SC-900 Security, Compliance, and Identity Fundamentals

SC-900 remains Microsoft’s entry-level credential for understanding security, compliance, and identity across Azure and Microsoft 365. It belongs to the Microsoft certifications, but unlike role-based security exams it is designed to test whether a candidate understands the purpose and relationship of major concepts and services before diving into detailed administration.

The current blueprint is broader than a vocabulary quiz. Candidates need to connect shared responsibility, Zero Trust, identity, cloud security, Microsoft Defender, Microsoft Sentinel, and Microsoft Purview to recognizable business and technical scenarios. The goal is to know what a control or service is for, where it fits, and which problem it is meant to solve.

As of September 2026 the exam is active, with Microsoft already publishing another English-language update for October 21, 2026. Candidates testing before that date should study the currently effective objectives rather than treating the future change log as if it has already replaced the live exam.

Start with the security model before memorizing products

The most durable SC-900 concepts are shared responsibility, defense in depth, and Zero Trust. These ideas explain why cloud security is split between provider and customer responsibilities, why multiple layers of protection matter, and why modern access decisions should continuously verify identity, context, and risk instead of trusting a network location by default.

A candidate who understands those principles can reason through product questions more effectively. For example, multifactor authentication is not just a feature name; it reduces dependence on a single credential. Network segmentation is not an isolated Azure capability; it limits the effect of compromise. Data classification is not simply labeling; it creates context for protection and governance decisions.

Shared responsibility is especially important because the boundary moves depending on the service model. In an infrastructure service, the customer controls more of the operating system and network configuration; in a managed platform or SaaS product, Microsoft operates more of the underlying stack while the customer still owns identities, data decisions, access policies, and appropriate configuration. SC-900 does not require exhaustive matrices, but candidates should be able to explain why moving to the cloud does not transfer all security accountability to the provider. That understanding makes many scenario questions almost self-solving.

Identity is the organizing layer for modern access

Microsoft Entra is a major part of the exam because identities represent users, applications, devices, and increasingly agentic workloads. Candidates should understand authentication versus authorization, single sign-on, multifactor authentication, Conditional Access, role-based access control, identity protection, access reviews, and privileged identity management at a conceptual level.

Those fundamentals provide the runway for a role such as SC-300 identity and access administration. SC-900 does not require the same configuration depth, but it does expect candidates to distinguish an authentication problem from an authorization problem and to recognize when governance controls such as access reviews or privileged activation are more appropriate than simply adding another login factor.

Identity governance questions become clearer when you separate steady-state access from privileged or temporary access. A person may legitimately need an application every day but need an administrative role only for a short maintenance task. Access reviews, entitlement processes, and privileged activation address different moments in that lifecycle. The exam expects enough conceptual precision to recognize those differences. A candidate who uses “identity security” as one undifferentiated category is more likely to choose a plausible but poorly matched control.

Cloud security services protect different layers

Azure security questions become easier when services are grouped by the layer they protect. Network security groups, firewalls, web application firewalls, DDoS protection, and segmentation address traffic and exposure. Key Vault protects secrets, keys, and certificates. Defender for Cloud brings posture management and workload protection into a broader security-management view.

SC-900 security, compliance, and identity scenarios become easier to reason about when the services are treated as parts of an operating model rather than an alphabetized catalog. SC-900 candidates should be able to look at a scenario and identify whether the problem is network exposure, credential protection, posture, workload threat protection, or another security concern.

Defender XDR and Sentinel solve related but different problems

Microsoft Defender XDR brings together signals across endpoints, identities, email, applications, and other security surfaces. Microsoft Sentinel provides SIEM and SOAR capabilities for collecting, analyzing, correlating, and automating around security data. At the fundamentals level, candidates should know why an organization uses each and how they can complement one another.

If security operations becomes the main career direction, SC-200 is the natural deeper path. SC-900 should still build the conceptual map first: endpoint or identity products generate and enrich signals, XDR helps correlate incidents across Microsoft security workloads, and a SIEM extends visibility across a wider set of sources and operational workflows.

