Exam Details
Microsoft · SC-900
Prepare for SC-900: Understand security, compliance, and identity concepts across Microsoft services.
Overview
Related Roadmaps
Approved links shared by the community. Earn credits when yours gets approved!
No community resources yet. Be the first to suggest one!
Know a strong article, guide, or explainer for this exam? Submit it for review and earn credits when it gets approved.
ExamOS may provide links to third-party websites, books, videos, courses, and other materials ("External Resources") for your convenience and reference. These resources are not created, owned, or controlled by ExamOS unless explicitly stated.
For official and up-to-date information, always refer to the certification provider website.
No resources have been linked to this exam yet.
Video Library
No video resources are available for this exam yet.
Found a strong walkthrough, lesson, or exam breakdown on YouTube? Submit it here and earn credits if it gets approved.
FAQ
The SC-900 certification validates foundational knowledge of security, compliance, and identity concepts across Azure and Microsoft 365. This fundamentals-level exam is designed for business stakeholders, IT beginners, and professionals exploring cybersecurity careers. You'll understand core security principles, Microsoft's security solutions, compliance capabilities, and identity services like Microsoft Entra ID. No technical experience is required. This cert is the ideal starting point before pursuing associate-level security certifications like AZ-500, SC-200, or SC-300.
You're a fit for SC-900 if you:
Not sure if you're ready? Try a free sample quiz: 10 questions, instant results, identify weak areas.
| Domain | Weight | What This Means |
|---|---|---|
| Security, compliance, and identity concepts | 10–15% | Understand shared responsibility, defense in depth, zero trust, and common threat types |
| Microsoft Entra ID capabilities | 25–30% | Describe authentication, authorization, MFA, conditional access, and identity types in Entra ID |
| Microsoft security solutions | 30–35% | Understand Defender XDR, Sentinel, Defender for Cloud, and how they protect against threats |
| Microsoft compliance solutions | 20–25% | Describe Microsoft Purview, DLP, information protection, insider risk, and eDiscovery |
You're probably ready if you can:
You might need more prep if:
If this feels too advanced:
If you know the basics but want to build confidence:
The SC-900 exam typically consists of 40–60 questions. You are given 45–60 minutes for the exam itself, with a total seat time of 85 minutes to allow for instructions and the non-disclosure agreement. The format includes multiple-choice, drag-and-drop, and matching scenarios. Note that Fundamentals exams generally do not include complex case studies or labs.
The passing score is a scaled score of 700 out of 1000. Microsoft uses a scaled scoring system to ensure consistency across different versions of the exam. To build the confidence needed to clear this threshold, ExamOS offers scenario-based practice quizzes that focus on "Service Matching"—helping you perfectly identify which Microsoft tool solves a specific security or compliance problem.
The exam is balanced across four functional pillars. The current weightings are:
The AZ-900 is about general cloud infrastructure (VMs, VNets, Storage). The SC-900 is a "horizontal" certification—it focuses specifically on the security and compliance layer that sits on top of both Azure and Microsoft 365. If you want to specialize in cybersecurity, SC-900 is the better starting point.
No. Microsoft’s "Open Book" feature is only available for Associate, Expert, and Specialty exams. Because SC-900 is a Fundamentals level exam, you must rely entirely on your memory for service names and conceptual definitions. You will not have access to any external documentation during the test.
The standard registration fee is $99 USD in the United States. Prices vary by region and local taxes. If you are a student or a teacher, you may be eligible for a significant discount or even a free voucher through the "Microsoft Learn for Educators" program or by attending a "Microsoft Virtual Training Day."
If you do not pass on your first attempt, you must wait 24 hours before rescheduling. For any subsequent attempts, a 14-day waiting period is required. You are allowed a maximum of five attempts within a 12-month period. Each retake attempt requires a new registration fee.
No. Microsoft Fundamentals certifications do not expire. Once you earn the SC-900 badge, it remains on your transcript permanently. You do not need to take annual renewal assessments. However, it is highly recommended to move on to an Associate-level certification (like SC-200 or SC-300) to keep your skills current as the technology evolves.
There are no formal prerequisites. This exam is ideal for:
After mastering the fundamentals, you should choose a role-based path: