SC-900 remains Microsoft\u2019s active fundamentals exam for security, compliance, and identity in 2026. The current English-language skills outline took effect on October 21, 2026 and is designed for beginners who want a working understanding of Microsoft\u2019s security, identity, and compliance ecosystem across Azure and Microsoft 365.<\/p>\n
The current SC-900<\/a> blueprint is divided into four areas: security, compliance, and identity concepts; Microsoft Entra capabilities; Microsoft security solutions; and Microsoft compliance solutions. The October 21, 2026 English update is now in effect. Compare preparation materials with the current Microsoft study guide, particularly the refined Microsoft Entra identity types and Microsoft Defender XDR skills.<\/p>\n SC-900 is not an implementation exam. You do not need to configure every product in depth. You should be able to explain what each security or compliance capability does, why an organization would use it, and how the major Microsoft platforms fit together.<\/p>\n Cloud security starts with understanding which responsibilities belong to Microsoft and which remain with the customer. The exact boundary changes depending on whether the workload uses infrastructure as a service, platform as a service, or software as a service.<\/p>\n Microsoft may operate the physical datacenter and underlying cloud platform, but customers still own important responsibilities such as identities, access, data, configuration, and how services are used.<\/p>\n This concept makes many later exam questions easier because it prevents the assumption that moving a workload into Microsoft\u2019s cloud automatically transfers every security responsibility to Microsoft.<\/p>\n Zero Trust is based on verifying explicitly, using least privilege, and assuming breach. It challenges the idea that a user or device should be trusted simply because it is inside a corporate network.<\/p>\n Defense in depth uses multiple protective layers so one failed control does not immediately expose the entire environment. Identity, endpoints, applications, networks, data, monitoring, and governance can all contribute independent layers.<\/p>\n SC-900 candidates should understand these as principles rather than product names. Microsoft tools implement parts of the model, but no single service \u201cis\u201d Zero Trust.<\/p>\n Authentication proves who or what an identity is. Authorization determines what that authenticated identity is allowed to do.<\/p>\n This distinction matters across Microsoft Entra ID, Azure RBAC, Microsoft 365 roles, applications, and cloud resources. Multifactor authentication strengthens authentication, while role assignments and permissions govern authorization.<\/p>\n A user can authenticate successfully and still be denied access because they lack the correct permission. Keeping those concepts separate prevents a common fundamentals-level confusion.<\/p>\n Microsoft Entra ID provides cloud identity and access management for users, applications, services, devices, and increasingly agent identities.<\/p>\n The July 2026 SC-900 outline explicitly includes different identity types, hybrid identity, authentication methods, Conditional Access, roles, identity governance, access reviews, Privileged Identity Management, and Identity Protection.<\/p>\n Older study material may still use the Azure Active Directory name. The durable concepts remain useful, but current terminology is Microsoft Entra ID.<\/p>\n Multifactor authentication combines different evidence, such as something the user knows, has, or is. A stolen password alone is therefore less useful to an attacker.<\/p>\n Passwordless methods can reduce password exposure even further through technologies such as passkeys, security keys, certificates, or Microsoft-supported authentication methods.<\/p>\n SC-900 does not require deep deployment knowledge, but candidates should understand why stronger authentication reduces account-compromise risk.<\/p>\n Conditional Access evaluates signals such as user, application, location, device state, or risk and applies access requirements based on policy.<\/p>\n A policy might require multifactor authentication for administrative access, block a risky sign-in, or require a compliant device for a sensitive application.<\/p>\n The Conditional Access fundamentals<\/a> are useful because the service is easier to remember when you think of it as an if-then policy engine for access decisions.<\/p>\n Access should not be granted once and forgotten forever. Employees change roles, contractors leave, guests finish projects, and administrative permissions accumulate.<\/p>\n Microsoft Entra ID Governance, access reviews, and Privileged Identity Management help organizations review and reduce unnecessary access over time.<\/p>\n PIM is particularly important for privileged roles because it can make access eligible and time-limited instead of permanently active.<\/p>\n The current exam expects candidates to recognize core Azure security services including Azure Firewall, Web Application Firewall, DDoS Protection, virtual-network segmentation, Network Security Groups, Azure Bastion, and Azure Key Vault.<\/p>\n These controls solve different problems. NSGs filter network traffic around subnets and interfaces. Azure Firewall provides centralized filtering. WAF protects web applications at the HTTP layer. DDoS Protection addresses denial-of-service attacks. Key Vault protects secrets, keys, and certificates.<\/p>\n At fundamentals level, the important skill is matching the control to the risk rather than memorizing detailed configuration.<\/p>\n Defender for Cloud helps organizations identify risky cloud configurations and protect supported workloads. Cloud Security Posture Management surfaces recommendations and security posture information, while Defender plans provide deeper protection for selected workload types.<\/p>\n The cloud security posture management<\/a> concept is worth understanding because many cloud risks come from configuration drift, excessive exposure, or missing controls rather than only from malware.<\/p>\n SC-900 candidates should know the purpose of recommendations, standards, Secure Score-style posture concepts, and workload protection without needing administrator-level configuration depth.<\/p>\n A SIEM collects and analyzes security data to support detection, investigation, and threat hunting. SOAR adds automation and orchestration to security response.<\/p>\n Microsoft Sentinel provides those capabilities in the Microsoft security ecosystem. It can ingest data from Microsoft and non-Microsoft sources, create detections, manage incidents, support KQL-based investigation, and automate response workflows.<\/p>\n The distinction from Defender products matters: Defender tools provide security capabilities for specific workloads and XDR scenarios, while Sentinel can provide a broader SIEM and orchestration layer.<\/p>\n Microsoft Defender XDR brings together signals across endpoints, identities, email, applications, and other Microsoft security services.<\/p>\n SC-900 expects candidates to recognize Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Vulnerability Management, Defender Threat Intelligence, and the Microsoft Defender portal.<\/p>\n The goal is not to memorize every feature. Understand which surface each product protects and why correlated signals provide stronger investigation context than isolated alerts.<\/p>\n Microsoft Purview provides capabilities for compliance management, information protection, data lifecycle, insider risk, eDiscovery, and audit.<\/p>\n Before information can be protected consistently, organizations need to identify sensitive content. Classification can use sensitive information types, labels, classifiers, and other detection methods.<\/p>\nBegin with the shared responsibility model<\/h2>\n
Zero Trust and defense in depth are foundational concepts<\/h2>\n
Authentication and authorization solve different problems<\/h2>\n
Microsoft Entra ID is the identity foundation<\/h2>\n
Multifactor and passwordless authentication reduce password dependence<\/h2>\n
Conditional Access makes access decisions from context<\/h2>\n
Identity governance controls access over time<\/h2>\n
Azure security services protect infrastructure and applications<\/h2>\n
Microsoft Defender for Cloud focuses on cloud security posture and workload protection<\/h2>\n
Microsoft Sentinel is the SIEM and SOAR platform<\/h2>\n
Microsoft Defender XDR correlates threats across security products<\/h2>\n
Compliance begins with knowing what information exists<\/h2>\n