SC-900 Security, Compliance, and Identity Fundamentals: Current Microsoft Exam Guide

SC-900 is Microsoft’s current fundamentals exam for security, compliance, and identity across Microsoft cloud services. As of October 3, 2026, the active study guide is based on skills measured from July 28, 2026. Microsoft divides the exam into four areas: core security/compliance/identity concepts, Microsoft Entra capabilities, Microsoft security solutions, and Microsoft compliance solutions. It is designed for business stakeholders, students, and new or existing IT professionals who want a broad foundation before moving into specialized roles.

The exam supports the Security, Compliance, and Identity Fundamentals credential in the broader Microsoft certification ecosystem. It is a beginner-level assessment, but “fundamentals” should not be confused with trivia. Many questions become easier only when candidates understand how identity, Zero Trust, Defender, Sentinel, and Purview fit together.

Microsoft has announced an English SC-900 update later in October 2026, so the active objective version should always be checked against the test date. Candidates testing before the change should use the July 28 scope; candidates testing after it takes effect should follow the updated study guide rather than assume a course recorded earlier in the year still matches.

Security, compliance, and identity concepts create the vocabulary for the rest of the exam

The first domain covers ideas such as shared responsibility, defense in depth, Zero Trust, encryption, hashing, governance/risk/compliance, authentication, authorization, identity providers, directory services, and federation. These are not vendor-specific definitions to memorize in isolation. They provide the logic needed to understand why Microsoft’s services exist and which problem each one addresses.

For example, authentication establishes that an identity is who it claims to be, while authorization determines what that identity may do. Zero Trust assumes access decisions should be continuously evaluated rather than granted permanently because a user or device is “inside” a network. Shared responsibility explains why using a cloud service does not transfer every security obligation to Microsoft. These distinctions become the foundation for later Entra, Defender, and Purview questions.

Microsoft Entra is the identity layer behind many cloud security decisions

The identity domain covers Microsoft Entra ID, identity types, hybrid identity, authentication methods, multifactor authentication, Conditional Access, roles, identity governance, access reviews, Privileged Identity Management, and identity protection. SC-900 does not require the implementation depth of SC-300, but candidates should be able to describe what these capabilities accomplish.

A useful way to study is to follow an access request. An identity exists in Entra, authenticates using an approved method, is evaluated by Conditional Access, receives authorization through roles or application permissions, and may be subject to governance controls over time. Privileged access deserves stronger controls because administrative roles can change the environment. Thinking in this sequence makes identity features much easier to distinguish than memorizing portal labels.

Azure infrastructure security demonstrates defense in depth

SC-900 expects candidates to recognize Azure security capabilities including DDoS Protection, Azure Firewall, Web Application Firewall, virtual network segmentation, network security groups, Azure Bastion, and Azure Key Vault. At fundamentals level, the important question is what layer each service protects. DDoS mitigation, web request inspection, network filtering, secure administrative access, and secret management address different threats.

These controls illustrate defense in depth: a secure architecture does not rely on one barrier. A workload may use identity controls, network restrictions, secure secrets, application-layer filtering, and monitoring together. Candidates who later want implementation depth can move toward SC-500, where cloud and AI security engineering turns these concepts into deployable controls.

Defender for Cloud, Sentinel, and Defender XDR solve different security problems

Microsoft’s security portfolio can look confusing because several products surface alerts and risk. SC-900 candidates should understand the role of each layer. Defender for Cloud provides cloud security posture management and workload protection. Microsoft Sentinel is a SIEM and SOAR platform that collects and analyzes security data and supports detection, investigation, and automation. Defender XDR brings together threat protection across Microsoft security products.

The distinctions matter in scenario questions. A need to improve cloud configuration posture points in a different direction from a need to centralize security events or investigate a cross-product attack chain. The deeper SC-200 path expands the security-operations side, but SC-900 candidates mainly need a correct mental map of the capabilities and how they contribute to detection and response.

Microsoft Purview covers the information and compliance side of the security model

The compliance domain includes Microsoft Purview, Compliance Manager, compliance score, data classification, Content Explorer, Activity Explorer, sensitivity labels, DLP, records management, retention, Insider Risk Management, eDiscovery, and Audit. The common thread is governing information and demonstrating that policies are being applied, rather than protecting only infrastructure.

