Microsoft Security, Compliance, and Identity Fundamentals
The SC-900 exam is designed for anyone getting started with Security. It validates your understanding of the concepts of security, compliance, and identity, the capabilities of Microsoft Entra, the capabilities of Microsoft security solutions, and the capabilities of Microsoft compliance solutions.
Exam details
- Certification
- Microsoft Security, Compliance, and Identity Fundamentals
- Exam code
- SC-900
- Level
- Fundamentals
- Duration
- Approximately 45 minutes
- Questions
- Typically 40–60 questions
- Passing score
- 700 out of 1000
- Cost
- USD $99 — typical price; the exact fee varies by country/region and currency, and local taxes may apply.
- Prerequisites
- None required
- Languages
- English (also available in Japanese, Korean, French and Spanish, and several other languages)
- Delivered by
- Pearson VUE
- Renewal
- Not required (Fundamentals certifications do not expire)
Skills measured
Describe the concepts of security, compliance, and identity (10–15%)
- Describe shared responsibility, defense in depth, Zero Trust, encryption, and GRC.
- Define identity, authentication, authorisation, identity providers, directories, and federation.
Describe the capabilities of Microsoft Entra (25–30%)
- Describe Entra ID identity types, hybrid identity, and agent ID.
- Describe authentication methods, MFA, password protection, Conditional Access, and RBAC.
- Describe ID Governance, access reviews, PIM, and ID Protection.
Describe the capabilities of Microsoft security solutions (35–40%)
- Describe Azure DDoS Protection, Firewall, WAF, NSGs, Bastion, and Key Vault.
- Describe Defender for Cloud, CSPM, and Microsoft Sentinel SIEM and SOAR.
- Describe Microsoft Defender XDR services and the Defender portal.
Describe the capabilities of Microsoft compliance solutions (20–25%)
- Describe the Service Trust Portal and Microsoft privacy principles.
- Describe Purview Compliance Manager, classification, DLP, retention, and records management.
- Describe insider risk, eDiscovery, and audit capabilities.
Study resources & practice tests
Disclosure: some links below are affiliate links. If you buy through them we may earn a commission, at no extra cost to you. Read our affiliate disclosure.
Frequently asked questions
Who should take SC-900?
SC-900 is for students, business stakeholders, and IT staff who are new to Microsoft security, compliance, and identity. That includes people in professional services and the public sector.
What is the average salary for a Security, Compliance, and Identity Fundamentals professional?
SC-900 is a fundamentals credential, not a job title, so it has no published salary of its own. Holders are often junior SOC, GRC, or identity analysts. As of 2026, US entry SOC and security administrator roles commonly earn about $50,000 to $85,000. UK junior security operations and GRC analysts are often £28,000 to £45,000. Western European junior SOC pay is often about €35,000 to €57,000. The exam does not set pay.
Where do I find exam questions to practice?
You will find websites selling exam dumps or brain dumps that claim to be real SC-900 questions. Those materials are not official. Microsoft treats using brain dumps as cheating. It can invalidate your score, revoke certifications you already hold, and ban you from future exams. Microsoft publishes a free Practice Assessment for SC-900 on Microsoft Learn. Those questions are examples only, not the live exam. MeasureUp also sells the official practice test linked in the study resources on this page. You can try the Microsoft exam sandbox to see the question types and timer, but it does not use real exam questions. Practise the skills measured in a real product environment rather than memorising leaked items.
Does the exam include official labs I can use to practice?
SC-900 is a knowledge exam. Microsoft does not provide official exam labs you can use to practise this credential. Some Microsoft Learn modules include short exercises, and official instructor-led SC-900T00 training delivered by a Microsoft Learning Partner includes labs. Those labs are for the course, not a copy of the exam. Hands-on practice, if you want it, is in a free Azure, Power Platform, Microsoft 365, or trial tenant rather than an exam lab. The Microsoft exam sandbox shows traditional question types only. It does not give you the lab virtual machine.