|
| User | A person in the tenant | Member and guest describe directory relationships and default access; the identity provider and granted permissions still matter. |
| Group | A set of users, devices, or other groups | Assign access to the group when many people need the same rights. |
| Device | A registered or joined computer or phone | Device state can become a Conditional Access signal. |
| Workload identity | An app, service, script, or container | Service principals and managed identities are the examples to recognize. A managed identity avoids a password stored in code. |
| Hybrid identity | The same person in Active Directory and Entra ID | Synchronization uses Microsoft Entra Connect or cloud sync. Sign-in can use password hash sync, pass-through authentication, or federation. |
Authentication methods include passwords, phone methods, OATH tokens, certificate-based authentication, and phishing-resistant options such as FIDO2 and Windows Hello for Business. Multifactor authentication combines factors: something you know, have, or are. Microsoft Entra Password Protection evaluates weak passwords when they are changed or reset. Smart lockout is a separate protection against repeated failed sign-ins. Self-service password reset lets a user recover an account with registered methods.
Factors, methods, and phishing resistance
MFA requires evidence from at least two different factor categories: knowledge, possession, or inherence. A password and a second memorized secret are both knowledge; two screens do not automatically mean two factors. A security key unlocked with a PIN or biometric can combine factors in one sign-in experience. Count the evidence, not the number of prompts. See the MFA explanation.
Passwordless and phishing-resistant are not interchangeable. SMS codes and ordinary push approvals can support MFA but should not be described as phishing-resistant. FIDO2/passkeys and Windows Hello for Business are examples of phishing-resistant methods. Extra Conditional Access authentication strengths can require an approved set of methods; configuration details go beyond the exam's capability-level emphasis. See authentication strengths.
A workload identity still needs authorization
A managed identity lets supported Azure workloads obtain tokens without a developer storing and rotating credentials. Enabling it does not grant access to every storage account or vault. The target service must authorize the identity for the required operation. For example, a function that only reads blobs needs appropriately scoped data access; a successful token request alone does not prove that it may read a blob. Network restrictions remain another independent check. See the managed identity overview.
Password Protection, smart lockout, and self-service password reset solve different problems. The first evaluates password quality at change or reset, the second limits repeated failed authentication, and the third helps an eligible user reset a password after verification. None replaces authorization. Review Password Protection when older material treats all three as one feature.
Access management, governance, and protection
| Capability | Question it answers |
|---|---|
| Conditional Access | Given this user, app, location, device, and risk, should sign-in be allowed, blocked, or challenged? |
| Entra roles | Who may administer directory objects, such as users and groups? |
| Azure RBAC | Who may manage Azure resources, such as a resource group? |
| Entra ID Governance | How is access requested, reviewed, and removed over its lifecycle? |
| Access reviews | Does this person or guest still need the access they already have? |
| Privileged Identity Management | Can this admin activate a privileged role only for a limited time? |
| Entra ID Protection | Is this user or sign-in risky, and should policy respond? |
A Global Administrator is a directory role. Owner is an Azure RBAC role. They are both powerful, and they govern different planes. Least privilege means choosing the narrower role that still completes the task.
Follow the access lifecycle
A contractor first receives approved access. Conditional Access evaluates conditions when the contractor accesses an application; it does not assign the application's business permissions. Access reviews later check whether the assignment should remain. If the contractor performs privileged administration, PIM can make the role eligible for limited activation instead of continuously active. ID Protection supplies identity-risk signals. These controls can work together, and PIM is part of Microsoft Entra ID Governance.
Sign-in risk concerns a particular authentication attempt; user risk concerns the likelihood that the identity is compromised. A risk detection is evidence to assess, not a complete investigation result. Conditional Access applies policy after first-factor authentication and can require controls or block access. It is not a network firewall or a substitute for application permissions.
An access-review decision must be applied before it changes the target assignment. Check automatic-application settings and review completion, then verify the resulting access. See the access review guidance.
Role assignments have both a capability and a scope. A directory role does not automatically grant access to every Azure resource or every application's data. Conversely, subscription Owner is not the same role as Global Administrator. In a scenario, state the task and scope before selecting a role; avoid treating the most powerful available role as the default answer.
