- What the SC-900 Certification Actually Is
- The Four SC-900 Exam Domains
- Registration, Delivery, and Fee Mechanics
- Question Format and Testing Experience
- Passing Score and Scoring Mechanics
- Who Hires SC-900-Certified Professionals
- A Domain-Weighted Prep Timeline
- Certification Validity and Renewal
- Frequently Asked Questions
- SC-900 covers four domains, with Microsoft security solutions weighted heaviest at 35-40%.
- Testing time is 45 minutes inside a standard 65-minute proctored appointment.
- Passing requires a scaled score of 700 out of 1000, not a fixed percentage correct.
- The credential does not expire - no renewal assessment or continuing-education credits needed.
What the SC-900 Certification Actually Is
SC-900, formally titled Microsoft Certified: Security, Compliance, and Identity Fundamentals, is Microsoft's entry-level credential covering the shared language and architecture behind Microsoft Entra, Microsoft security solutions, and Microsoft compliance solutions. It is not a hands-on administrator exam - it validates conceptual understanding of how these product families fit together, which makes it a common starting point before candidates move toward more specialized Microsoft security or identity paths.
If you're still mapping out exactly what this credential covers and why it matters, the companion piece What Is SC-900 Certification? walks through the basics in plain language, and SC-900 Meaning untangles the naming convention Microsoft uses across its "Fundamentals" line.
The Four SC-900 Exam Domains
Every SC-900 study plan should be built around the official domain weightings, not generic security trivia. There are exactly four graded areas, and their relative weight tells you where to spend your time.
Domain 1: Describe the concepts of security, compliance, and identity (10-15%)
Foundational vocabulary - shared responsibility model, defense in depth, Zero Trust principles, encryption basics, and core compliance concepts.
- Zero Trust guiding principles and pillars
- Shared responsibility across cloud service models
- Basic encryption and hashing concepts
Domain 2: Describe the capabilities of Microsoft Entra (25-30%)
The identity backbone of the exam. Expect questions on authentication, access management, and identity governance.
- Microsoft Entra ID authentication methods and Conditional Access
- Identity governance features: entitlement management, access reviews, PIM
- External identities and hybrid identity concepts
Domain 3: Describe the capabilities of Microsoft security solutions (35-40%)
The single largest domain and the one most likely to decide your score. It spans Microsoft Defender products, Microsoft Sentinel, and cloud security posture tooling.
- Microsoft Defender XDR components and their scope
- Microsoft Sentinel's role in SIEM/SOAR scenarios
- Microsoft Defender for Cloud and cloud security posture management
Domain 4: Describe the capabilities of Microsoft compliance solutions (20-25%)
Focused on the Microsoft Purview compliance portfolio and regulatory concepts.
- Compliance Manager and compliance score
- Information protection, data loss prevention, and insider risk management
- eDiscovery and records management fundamentals
For a deeper breakdown of sub-topics inside each domain, see SC-900 Exam Domains 2026: Complete Guide to All 4 Content Areas. Because Domain 3 alone can be worth more than a third of the exam, it deserves disproportionate attention relative to its single-line entry in most outlines.
Registration, Delivery, and Fee Mechanics
SC-900 is delivered through Pearson VUE as a proctored, computer-based exam, with Certiport also listed as an option for students and educators. You can sit for it at a testing center or remotely where remote proctoring is supported for your region.
On cost: the current official U.S. checkout price is not consistently verified across sources, and a commonly cited US$99 figure circulates as a third-party reference point rather than a guaranteed rate. There's no member versus non-member pricing tier for this exam, but regional taxes and periodic discount vouchers can shift the total you actually pay. Always confirm the live price at checkout before scheduling. A fuller pricing discussion, including regional variance, is covered in SC-900 Certification Cost 2026: Complete Pricing Breakdown.
Eligibility is intentionally open - there's no formal degree requirement, no prior certification prerequisite, and no mandated training hours. Microsoft only recommends baseline familiarity with Azure and Microsoft 365 concepts. If you want the full eligibility picture, SC-900 Requirements 2026: Eligibility, Prerequisites & How to Qualify lays it out step by step.
Question Format and Testing Experience
The scored testing time for SC-900 is 45 minutes, sitting inside a standard 65-minute total appointment once you account for check-in, the NDA screen, and any survey at the end. Microsoft has not disclosed the exact number of scored versus unscored items or the total question count for this specific exam; general Microsoft exam guidance references a typical range of roughly 40-60 items across its certification portfolio, but that is not an SC-900-specific guarantee.
Expect a proctored, computer-based delivery with interactive item types possible - think drag-and-drop matching, multiple-choice, and scenario-based "select the correct capability" questions rather than open-ended written responses. The exact mix of item types is not officially published, so don't over-index on any single question-bank format claiming to replicate it exactly.
There is no in-exam access to Microsoft Learn documentation, so you need to internalize terminology - you won't be able to look up what "Conditional Access" or "Compliance Manager" does mid-exam. Details on how question difficulty actually feels in practice, rather than just what's disclosed, are covered in How Hard Is the SC-900 Exam? Complete Difficulty Guide 2026.