It also helps to understand that security products generate different forms of evidence. Endpoint telemetry, identity signals, email detections, cloud-app activity, and threat intelligence can contribute to a correlated incident, while a SIEM can ingest broader organizational data and support hunting, analytics, and automation. The fundamentals exam is not asking candidates to write production detection rules, but it does test whether they can match a security-operation need to the right type of platform capability. Focus on purpose, inputs, and outcomes rather than memorizing portal labels.

Compliance is about governing information, not merely passing audits

Microsoft Purview appears prominently because organizations need to know what sensitive data they hold, how it should be protected, how long it should be retained, where risky activity is occurring, and how information can be found for investigations. The information-protection concepts behind sensitivity labels, data loss prevention, retention, eDiscovery, audit, and insider-risk tools are more important than memorizing portal navigation.

A good exam habit is to separate security from compliance without pretending they are unrelated. Security controls try to reduce unauthorized access and malicious activity. Compliance and governance controls help organizations meet obligations, classify and manage information, preserve evidence, and demonstrate how data is handled. A single scenario can require both.

Retention and deletion are a good example of why governance is not just “keep everything.” Legal, regulatory, business, and privacy requirements can conflict if data is preserved indefinitely without a defined reason. Candidates should understand that records management establishes what must be retained and for how long, while other controls can govern classification, protection, investigation, and disposal. This lifecycle view helps distinguish tools that protect data from tools that prove how data was handled over time.

Foundational knowledge becomes useful when services are compared by purpose

Many SC-900 questions are easiest when candidates ask what outcome is needed. If the organization wants stronger sign-in protection, identity controls are relevant. If it wants to understand cloud configuration risk, posture management is relevant. If it wants to classify confidential documents, information protection is relevant. If it wants to investigate security events from many sources, SIEM and XDR concepts matter.

This purpose-first method reduces confusion between products with overlapping marketing language. It also helps candidates handle renamed portals and reorganized interfaces because the underlying problem remains stable even when Microsoft changes how capabilities are grouped or displayed.

Hands-on exploration should support, not replace, conceptual clarity

SC-900 does not demand administrator-level deployment skills, but opening the relevant portals can make the concepts concrete. Explore where Entra surfaces identities and Conditional Access, where Defender shows incidents, where Sentinel exposes analytics and automation, and where Purview groups information-protection and compliance capabilities.

The objective is not to memorize every menu. It is to connect a service name with the type of evidence or control it provides. A candidate who can explain why a capability belongs in a scenario usually performs better than one who only remembers where a button appeared in a screenshot.

SC-900 should lead into a deliberate specialization path

After the fundamentals, the next exam should follow the work you actually want to do. SC-500 is implementation-heavy cloud and AI security engineering. SC-300 focuses on identity and access. SC-200 focuses on security operations. SC-401 goes deeper into information security and Purview, while SC-100 is the architecture path.

That specialization view is more useful than treating SC-900 as a destination by itself. The credential establishes a common language across security, compliance, and identity; deeper role-based study turns that language into configuration, investigation, governance, or architecture skills.

A useful career exercise is to compare what each downstream role produces. An identity administrator changes access and governance. A security operations analyst investigates and responds. An information security administrator protects and governs data. A cloud security engineer implements controls across workloads. A cybersecurity architect defines strategy and patterns. That output-based comparison is more reliable than choosing an exam because two product names look similar. SC-900 gives you enough vocabulary to make that choice intentionally.

Readiness means being able to explain the relationships in plain language

A strong final review should focus on explanations, not flash-card recognition. Be able to describe how Zero Trust changes access decisions, how Entra controls identity, how Defender and Sentinel support protection and operations, and how Purview helps govern information. Then practice choosing the best capability for short business scenarios.

If you can explain those relationships to a non-specialist without hiding behind product names, you are probably studying at the right level. SC-900 rewards broad understanding with enough technical precision to distinguish adjacent services, not deep command-line expertise.

A useful final exercise is to explain one security incident from several service perspectives. Start with an identity being compromised, then describe which identity controls could reduce the initial access risk, which security services might surface suspicious behavior, how an incident platform could help correlate evidence, and which compliance or information-governance concerns might arise if sensitive data were exposed. The point is not to memorize a single Microsoft product sequence. It is to demonstrate that you understand why the services exist, where their responsibilities overlap, and where they deliberately remain separate.