Domain 3: Azure infrastructure security
Match the control to the layer in the stem.
| Service | Use it when |
|---|---|
| Azure DDoS Protection | Public endpoints must survive large volumetric floods. |
| Azure Firewall | Virtual network traffic needs a stateful firewall, FQDN rules, or threat intelligence filtering. |
| Web Application Firewall | HTTP and HTTPS applications need protection from common web attacks. |
| Virtual network segmentation | Workloads must be isolated into networks and subnets. |
| Network security groups | Subnet or NIC traffic must be allowed or denied by rule. |
| Azure Bastion | Admins need RDP or SSH in the browser without a public IP on the VM. |
| Azure Key Vault | Secrets, keys, and certificates must be stored and access-controlled. |
Layer controls without promising complete protection
An NSG matches network-flow properties such as source, destination, protocol, and port. A subnet is an address boundary, not an automatic deny rule: routing and security rules determine which traffic can pass. Azure Firewall provides centralized network controls and application rules; capabilities vary by tier. A WAF is specialized for web-request attack patterns. Do not reduce the distinction to “Firewall never inspects application traffic.”
A public website can need both WAF protection against malicious requests and DDoS mitigation against network floods. Neither control fixes every application vulnerability. Bastion provides a managed administrative connection path without requiring a public IP on each target VM, but administrators still need authentication, authorization, and permitted network connectivity. Key Vault centralizes secrets, keys, and certificates; access policies or Azure RBAC, network configuration, and logging remain part of the design.
Microsoft Defender for Cloud
Defender for Cloud is the posture and workload service for Azure and supported multicloud resources. Cloud Security Posture Management compares resources with policies and standards, then shows recommendations and a secure score. Cloud workload protection adds enhanced security features for workloads such as servers, containers, and databases.
Defender for Cloud secure score summarizes cloud security posture. Microsoft Secure Score in the Defender portal is a separate security-posture measure. Microsoft Purview Compliance Manager has a compliance score for improvement actions. Always identify the product and assessment scope before comparing numbers; none proves that a system is breach-proof or that an organization is legally compliant.
Posture findings are different from active attack alerts
A recommendation to restrict a storage account's exposure is a posture finding. An alert about suspicious activity on a workload is a threat-protection signal. CSPM helps identify and prioritize configuration weaknesses; workload protection detects and responds to threats on supported resources. Coverage depends on the enabled plans and onboarded resources.
Standards organize assessment requirements, and recommendations describe gaps and remediation. Do not assume that every regulatory finding directly changes secure score or that selecting a standard enforces all its controls. Read the security policy and standards documentation and distinguish score calculation from risk prioritization. Extra Microsoft Secure Score is a useful comparison when a screenshot comes from the Defender portal rather than Defender for Cloud.
Microsoft Sentinel
A SIEM collects and analyzes security data so analysts can detect threats. SOAR orchestrates and automates response. Microsoft Sentinel supports both. Analytics rules can generate alerts and, when configured, group them into incidents. Automation rules can invoke playbooks built on Azure Logic Apps; connectors, permissions, and configured actions determine what a workflow can do.
Sentinel analyzes Microsoft and non-Microsoft data sources. Defender XDR correlates signals across its security services. Both can appear in the Microsoft Defender portal and their incident experiences integrate, so a portal name alone does not identify the capability. Look for the requested job: cross-product Defender detection, broader SIEM ingestion and analytics, or SOAR response.
Detection does not imply successful remediation
An incident can exist even when no playbook has been attached. A workflow can start and still fail because a connector lacks permission or a downstream service is unavailable. Follow the sequence: data arrives, an analytic identifies a pattern, an alert or incident is created, and configured automation attempts an action. Confirm the action outcome separately. See Sentinel automation.
For SC-900, learn the capabilities rather than a fixed navigation path. The Defender portal integration means the portal can host both Sentinel and Defender XDR workflows. A question about third-party firewall ingestion points toward SIEM; a question explicitly about correlating Defender product signals points toward XDR.
Threat protection with Microsoft Defender XDR
Learn which Defender watches which asset. The October 21, 2026 guide calls the intelligence objective Microsoft Threat Intelligence.
| Service | Asset or job |
|---|---|
| Defender for Office 365 | Email, links, attachments, and collaboration threats. |
| Defender for Endpoint | Devices such as laptops and servers. |
| Defender for Cloud Apps | SaaS discovery, shadow IT, and session control. This is not Defender for Cloud. |
| Defender for Identity | On-premises Active Directory signals and identity attacks. |
| Defender Vulnerability Management | Weaknesses and insecure device configuration. |
| Microsoft Threat Intelligence | Threat intelligence used with Defender. Older guides may say Microsoft Defender Threat Intelligence. |
| Microsoft Defender portal | The unified place to investigate alerts across these services. |
Use threat intelligence as context
Threat intelligence adds context about malicious infrastructure, attacker techniques, and campaigns. It helps analysts prioritize and investigate observations; a reputation result is not automatic proof that an organization was breached. Defender Vulnerability Management instead identifies exposures such as vulnerable software and insecure configuration. A machine can have a vulnerability without a confirmed attack, and an incident can occur without a previously cataloged vulnerability.
