Microsoft Security, Compliance, and Identity Fundamentals

SC-900 · ● Active · Entry · Microsoft

Exam facts

Vendor source — Microsoft Certified: Security, Compliance, and Identity Fundamentals ↗

Official exam guide — Study Guide for Exam SC-900 ↗

Exam objectives — Exam SC-900 Skills Measured ↗

About

The SC-900 is Microsoft's entry-level certification for security, compliance, and identity (SCI) concepts across Azure and Microsoft 365 environments. Released in 2021, it serves as a foundational stepping stone for IT professionals, business analysts, and non-technical stakeholders who want to understand cloud security principles, identity management, compliance frameworks, and Microsoft's integrated security solutions—without requiring hands-on lab experience or prior security certification. The exam does not expire and requires no renewal, making it an ideal low-risk entry point into the Microsoft security ecosystem.

Domain context — Security

Cloud-native and hybrid security, identity governance, compliance orchestration, and threat detection across public cloud (Azure), SaaS (Microsoft 365), and on-premises deployments.

Read full deep dive — Security Domain ↗

Topics covered

The SC-900 exam blueprint is organized into four domains with the following weights:

• Describe the concepts of security, compliance, and identity (10–15%)

  • Shared responsibility model, Zero Trust architecture, defense in depth, encryption fundamentals, data residency and sovereignty, common security threats (phishing, ransomware, DDoS)

• Describe the capabilities of Microsoft Entra (25–30%)

  • Authentication and identity models, single sign-on (SSO), multi-factor authentication (MFA), Conditional Access, Azure AD (now Microsoft Entra ID), external identities (B2B, B2C), Azure AD Premium features

• Describe the capabilities of Microsoft security solutions (35–40%)

  • Microsoft Defender (Defender for Cloud, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps), Microsoft 365 Defender, DLP (data loss prevention), email/collaboration security, threat intelligence, incident response

• Describe the capabilities of Microsoft compliance solutions (20–25%)

  • Microsoft Purview (compliance portal), Compliance Manager, Information Protection, eDiscovery, audit logging, regulatory compliance (GDPR, HIPAA, PCI-DSS, SOC 2), insider risk management

Source: Microsoft Learn — Exam SC-900 Skills Measured ↗

Common skills at Security · Entry

Shared content for the Security domain at Entry level — not specific to this cert.

• Cloud security fundamentals and shared responsibility model
• Basic cryptography and encryption concepts
• Identity and access management (IAM) principles
• Authentication methods (password, MFA, passwordless)
• Threat awareness and common attack vectors
• Compliance and governance frameworks (NIST, ISO 27001, GDPR)
• Cloud platform security architecture overview
• Risk assessment and vulnerability identification

Recommended courses at Security · Entry

Course-selection rule: Most SC-900 study material is vendor-neutral and affordable. Microsoft Learn and John Savill's cram are the most recommended free resources; Udemy and Whizlabs offer comprehensive paid options with practice exams.

Practice exams

Books

Typical job titles at Security · Entry

Security Analyst · Identity & Access Management Analyst · Compliance Officer · IT Administrator · Information Security Analyst · Cloud Security Analyst · Security Operations Support

(Job titles drawn from current job-board postings that list SC-900 or related Microsoft security certifications as required or preferred.)

Salary

Salary rule: SC-900 alone typically qualifies for entry-level compliance or identity-support roles. Higher salaries require stacking with SC-200, SC-300, or SC-400 certifications, or combining with 2+ years of hands-on security/identity experience.

Skills validated

Cert-specific — what this exam actually tests, distinct from the shared "Common skills" above.

• Microsoft Entra ID (formerly Azure AD) authentication and identity concepts
• Conditional Access policies and zero-trust principles
• Multi-factor authentication (MFA) and passwordless sign-in
• Microsoft Defender for Cloud and endpoint protection
• Microsoft Sentinel (SIEM) basics
• Microsoft 365 Defender ecosystem
• Data Loss Prevention (DLP) fundamentals
• Microsoft Purview Compliance Manager and audit
• GDPR, HIPAA, PCI-DSS, and SOC 2 compliance frameworks
• Incident response and threat intelligence
• Microsoft 365 security features (email, Teams, SharePoint)

Related certifications

• Stacks with: AZ-900 (Azure Fundamentals) ↗, MS-900 (Microsoft 365 Fundamentals) ↗
• Prerequisite for / Pathway to: [SC-200 (Security Operations Analyst) ↗]({file not yet created}), [SC-300 (Identity and Access Administrator) ↗]({file not yet created}), [SC-400 (Information Protection Administrator) ↗]({file not yet created})
• Expert level: [SC-100 (Cybersecurity Architect Expert) ↗]({file not yet created}) — requires SC-200, SC-300, or AZ-500 as prerequisite
• Equivalents at this level: [ISC2 CC (Certified in Cybersecurity) ↗]({file not yet created}), [CompTIA Security+ (SY0-701) entry foundation]({file not yet created})
• Vendor overview: Microsoft Vendor Overview ↗

Sources

• Microsoft Certified: Security, Compliance, and Identity Fundamentals
• Study guide for Exam SC-900
• Exam SC-900 Skills Measured
• Introduction to security, compliance, and identity concepts — Microsoft Learn
• Course SC-900T00-A: Introduction to Microsoft Security, Compliance, and Identity
• John Savill's SC-900 Study Cram (YouTube)
• Exam Ref SC-900 by Diogenes et al. (Pearson/Microsoft Press)
• MeasureUp Practice Test SC-900
• Whizlabs SC-900 Certification
• Glassdoor Security Analyst Salary
• Robert Half Salary Guide

Last verified: 2026-05-01 Parent ecosystem: Microsoft Azure + M365 Parent domain: Security Domain Vendor overview: Microsoft Overview