Study guide · Exam overview
The format, passing score, and four content domains of Microsoft Certified: Security, Compliance, and Identity Fundamentals, plus the service distinctions worth practicing before you book SC-900.
Exam version notice: This overview follows the Microsoft study guide for Exam SC-900, skills measured as of October 21, 2026. The exam code is still SC-900. That update kept the same domain weights and made two minor objective changes: identity types now include workload identities, and the Defender XDR threat-intelligence objective is named Microsoft Threat Intelligence. Pricing, languages, and delivery options can change. Confirm them on the Microsoft certification site before you register. Items tagged Extra are useful context that the study guide does not name as a measured skill. General Azure vocabulary is on the AZ-900 overview.
Microsoft Certified: Security, Compliance, and Identity Fundamentals checks whether you can describe security, compliance, and identity concepts and the Microsoft services that implement them. It is aimed at business stakeholders, students, and new or existing IT professionals who already know Microsoft Azure and Microsoft 365 at a familiar level.
The exam stays conceptual. You match a need to a concept or a service: Zero Trust versus defense in depth, Conditional Access versus Privileged Identity Management, Defender for Endpoint versus Defender for Office 365, a sensitivity label versus a retention label. You do not configure a production tenant. AZ-900 helps with shared cloud vocabulary. It is not a required prerequisite. SC-900 can prepare you for role-based work such as Cloud and AI Security Engineer Associate (SC-500), but it is not a prerequisite for that exam. Azure Security Engineer Associate (AZ-500) retired on August 31, 2026.
Figures below come from the SC-900 certification page, the study guide, and Microsoft’s fundamentals exam-duration guidance, reviewed in November 2026.
| Specification | SC-900 |
|---|---|
| Level | Beginner fundamentals for security, compliance, and identity. No prerequisite certification is required. |
| Length of test | 45 minutes to complete the assessment for fundamentals exams. Plan about 65 minutes of seat time including instructions and the candidate agreement. Confirm the time shown when you schedule. |
| Number of questions | Microsoft does not publish a fixed count on the certification page. Do not treat a practice length as the live exam length. |
| Passing score | 700 or greater on a scale of 1 to 1,000. A scaled score is not the percentage of questions you answered correctly. |
| Recommended experience | Familiarity with Microsoft Azure and Microsoft 365. Hands-on portal exploration helps, but the exam asks you to describe capabilities. |
| Exam price | Price depends on the country or region where the exam is proctored. Confirm the current fee when you schedule. |
| Validity | Microsoft fundamentals certifications do not expire. Confirm the current policy with Microsoft. |
| Delivery | Schedule through Pearson VUE, or Certiport for students and educators. English is updated first; localized updates may follow later. |
A blank answer earns no credit. Microsoft exams do not subtract extra points for a wrong answer, so answer every question. If the exam is not offered in your preferred language, you can request an additional 30 minutes. Request accommodations before you sit if you need them.
These ranges are the share of scored content in the study guide dated October 21, 2026. Our 80-question bank uses the midpoints: 10, 22, 30, and 18 questions (12.5%, 27.5%, 37.5%, and 22.5%). Each share falls within its published range. These are not a prediction of your exam.
Name the idea before you name a product.
Identity types, sign-in, and privileged access.
The largest share. Match the control to the asset.
Trust documents, then Purview controls.
The study guide names distinctions more often than slogans. Learn the paired choices first. The same map is in the core notes and flashcards.
| Need | Choose | Remember |
|---|---|---|
| Prove who someone is, then decide what they may open | Authentication, then authorization | A successful sign-in does not grant every file. |
| Verify every request and limit privilege | Zero Trust | The three principles are verify explicitly, least privilege, and assume breach. |
| An app or script that needs its own identity | Workload identity | Service principals and managed identities are the usual examples. The October 21, 2026 objective names them. |
| Require MFA outside the office on an unmanaged device | Conditional Access | MFA requires multiple factor categories. Conditional Access is a policy that can require it. |
| Activate a privileged role only for a short window | Privileged Identity Management | An eligible assignment requires activation; a standing active assignment leaves privilege available continuously. |
| Filter HTTP attacks on a public website | Azure Web Application Firewall | Azure Firewall and NSGs filter network traffic. DDoS Protection addresses volumetric floods. |
| Email phishing versus a laptop malware alert | Defender for Office 365 versus Defender for Endpoint | Defender for Identity watches on-premises Active Directory. Defender for Cloud Apps watches SaaS use. |
| Collect security logs and automate a response | Microsoft Sentinel | SIEM detects. SOAR playbooks respond. Sentinel provides both. |
| Encrypt a file and also keep it for seven years | Sensitivity label plus retention | Sensitivity labels classify and protect. Retention labels and policies decide how long content is kept. |
| Extra Build a full Conditional Access design or a KQL hunting query | Out of the SC-900 fundamentals scope | Useful for SC-500. October 21, 2026 skills stay at describing capabilities. |
Microsoft points candidates to an exam sandbox so you can try the interface. The current certification page also links to the official Practice Assessment on AI Skills Navigator, which requires sign-in. This site’s practice questions are single-answer multiple choice. They practice the distinctions in the study guide. They are not a claim about the live item mix.