Domain 4: Service Trust Portal and privacy
The Service Trust Portal is where customers obtain Microsoft audit reports, trust documents, and compliance resources about Microsoft services. It describes Microsoft’s controls. It does not list your tenant’s improvement actions.
Microsoft’s privacy principles, as published for this fundamentals story, include control, transparency, security, strong legal protections, no content-based targeting, and benefits to the customer. Confirm the current wording on the Microsoft Trust Center if a question quotes a principle.
Microsoft Purview compliance management
The Microsoft Purview portal is the compliance surface. Compliance Manager assesses your controls against regulations and tracks improvement actions. The compliance score measures progress on those actions. A high score is not an external certification and is not the SC-900 exam score.
Information protection, lifecycle, and investigations
Three families: classify and protect, keep or delete, and investigate.
| Capability | Use it when |
|---|---|
| Data classification | Sensitive information types or trainable classifiers must find sensitive data. |
| Content explorer | You need to see where sensitive or labeled content sits. |
| Activity explorer | You need to see what people did with that sensitive content. |
| Sensitivity labels | Content must be classified and optionally marked or encrypted. |
| Sensitivity label policies | Those labels and policy settings must be published to selected users and groups. |
| Data loss prevention | Sharing of sensitive information must warn or block. |
| Records management | Items need record declaration, lifecycle controls, and, when configured, disposition review. |
| Retention policies | Selected locations, such as mailboxes or sites, need common retention settings. |
| Retention labels | Specific items need retention settings; label policies can publish or auto-apply labels. |
| Insider risk management | Potential data-risk behavior needs policy-based detection and human investigation. |
| eDiscovery | Legal or regulatory matters need search, hold, and export. |
| Audit | Investigators need to search user and admin activity. |
Insider risk management watches what a person does with data. Defender for Identity watches attacks against the on-premises directory. Both can involve a user account, and they remain different products.
Classification, publication, and enforcement are separate
A classifier identifies a data category. A sensitivity label records a classification and may apply protection. A label policy makes labels available to selected people and defines related settings. DLP evaluates content and activities within configured coverage, then can audit, warn, restrict, or block according to policy. A label named Confidential does not imply that encryption is enabled, and a DLP policy in simulation does not mean sharing is blocked. See DLP capabilities.
Extra A sensitivity label on a team or site controls supported container settings. Files inside do not automatically inherit item-level encryption from that container label. This boundary helps explain why site access and document protection must be checked independently. See labels for groups and sites.
Retention is more than “keep everything”
Retention can retain content, delete it after a period, or retain and then delete. Policies commonly apply settings across selected sites or mailboxes; labels support item-level requirements. A label policy publishes or automatically applies retention labels. A retention label and a sensitivity label can address different requirements on the same document.
Users may remove an item from their normal view while a retained copy remains preserved. An applicable retention requirement or eDiscovery hold can prevent permanent deletion even when another setting requests deletion. Do not promise immediate erasure simply because a user clicked Delete or one retention period ended. See retention behavior and precedence. A practice scenario's seven-year or ten-year period is an example requirement, not advice about the period your organization must adopt.
Investigations need evidence and appropriate access
Audit searches activity records. eDiscovery identifies and preserves relevant content for a case. Insider risk management brings together configured behavioral indicators for review. An unusual download could be legitimate work; an alert is a reason to investigate, not proof of misconduct. Limit access to the people authorized to investigate and use the product's privacy controls. See the insider risk privacy guide. The tools assist an investigation; they do not make legal or employment decisions.
Worked scenarios
| Constraint | Best match | Why the neighbor loses |
|---|---|---|
| A function must read storage without a password in code | Managed identity, a workload identity | A guest user is a person from another tenant. |
| MFA only when the device is unmanaged and off-network | Conditional Access | Turning on MFA for every sign-in ignores the conditions in the stem. |
| Privileged role available only during a change window | Privileged Identity Management | A standing Owner or Global Administrator assignment stays active. |
| Injection attacks against a public website, plus a volumetric flood | Web Application Firewall and DDoS Protection | An NSG can limit ports. It does not parse HTTP payloads or absorb a flood by itself. |
| Phishing email that later alerts on the laptop | Defender for Office 365 and Defender for Endpoint, investigated in Defender XDR | Defender for Cloud Apps would fit a shadow-IT SaaS stem instead. |
| Encrypt finance files, block external sharing, keep them ten years | Sensitivity label, DLP, and retention | Any one of the three leaves two requirements unmet. |
Four guided exercises with answer checks
These exercises need no paid tenant, deployment, or real personal data. Write a short answer before revealing the explanation. They practice the service distinctions in SC-900; portal configuration remains optional extra study.
