Prepare for SC-900 by reviewing security, compliance, and identity concepts and the capabilities of Microsoft Entra, security solutions, and compliance solutions. Use the current skills list to find gaps, then practice explaining how capabilities relate to stated needs. This guide includes a Conditional Access example and a preparation checklist.
Who is SC-900 for?
SC-900 is the exam for Microsoft Certified: Security, Compliance, and Identity Fundamentals.
Microsoft describes an audience of business stakeholders, new or existing IT professionals, and students seeking familiarity with security, compliance, and identity across Azure and Microsoft 365.
The audience profile expects familiarity with Azure and Microsoft 365 and an interest in how the solutions work together. The objectives emphasize describing concepts and capabilities. Use that profile to assess learning needs; it is not a promise that a particular background guarantees a pass.
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Microsoft Certified: Security, Compliance, and Identity Fundamentals - Certifications | Microsoft Learn — Certification page, checked 2026-09-14; Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn — Skills measured as of July 28, 2026, checked 2026-09-14
What to study in each skill area
Use the four areas in the English skills list dated July 28, 2026, together with your knowledge gaps.
The percentages are official ranges, not fixed question counts or a required allocation of study time. Compare older resources with the full current task list instead of assuming their scope is still sufficient.
Localized versions generally follow English updates about eight weeks later, with variation. Check the guidance for your booked language.
| Skill area | Weight range | Topics and suggested practice |
|---|---|---|
| Describe the concepts of security, compliance, and identity | 10-15% | Shared responsibility, defense in depth, Zero Trust, encryption and hashing, GRC, authentication, authorization, and federation. Explain a distinction such as authentication versus authorization using the official learning material. |
| Describe the capabilities of Microsoft Entra | 25-30% | Identity types including agent ID, hybrid identity, authentication and MFA, Conditional Access, RBAC, governance, access reviews, PIM, and ID Protection. Work the access-policy example and explain which requirements are satisfied. |
| Describe the capabilities of Microsoft security solutions | 35-40% | Azure network and infrastructure security, Key Vault, Defender for Cloud and CSPM, Sentinel SIEM/SOAR, and the Defender XDR family. Compare the purpose of the listed capabilities using current documentation. |
| Describe the capabilities of Microsoft compliance solutions | 20-25% | Service Trust Portal, Purview, Compliance Manager, sensitivity labels, DLP, retention, insider risk, eDiscovery, and audit. Describe a need each capability addresses and check its limits in the learning material. |
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn — Skills measured as of July 28, 2026, checked 2026-09-14
Practice: which access requirements are satisfied?
Conditional Access turns signals such as user, device, location, and risk into if-then rules that are enforced after first-factor authentication.
Conditional Access uses signals such as users, devices, applications, location, and risk to make policy decisions. Microsoft describes simple policies as if-then statements, with decisions to block access or grant it subject to controls.
Policies are enforced after first-factor authentication. Conditional Access is not intended as frontline protection against denial-of-service attacks. The following original example isolates two grant requirements; it is not a production configuration or an actual exam question.
Exercise: a worked Conditional Access decision with a full answer and explanation.
One enabled Conditional Access policy applies to members of Staff accessing the Reports app. It requires BOTH multifactor authentication (MFA) and a compliant device. For each request, first-factor authentication has succeeded, all other authorization requirements are met, and no other policy applies. A: MFA completed; compliant device. B: MFA completed; non-compliant device. C: MFA not completed; compliant device. Which request satisfies both requirements now? What requirement remains for B and C?
Show answer
A satisfies both requirements. B still needs a compliant device; C still needs to complete MFA.
The policy requires both controls, so satisfying one is insufficient. B needs to meet the device-compliance requirement while retaining MFA; C needs to complete MFA while using a compliant device. Neither request is described as permanently blocked. The result follows from the single-policy assumptions and does not guarantee access in a real tenant with additional policies or requirements.
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Microsoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID | Microsoft Learn — Conditional Access overview
How to use the official practice assessment
The free official practice assessment shows question style and helps find gaps, but a high score is not proof you are ready.
The free SC-900 practice assessment can be repeated and provides answers, rationales, and links to further reading.
Microsoft states that these are example questions, not actual exam questions, and that they do not represent exam length or complexity or replace training and product experience.
For each mistake, explain the requirement you missed and use the linked material to review it. A later repeated score alone cannot establish that every gap is closed. Check whether you can explain the concepts when the scenario changes.
