Microsoft Security, Compliance, and Identity Fundamentals SC-900
Follow a topic roadmap built from the published exam blueprint, with lessons, practice exercises and practice exams.
Demonstrate foundational knowledge on security, compliance, and identity concepts and related cloud-based Microsoft solutions.
What you'll learn
Every objective SC-900 publishes, and what it asks you to be able to do.
- Describe the concepts of security, compliance, and identityDescribe security and compliance concepts. Define identity concepts.
- Describe the capabilities of Microsoft EntraDescribe function and identity types of Microsoft Entra ID. Describe authentication capabilities of Microsoft Entra ID. Describe access management capabilities of Microsoft Entra ID. Describe identity protection and governance capabilities of Microsoft Entra.
- Describe the capabilities of Microsoft security solutionsDescribe core infrastructure security services in Azure. Describe security management capabilities of Azure. Describe capabilities of Microsoft Sentinel. Describe threat protection with Microsoft Defender XDR.
- Describe the capabilities of Microsoft compliance solutionsDescribe Microsoft Service Trust Portal and privacy principles. Describe compliance management capabilities of Microsoft Purview. Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview. Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview.
The exam at a glance
- Length
- 45 minutes
- Validity
- Does not expire
- Style
- Multiple choice
Multiple-choice questions; Microsoft states the exam includes 40–60 questions.. Based on Skills measured as of July 28 2026. Pass mark is 700.
Sitting the exam
The part nobody publishes in a syllabus. For SC-900 the logistics are study strategy: what you are allowed to read while the clock runs changes how you should practise, and what a second attempt costs changes when you should book.
Where you sit it
- An online proctor observes your performance during the test.
- Your examination may feature interactive tasks that you must complete.
If you do not pass
- A waiting period of 24 hours is required before you can retake the exam for the first time after failing.
- All subsequent retake attempts up to a total of 5 require a 14-day waiting period between them.
- You are not permitted to take a specific exam more than five times in a 12-month timeframe starting from your initial attempt.
- If you fail the exam 5 times, you will become eligible to attempt it again 12 months after the date of your first attempt.
- Retaking an exam you have already passed is prohibited unless your certification has expired.
- You are required to pay for the exam retake if applicable.
- You can submit a request to waive the retake waiting period if you encountered equipment failure or internet connectivity issues during the test and a Pearson VUE case was generated.
- No waivers will be granted for any other reason.
- Waiver requests must incorporate the Pearson VUE case number to verify your eligibility.
Booking it
- You can book your test date through Pearson Vue.
- Educators and students are able to schedule their exam through Certiport.
- It is strongly advised that you sign up for the exam utilizing a personal MSA account.
- If you register using an organizational AAD account from your work or school and later leave that organization, your testing records will be lost and cannot be recovered.
- The cost of the exam depends on the country or region where it is proctored.
Read off the official exam page on 10 September 2026. Rules change without notice, so confirm anything you are about to spend money on.
What the exam covers
Microsoft publishes the objectives but not a weight for each one, so treat these as equally likely to come up.
Course content
14 topics
1. Security and Compliance Concepts
- Describe security and compliance concepts
2. Identity Fundamentals
- Define identity concepts
3. Microsoft Entra ID Functions and Identity Types
- Describe function and identity types of Microsoft Entra ID
4. Authentication Capabilities in Microsoft Entra ID
- Describe authentication capabilities of Microsoft Entra ID
5. Access Management Capabilities in Microsoft Entra ID
- Describe access management capabilities of Microsoft Entra ID
6. Identity Protection and Governance in Microsoft Entra
- Describe identity protection and governance capabilities of Microsoft Entra
7. Core Infrastructure Security Services in Azure
- Describe core infrastructure security services in Azure
8. Security Management Capabilities of Azure
- Describe security management capabilities of Azure
9. Security Information and Event Management with Microsoft Sentinel
- Describe capabilities of Microsoft Sentinel
10. Threat Protection with Microsoft Defender XDR
- Describe threat protection with Microsoft Defender XDR
11. Microsoft Service Trust Portal and Privacy Principles
- Describe Microsoft Service Trust Portal and privacy principles
12. Compliance Management Capabilities of Microsoft Purview
- Describe compliance management capabilities of Microsoft Purview
13. Information Protection and Data Governance in Microsoft Purview
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview
14. Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview
- Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview
What to know before you start
- Microsoft Azure
- Microsoft 365
Other Microsoft certifications
All Microsoft certificationsFrequently asked questions
How much does the SC-900 exam cost?
Fee on Microsoft's site, and worth checking there before you book.
How long is the SC-900 exam?
45 minutes. Multiple-choice questions; Microsoft states the exam includes 40–60 questions..
How many questions are on the SC-900 exam?
Multiple-choice questions; Microsoft states the exam includes 40–60 questions.. The sitting is 45 minutes long. Check the current count with Microsoft before you book.
How long is SC-900 valid?
It does not expire, so there is no renewal date to plan for.
Is the SC-900 exam hands-on?
No. It is a written exam, so the skill it tests is recognising the right design or command rather than executing it under time pressure.
What is on the SC-900 exam?
4 objectives: Describe the concepts of security, compliance, and identity, Describe the capabilities of Microsoft Entra, Describe the capabilities of Microsoft security solutions, Describe the capabilities of Microsoft compliance solutions. Microsoft does not publish a weight per objective.
What should I know before starting SC-900?
Microsoft Azure. Microsoft 365.
Exam details from Microsoft, checked August 2026. Always confirm on their page before booking.
What learners say about Acelro
About Acelro rather than the SC-900 exam: what learners made of the gap analysis, the roadmap and the projects.
“The roadmap makes me focus on a learning curve, no matter the length.”
“Acelro has been really great for me, an inspiring experience. I've gained a lot of confidence doing projects I thought were rocket science.”
“The gap analysis maps your actual skills against what the current job market is asking for. Nobody else made it that clear where I stood.”