Passing Score and Scoring Mechanics
SC-900 uses a scaled passing score of 700 out of 1000. This is important to internalize: 700/1000 is not the same as needing 70% of raw questions correct, because Microsoft weights items differently and the scale isn't linear against raw question count. Treat 700 as the target on your score report, not as a simple percentage benchmark.
Microsoft does not publicly disclose the SC-900 pass rate, so be skeptical of any site quoting a specific percentage as official. For a grounded look at what's actually knowable about pass outcomes, read SC-900 Pass Rate 2026: What the Data Shows. And if you want the scoring mechanics explained in more depth - including how domain weighting theoretically interacts with the scaled score - see SC-900 Passing Score 2026: Exactly What You Need to Pass.
| Attribute | SC-900 Detail |
|---|---|
| Passing score | 700 / 1000 (scaled, not raw %) |
| Testing time | 45 minutes |
| Total appointment length | 65 minutes |
| Delivery | Proctored, computer-based (Pearson VUE / Certiport) |
| Renewal requirement | None - Fundamentals credential does not expire |
Who Hires SC-900-Certified Professionals
Because SC-900 is a Fundamentals-level credential, it typically supports early-career transitions rather than serving as a standalone qualification for senior roles. It's most relevant for:
- IT support or helpdesk professionals moving toward security or identity specializations
- Compliance, risk, or legal-adjacent staff who need to speak the language of Microsoft Purview and governance tooling
- Sales engineers, pre-sales consultants, and partner-channel staff who present Microsoft security and compliance capabilities to customers
- Students and career-changers using it as a low-barrier entry point into the Microsoft security ecosystem
It's worth being realistic about scope: SC-900 demonstrates conceptual fluency, not administrative capability. Employers hiring for hands-on Microsoft Entra administration or SOC analyst work generally expect this as a stepping stone toward role-based certifications, not a substitute for them. For a candid look at how this plays out in job postings and career trajectories, see SC-900 Jobs and the broader analysis in SC-900 Salary Guide 2026: Complete Earnings Analysis.
Key Takeaway
Treat SC-900 as a credibility signal and foundation-builder for identity/security careers, not as a hiring guarantee on its own. Pair it with role-based study once you've mastered the fundamentals.
A Domain-Weighted Prep Timeline
Rather than splitting study time evenly across four domains, allocate hours in proportion to exam weight - Domain 3 alone can be worth more than Domains 1 and 4 combined. A simple weighted approach:
Domains 1 and 2 - Foundations and Entra
- Learn Zero Trust and shared responsibility vocabulary (Domain 1)
- Study Microsoft Entra authentication, Conditional Access, and identity governance (Domain 2)
Domain 3 - Microsoft Security Solutions
- Deep-dive Microsoft Defender XDR, Sentinel, and Defender for Cloud since this is the heaviest-weighted domain
- Practice distinguishing overlapping Defender product capabilities
Domain 4 - Compliance Solutions
- Review Microsoft Purview compliance features, eDiscovery, and information protection
- Revisit weaker Domain 2 and 3 subtopics using timed practice questions
Full-Length Review and Scheduling
- Take full-length practice sessions under the 45-minute time constraint
- Book your Pearson VUE or Certiport appointment once consistently scoring above the 700/1000 target range
For a more detailed week-by-week methodology - including how to layer spaced repetition specifically around Domain 3's weight - see the SC-900 Study Guide 2026: How to Pass on Your First Attempt. You can reinforce this timeline with realistic timed practice on the SC-900 practice test platform, which mirrors the 45-minute pacing pressure you'll face on exam day.
Certification Validity and Renewal
Unlike role-based Microsoft certifications that require periodic renewal assessments, SC-900 is a Fundamentals credential that does not expire. There's no continuing-education requirement and no renewal exam to schedule down the line. Once you pass, the credential stays valid indefinitely, which makes it a low-maintenance addition to a resume or LinkedIn profile compared to associate- or expert-level Microsoft certifications.
This "earn once" structure is part of why many candidates treat it as a gateway credential - pair it with practical experience and, later, a role-based certification if you want to demonstrate hands-on capability rather than conceptual knowledge alone. If you're still deciding whether the investment of time is worthwhile given this structure, Is the SC-900 Certification Worth It? Complete ROI Analysis 2026 weighs the tradeoffs directly.
Frequently Asked Questions
No. It's a Fundamentals-level credential that does not expire, and there is no renewal assessment or continuing-education requirement.
Start with Domain 1 (security, compliance, and identity concepts) to build vocabulary, but plan to spend the most total hours on Domain 3 (Microsoft security solutions), since it carries the largest weight at 35-40%.
Scored testing time is 45 minutes, within a standard 65-minute total appointment that includes check-in and administrative screens.
You need a scaled score of 700 out of 1000. This is not the same as answering 70% of questions correctly, since Microsoft's scaling isn't a direct percentage conversion.
Through Pearson VUE at a testing center or via supported remote proctoring, or through Certiport if you qualify as a student or educator.
SC-900 rewards candidates who study the four domains in proportion to their actual exam weight rather than spreading effort evenly. If you want a quick reference to revisit before test day, bookmark the SC-900 Cheat Sheet 2026: One-Page Review of Must-Know Facts, and run a few timed sessions on our SC-900 practice tests to confirm your pacing before you schedule the real appointment.