SC-900 Study Guide: Security, Compliance and Identity Fundamentals Explained

SC-900 is the starting point for Microsoft's security, compliance and identity certifications, and it suits both IT people and non-technical stakeholders. This guide follows the skills outline updated October 21, 2026.

Exam at a glance

A score of 700 or above passes.

1. Concepts (10-15%)

Short section, easy points:

• Shared responsibility model
• Defense in depth
• Zero Trust (verify explicitly, least privilege, assume breach)
• Encryption versus hashing: encryption is reversible with a key, hashing is one-way
• Governance, risk and compliance (GRC)
• Identity as the primary security perimeter, plus authentication versus authorization, identity providers, directory services and federation

2. Microsoft Entra (25-30%)

• Identity types: users, groups, devices, workload identities, and hybrid identity
• Authentication: methods, MFA, password protection
• Access management: Conditional Access and Entra roles with RBAC
• Protection and governance: ID Governance, access reviews, Privileged Identity Management (PIM) and ID Protection

A simple way to keep them apart:

3. Security solutions (35-40%)

The largest section. Group it by layer:

• Azure infrastructure security: DDoS Protection, Azure Firewall, WAF, NSGs, network segmentation, Bastion and Key Vault
• Security management: Microsoft Defender for Cloud, CSPM and workload protection
• Sentinel: know SIEM versus SOAR and what detection and response look like
• Defender XDR: Defender for Office 365, Endpoint, Cloud Apps, Identity, Vulnerability Management, threat intelligence and the Defender portal

Exam trick: match the product to the thing it protects. Email and collaboration points to Office 365, devices to Endpoint, SaaS apps to Cloud Apps, on-premises AD signals to Identity.

4. Compliance solutions (20-25%)

• Service Trust Portal and Microsoft's privacy principles
• Purview compliance management: the Purview portal, Compliance Manager and compliance score
• Information protection and governance: data classification, content and activity explorer, sensitivity labels and policies, DLP, records management, retention policies and labels
• Insider risk, eDiscovery and audit

Tip: sensitivity labels classify and protect content, while retention labels control how long it is kept.

Hands-on in a free tenant

A Microsoft 365 developer or trial tenant is enough to look at:

1. Entra admin center: create a user, review authentication methods and a Conditional Access policy (use report-only mode)
2. Defender portal: browse the dashboards and incidents view
3. Purview portal: browse sensitivity labels and Compliance Manager

Even five minutes in each portal makes exam wording much easier to picture.

Study plan (2-3 weeks)

1. Read the skills outline and mark anything unfamiliar.
2. Work through the Microsoft Learn path.
3. Build a one-page cheat sheet mapping each product to its purpose.
4. Take the free practice assessment and review every miss.

Verify weights on the official SC-900 study guide before you book.

Which product do you mix up most: Sentinel, Defender XDR or Purview? Let me know below.