Microsoft Security, Compliance, and Identity Fundamentals (SC-900)
The SC-900 exam is designed for anyone getting started with Microsoft Security. It validates your understanding of the concepts of security, compliance, and identity, the capabilities of Microsoft Entra, the capabilities of Microsoft security solutions, and the capabilities of Microsoft compliance solutions.
Exam details
- Certification
- Microsoft Security, Compliance, and Identity Fundamentals
- Application
- Microsoft Security
- Exam code
- SC-900
- Level
- Fundamentals
- Duration
- Approximately 45 minutes
- Questions
- Typically 40–60 questions
- Passing score
- 700 out of 1000
- Cost
- USD $99 — typical price; the exact fee varies by country/region and currency, and local taxes may apply.
- Prerequisites
- None required
- Languages
- English (also available in Japanese, Korean, French and Spanish, and several other languages)
- Delivered by
- Pearson VUE
- Renewal
- Not required (Fundamentals certifications do not expire)
Skills measured
Describe the concepts of security, compliance, and identity (10–15%)
- Describe shared responsibility, defense in depth, Zero Trust, encryption, and GRC.
- Define identity, authentication, authorisation, identity providers, directories, and federation.
Describe the capabilities of Microsoft Entra (25–30%)
- Describe Entra ID identity types, hybrid identity, and agent ID.
- Describe authentication methods, MFA, password protection, Conditional Access, and RBAC.
- Describe ID Governance, access reviews, PIM, and ID Protection.
Describe the capabilities of Microsoft security solutions (35–40%)
- Describe Azure DDoS Protection, Firewall, WAF, NSGs, Bastion, and Key Vault.
- Describe Defender for Cloud, CSPM, and Microsoft Sentinel SIEM and SOAR.
- Describe Microsoft Defender XDR services and the Defender portal.
Describe the capabilities of Microsoft compliance solutions (20–25%)
- Describe the Service Trust Portal and Microsoft privacy principles.
- Describe Purview Compliance Manager, classification, DLP, retention, and records management.
- Describe insider risk, eDiscovery, and audit capabilities.
Study Resources
Disclosure: some links below are affiliate links. If you buy through them we may earn a commission, at no extra cost to you. Read our affiliate disclosure.
Frequently asked questions
Who should take SC-900?
SC-900 is for students, business stakeholders, and IT staff who are new to Microsoft security, compliance, and identity. That includes people in professional services and the public sector.
What is the average salary for a Security, Compliance, and Identity Fundamentals professional?
For a U.S. role benchmark, Robert Half's 2027 salary guide lists Cybersecurity Analyst starting pay from $104,750 for candidates new to the role or still developing core skills, up to $151,500 for candidates with extensive experience. Actual pay varies by location and experience; these are role-based estimates, not an SC-900 salary premium.
Where do I find exam questions to practice?
Start with Microsoft's SC-900T00 course. Then use the official SC-900 practice test from MeasureUp to practise the exam skills.
Avoid exam dumps: using them can invalidate your score, revoke certifications you already hold, and bar you from future exams.
Search the Microsoft Training Services Partners directory for instructor-led options. Separately, current U.S. listings for the one-day SC-900T00 course quote $695 at Interface Technical Training and $695 at New Horizons.
Does the exam include official labs I can use to practice?
If you purchase instructor-led training, Microsoft Training Services Partners usually provide access to official labs for about 90 days. Always check that the labs are from a Microsoft partner such as Skillable.
Depending on the exam, a trial licence could include demo data to practise with, but this is not guaranteed and Microsoft often changes its policies about free trials with demo data. If you prefer hands-on learning using labs, contact a Microsoft Training Services Partner for instructor-led training.