Do not rely on the practice assessment score alone.
In one widely discussed thread, candidates who scored highly on the free practice assessment found the real exam harder, with more questions about naming the right product for a scenario.
Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) Exam Guide
Validates foundational knowledge of security, compliance and identity concepts and Microsoft Entra, security and compliance solutions.
SC-900 tests whether you can describe security, compliance and identity concepts and match Microsoft's products to a business need. Learn what each Entra, Defender, Sentinel and Purview feature is for, then practise choosing the right one for short scenarios.
Understand the exam
Syllabus
Describe the concepts of security, compliance, and identity10–15%
- Describe security and compliance concepts
- Define identity concepts
Example scenario: A company moves its email to a cloud service. Which security tasks stay with the company under the shared responsibility model?
Describe the capabilities of Microsoft Entra25–30%
- Describe function and identity types of Microsoft Entra ID
- Describe authentication capabilities of Microsoft Entra ID
- Describe access management capabilities of Microsoft Entra ID
- Describe identity protection and governance capabilities of Microsoft Entra
Example scenario: Administrators should get their elevated role only when they need it, with an approval step. Which Entra feature fits?
Describe the capabilities of Microsoft security solutions35–40%
- Describe core infrastructure security services in Azure
- Describe security management capabilities of Azure
- Describe capabilities of Microsoft Sentinel
- Describe threat protection with Microsoft Defender XDR
Example scenario: A security team wants to collect logs from many sources, detect threats and run automated responses. Which Microsoft service is built for this?
Describe the capabilities of Microsoft compliance solutions20–25%
- Describe Microsoft Service Trust Portal and privacy principles
- Describe compliance management capabilities of Microsoft Purview
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview
- Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview
Example scenario: Documents marked Confidential must stay encrypted when they are emailed outside the company. Which Purview feature applies the protection?
Official SC-900 study guide · Skills measured as of October 21, 2026
Format
- Questions
- 40–60
- Duration
- 45 min
- Passing score
- 700 / 1000
- Delivery
- Test centre or online
- Languages
- English, Japanese, Chinese (Simplified), Korean, French, Spanish, Portuguese, Russian, Arabic, Indonesian, German, Chinese (Traditional), Italian
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
A company wants to allow sign-in to its apps only from devices that meet its compliance rules. Which Microsoft Entra capability enforces this?
Show answer
A. Conditional Access sets conditions, such as device compliance, that must be met before access is granted. Privileged Identity Management controls when admin roles are active.
Drag items from a list into the matching places; an item can be used once, more than once or not at all.
CertUp example
Drag each Microsoft service to the task it handles. The tasks are collect and analyse security logs from many sources, protect endpoints from threats, and label and protect sensitive documents.
Show answer
Collect and analyse security logs → Microsoft Sentinel, protect endpoints → Microsoft Defender for Endpoint, label and protect sensitive documents → Microsoft Purview.
Pick one value from each drop-down list in a block of text or a diagram to complete it.
CertUp example
Select the correct value in each list. Zero Trust treats every request as [verified explicitly / trusted by default], and applies [least privilege access / unrestricted access].
Show answer
Verified explicitly, and least privilege access. Zero Trust checks every request and limits what each identity can reach.
Eligibility and booking
Sign in to Microsoft Learn with a personal Microsoft account, then schedule SC-900 with Pearson VUE from the exam page. Students and educators can also book through Certiport.
Make a study plan
Read the skills list, take the free practice assessment once to see where you stand, then work through one course.
Most candidates spend 15–35 hours. Plan for the low end if you already use Microsoft 365 or Entra; add time for the compliance section and Defender products if they are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.1 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.12 h
- 4Practice with mock examsTake timed practice tests and review every mistake.6 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.1 h
Learn the core concepts
Use one course for coverage. The free Microsoft Learn modules follow the skills list closely.
Best overall paid courseSC-900 Microsoft Security Fundamentals Exam Prep
Best free optionSC-900 Study Cram V2
Best official courseSC-900 course on Microsoft LearnLearn what each product is for. Many questions describe a need and ask which product or feature meets it. Make a one-line purpose for every product in the skills list.
Practice with mock exams
Take Microsoft's free practice assessment to learn the style, then add a second question bank for more scenario practice.
SC-900 Practice Assessment
SC-900 Practice Exams SamplerSC-900 Microsoft Security, Compliance, and Identity Fundamentals Practice ExamsAre you ready?
- You can say what each Entra, Defender, Sentinel and Purview product is for in one sentence.
- You can pick the right product for a short scenario without guessing.
- You score well on fresh questions, not only on ones you have seen before.
Prepare for exam day
Choose the checklist for your test-centre or online appointment.
Before going to the test centre
Before testing from home
- Bring a current government-issued ID whose name matches your certification profile.
- Arrive about 15 minutes early for check-in.
- Store your belongings as instructed. You get a pass or fail result at the end.
- Run the OnVUE system test on the same computer, network and room.
- Use a private room with the door closed and a clear desk. Unplug extra monitors.
- Check in from 30 minutes before your appointment. Check-in takes about 15 minutes.
- Keep your phone out of reach but nearby for check-in photos.
Breaks are allowed, but the clock keeps running and you cannot go back to questions you saw before the break.
Advice from exam takers
Give the compliance section extra time.
One passer who scored 860 found the Purview compliance section their weakest area and advised extra study there.
A study cram plus practice questions can be enough.
The same passer built their preparation around John Savill's study cram and official practice questions.