A label can classify or protect sensitive information; DLP can respond when that information is handled in risky ways; retention controls how long information is kept; Audit records activity; and eDiscovery supports investigation and legal workflows. Candidates who want to continue into hands-on data-security administration can follow SC-401. At SC-900 level, the goal is to recognize the purpose and relationship of these capabilities.

Fundamentals questions reward service selection more than configuration memorization

Because SC-900 is descriptive, preparation should focus on selecting the right concept or service for a stated requirement. If a question describes temporary elevation for administrators, think about privileged identity management. If it asks about protecting sensitive content from inappropriate sharing, consider Purview DLP. If it describes central security analytics across data sources, Sentinel becomes relevant.

This style of reasoning is more durable than memorizing screenshots. Microsoft changes portals and product branding, but a requirement such as “reduce persistent privileged access” remains recognizable. A current SC-900 value discussion is useful only when paired with this capability-based understanding; the credential matters because it organizes the Microsoft security landscape into understandable functions.

Hands-on exploration should stay proportional to a fundamentals exam

SC-900 does not require candidates to become Entra, Sentinel, Defender, or Purview administrators before sitting the exam. However, light hands-on exploration helps make abstract product names concrete. Navigating a Microsoft security portal, viewing an identity object, reading a Conditional Access policy example, exploring a Defender recommendation, or reviewing a Purview label workflow can create strong mental anchors.

The key is not to spend all study time on configuration details that belong to associate-level exams. Use labs to understand relationships and terminology, then return to the official objective list. A beginner who can accurately explain why a control exists is better prepared than someone who memorized a sequence of clicks but cannot tell identity governance from threat detection or information protection.

SC-900 candidates should also be able to distinguish security controls from compliance evidence. A company may use encryption and access controls to reduce the chance of unauthorized disclosure, while Compliance Manager and audit capabilities help assess or demonstrate how controls align with requirements. Passing an assessment or improving a score does not itself make a system secure; the underlying technical and organizational controls still need to work.

Another useful fundamentals distinction is between risk and incident response. Identity Protection or Defender products may surface risk signals, while Sentinel and Defender XDR support investigation and response. A risk indicator can trigger stronger access requirements before a confirmed compromise is established. Understanding this progression prevents the common assumption that every alert represents the same type or severity of event.

Microsoft 365 and Azure also share security concepts without using identical implementation models. An identity can access both environments, Purview may govern information across Microsoft 365, and Defender products can provide protection across endpoints, cloud apps, identities, and cloud resources. The exam is easier when candidates think of these services as an integrated security architecture rather than as two unrelated product catalogs.

Study notes should therefore be organized by requirement language. Create headings such as “verify identity,” “limit privileged access,” “protect a web application,” “centralize security analytics,” “classify sensitive information,” and “retain records.” Under each heading, map the relevant Microsoft capability and one sentence explaining why it fits. This produces recall based on purpose, which is exactly what a descriptive fundamentals exam tends to test.

Licensing and product packaging can change, so fundamentals preparation should avoid memorizing which exact subscription tier contains every advanced capability unless the current study guide explicitly requires it. Focus instead on what a service does and how it relates to the security architecture. This keeps the knowledge useful even when Microsoft renames a portal, consolidates products, or moves a feature between bundles.

Practice assessments are most useful when every missed question is converted into a concept map. If a learner confuses Conditional Access with role-based access control, for example, the correction should explain that one evaluates access conditions while the other grants permissions to perform actions. Building these contrasts produces faster improvement than simply repeating the same questions until the wording becomes familiar.

Because the exam is broad, a final revision pass should emphasize contrasts: authentication versus authorization, RBAC versus Conditional Access, Defender for Cloud versus Sentinel, sensitivity labels versus DLP, and retention versus eDiscovery. Clear contrasts prevent adjacent services from blending together under time pressure.

SC-900 is most useful as a map for choosing the next specialization

After the fundamentals exam, the most appropriate next step depends on the work a learner wants to perform. Identity administration points toward SC-300. Security operations points toward SC-200. Information security and Purview administration point toward SC-401. Cloud and AI workload protection points toward SC-500. Cybersecurity architecture is represented by SC-100 for experienced practitioners designing broader security strategy.

That makes SC-900 valuable as orientation. It helps learners understand the vocabulary and boundaries of Microsoft’s security, compliance, and identity services before they commit to a specialized role. The exam should therefore be studied as a connected map: identity controls access, security tools protect and detect, and compliance tools govern information and evidence. Once that map is clear, both the exam and the choice of a deeper certification path become more straightforward.