1. Separate identity from permission
A function has a managed identity and obtains a token, but reading a blob is denied. Another administrator proposes giving it Global Administrator. Identify the two decisions already demonstrated and the narrower area to investigate.
Check the reasoning: identity and access
Token acquisition establishes an authentication path. The denied operation requires investigation of target-resource authorization and its scope; network restrictions may also matter. Granting a broad directory role is not the appropriate default fix for blob data access. A managed identity removes credential management, not permission management.
2. Distinguish a recommendation from an incident
One dashboard recommends removing public access from storage. Another shows a suspicious device process. A third ingests a third-party firewall log and starts a ticket workflow. Name the capability involved in each observation.
Check the reasoning: posture, detection, response
The storage recommendation is CSPM in Defender for Cloud. The device alert fits Defender for Endpoint, with cross-service investigation available through Defender XDR. Broad log ingestion and analytic detection fit Sentinel SIEM; the ticket workflow is SOAR. Verify the workflow result rather than treating its start as successful remediation.
3. Protect a document through its lifecycle
A fictional finance file must be encrypted for approved readers, prevented from being shared externally, and retained for a stated period. The document is later relevant to a legal hold. Explain why one label name cannot establish that every requirement is satisfied.
Check the reasoning: protection and retention
Check the sensitivity label's encryption settings, a DLP policy's conditions and enforcement, and retention settings separately. A legal hold can preserve relevant content despite a deletion request. The organization's authorized policy owners determine the required retention period and release of holds.
4. Choose evidence for the question being asked
A customer requests Microsoft's independent audit report. An internal team wants to prioritize its compliance actions. An investigator needs the history of an administrator's changes. Identify three evidence sources and explain what none of them proves alone.
Check the reasoning: reports, actions, activity
Use the Service Trust Portal for Microsoft's reports, Compliance Manager for assessed improvement actions, and Purview Audit for available activity records. A provider report does not audit the customer's configuration; a score does not certify legal compliance; an activity record requires context before drawing conclusions.
After each exercise, change one requirement and choose again. For example, replace “keep content” with “identify suspicious sharing,” or replace “activate an admin role” with “review guest membership.” Explaining why the nearest alternative no longer fits is stronger evidence of understanding than remembering an answer letter.
Frequently asked questions
What is the difference between Conditional Access and Privileged Identity Management?
Conditional Access evaluates sign-in signals and can allow, block, or require controls such as MFA. Privileged Identity Management gives eligible administrators time-bound activation of privileged roles. Both can require MFA, but the two products answer different questions.
Which Defender product matches email, devices, on-premises identity, and SaaS apps?
Defender for Office 365 protects email and collaboration. Defender for Endpoint protects devices. Defender for Identity watches on-premises Active Directory. Defender for Cloud Apps discovers and governs SaaS application use. Microsoft Defender XDR correlates those signals in the Microsoft Defender portal.
How do sensitivity labels differ from retention labels?
Sensitivity labels classify content and can apply markings or encryption. Retention labels and retention policies decide how long content is kept and when it can be deleted. A sensitivity label policy publishes sensitivity labels to users. Data loss prevention can block sharing of the labeled or classified content.
Service names and portal labels change. Use the current Microsoft study guide as the authority when it differs from these notes.
Continue the Security, Compliance, and Identity Fundamentals study path
Drill the distinctions, then test them under a timer.
Core Notes
Reference notes for concepts, Entra, Defender, Sentinel, and Purview.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for identity, security, and compliance.
Practice Exams
80 original questions with custom exams, explanations, and a score report by domain.
Related Study Paths
Connect these notes with adjacent skills and certification topics.
Azure Fundamentals
A learning path for Microsoft Certified: Azure Fundamentals (AZ-900).
Cloud and AI Security Engineer
A learning path for Cloud and AI Security Engineer Associate (SC-500).
CompTIA Security+
A learning path for the CompTIA Security+ (SY0-701) exam.
AWS Security Specialty
A learning path for the AWS Certified Security - Specialty exam.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.