A typical stem gives a constraint and asks for the best service or concept. Guests must be reviewed. A function needs a managed identity. A website must survive injection attacks. Distractors are nearby Microsoft features that solve a different problem. Conditional Access is not PIM. Defender for Cloud is not Defender for Cloud Apps. A compliance score is not a certification. A sensitivity label is not a retention label.
There is no published extra penalty for a wrong guess. A blank answer earns nothing. On a timed practice exam, answer every item, then use the review to see which domain actually needs work.
A practical sequence if you already use Microsoft 365 but mix up the security product names.
Shared responsibility, defense in depth, Zero Trust, encryption versus hashing, and authentication versus authorization.
Identity types including workload identities, hybrid identity, MFA, Conditional Access, roles versus RBAC, PIM, and ID Protection.
Network controls and Key Vault, Defender for Cloud, Sentinel, then each Defender XDR product.
Service Trust Portal, Compliance Manager, labels, DLP, retention, insider risk, eDiscovery, and audit.
Use the four decks until you can answer before the card flips. Revisit misses the next day.
Work through original questions, review every explanation, and return to the notes on domains below 75 percent. Before booking, check every objective; a repeated-bank percentage is not evidence of exam readiness. Use 45 minutes as the pace of the live fundamentals exam.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 700 passing score, domain weights, and a study plan.
Reference notes for concepts, Entra, Defender, Sentinel, and Purview.
40 recall cards in four decks, plus memory notes for identity, security, and compliance.
80 original questions with custom exams, explanations, and a score report by domain.
A score of 700 or greater is required to pass. Microsoft reports scores on a scale of 1 to 1,000. A scaled score is not the percentage of questions you answered correctly.
SC-900 is a fundamentals exam. Microsoft fundamentals exams give you 45 minutes to complete the assessment, with about 65 minutes of seat time including instructions and the candidate agreement. Confirm the time shown when you schedule.
The study guide dated October 21, 2026 measures four areas: concepts of security, compliance, and identity (10–15%), capabilities of Microsoft Entra (25–30%), capabilities of Microsoft security solutions (35–40%), and capabilities of Microsoft compliance solutions (20–25%).
There is no required prerequisite certification. Candidates should be familiar with Microsoft Azure and Microsoft 365. SC-900 can help you prepare for role-based security credentials, but it is not a prerequisite for them.
Microsoft fundamentals certifications do not expire. Confirm the current policy with Microsoft before you rely on it.
No. The practice questions on this site are original. They are not Microsoft exam items, and a practice score does not predict a result.
Service names and portal labels change. Use the current Microsoft study guide as the authority when it differs from these notes.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Compare two text blocks and highlight added, removed, and changed content.
Convert structured data between JSON and YAML with formatting and validation.
Content reviewed November 1, 2026. Older notes may still say Azure Active Directory, Microsoft 365 Defender, Azure Security Center, or the compliance center. On the current exam, prefer Microsoft Entra ID, Microsoft Defender XDR, Microsoft Defender for Cloud, and Microsoft Purview. The October 21, 2026 change log also renames the threat-intelligence objective to Microsoft Threat Intelligence and adds workload identities to the Entra identity-types objective. Domain weights did not change.
During practice, record why the nearest alternative is wrong, rather than memorizing the answer position. The question bank contains independent single-answer exercises; it does not reproduce the full range of official exam interactions or predict your scaled score.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the Microsoft Learn certification page before you register. The SC-900 study guide lists the skills measured as of October 21, 2026.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.
Certi