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Practice Assessments for Microsoft Certifications | Microsoft Learn — SC-900 practice assessment availability and limits; Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn — Skills measured as of July 28, 2026, checked 2026-09-14
Your preparation checklist
Work from the current objectives, practice with official tools, and book with the logistics above in mind.
Start with concepts you need for understanding the product areas, then focus on gaps across all four skill areas. This is suggested study practice, not an official sequence or prescribed study duration.
- Compare your resources with the July 28, 2026 English skills list and localized update guidance.
- Explain the concepts and capabilities in each area using the official learning material.
- Work the Conditional Access example and identify the remaining requirement for each request.
- Use practice-assessment rationales and documentation to address mistakes.
- Explore the sandbox and review break, navigation, identification, and accommodation instructions.
- Check your registration account, regional price, and appointment details before booking.
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Microsoft Certified: Security, Compliance, and Identity Fundamentals - Certifications | Microsoft Learn — Certification page, checked 2026-09-14; Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn — Skills measured as of July 28, 2026, checked 2026-09-14; Exam duration and exam experience | Microsoft Learn — Fundamentals exam duration and seat time; breaks; Microsoft Learn access; Exam and Applied Skills assessment lab retake policies | Microsoft Learn — Retake waiting periods and attempt limits; Practice Assessments for Microsoft Certifications | Microsoft Learn — SC-900 practice assessment availability and limits
What to expect on exam day
You get 45 minutes of exam time within a 65-minute seat booking, in a proctored session that may include interactive components.
The standard 45-minute assessment already includes the additional five minutes Microsoft provides for possible breaks. The 65-minute seat reservation also covers instructions, the candidate agreement, and comments. Check your appointment for approved accommodations.
Microsoft’s general guidance says most certification exams have 40–60 questions, with variation. It does not establish a fixed SC-900 count or item mix. The sandbox demonstrates the interface and possible question types.
A break does not pause the clock. You cannot return to previously viewed questions, including unanswered or flagged ones. Review them before starting a break through the interface.
Microsoft Learn is unavailable during Fundamentals exams. Prepare for SC-900 as a closed-book, proctored exam.
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Microsoft Certified: Security, Compliance, and Identity Fundamentals - Certifications | Microsoft Learn — Certification page, checked 2026-09-14; Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn — Skills measured as of July 28, 2026, checked 2026-09-14; Exam duration and exam experience | Microsoft Learn — Fundamentals exam duration and seat time; breaks; Microsoft Learn access
Scoring, booking, and retakes
You pass with a scaled score of 700 or greater on a 1-1,000 scale, and Microsoft fundamentals certifications do not expire.
The passing score is 700 on a scale of 1–1,000, not a raw 70% requirement. Incorrect answers do not deduct points, and some questions may be unscored without being identified. Answer every question.
After a first failure, wait 24 hours before a second attempt. A 14-day wait applies between later attempts, with at most five attempts in 12 months from the first. Pay retake fees where applicable and check appointment availability.
Pricing depends on the country or region where the exam is proctored. Microsoft recommends a personal registration account so records remain accessible if you leave a school or employer. Follow the current credential page’s scheduling options.
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.: Microsoft Certified: Security, Compliance, and Identity Fundamentals - Certifications | Microsoft Learn — Certification page, checked 2026-09-14; Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn — Skills measured as of July 28, 2026, checked 2026-09-14; Exam scoring and score reports | Microsoft Learn — Scaled passing score of 700; Credential expiration policies | Microsoft Learn — Fundamentals certifications do not expire; Exam and Applied Skills assessment lab retake policies | Microsoft Learn — Retake waiting periods and attempt limits
Sources: official Microsoft Learn certification, study guide, and exam policy pages, checked on September 14, 2026.
Facts checked against official Microsoft documentation on September 14, 2026.:
- Microsoft Certified: Security, Compliance, and Identity Fundamentals - Certifications | Microsoft Learn
- Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals | Microsoft Learn
- Microsoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID | Microsoft Learn
- Exam duration and exam experience | Microsoft Learn
- Exam scoring and score reports | Microsoft Learn
- Credential expiration policies | Microsoft Learn
- Exam and Applied Skills assessment lab retake policies | Microsoft Learn
- Practice Assessments for Microsoft Certifications | Microsoft Learn