- SC-900 stands for Microsoft Security, Compliance, and Identity Fundamentals, published by Microsoft.
- The exam has four domains, with Microsoft security solutions weighted heaviest at 35-40%.
- Passing requires a scaled score of 700 out of 1000, not a raw 70% correct.
- Testing time is 45 minutes with a 65-minute total appointment window.
What Does SC-900 Mean, Literally?
"SC-900" is Microsoft's exam code for Microsoft Certified: Security, Compliance, and Identity Fundamentals. The "SC" prefix signals that the exam belongs to Microsoft's security-and-compliance track, and the number distinguishes it from associate- and expert-level exams in the same family. When people ask "what does SC-900 mean," they're really asking two things: what the letters/numbers represent, and what the credential is supposed to prove about the person who holds it.
The answer to the second question is straightforward. SC-900 verifies that you understand foundational concepts across three interconnected pillars - security, compliance, and identity - as they apply to Microsoft's cloud ecosystem, particularly Microsoft Entra, Microsoft security solutions, and Microsoft compliance solutions. It is a Fundamentals-level exam, meaning Microsoft designed it for breadth, not deep technical mastery. There is no formal degree, prior certification, or minimum training-hour requirement listed for taking it, though Microsoft recommends candidates already have some familiarity with Azure and Microsoft 365 concepts before sitting the exam.
If you're looking for a plain-language walkthrough of the credential itself, the companion pieces What Is SC-900? and SC-900 Meaning go deeper into terminology, while What Does SC-900 Stand For? focuses specifically on the acronym breakdown.
The Four Domains Behind the Name
The clearest way to understand what SC-900 "means" in practice is to look at what it actually tests. Microsoft organizes the exam into four domains, each mapping to a piece of the name itself - security, compliance, and identity - plus a foundational concepts section that ties them together.
Domain 1: Describe the concepts of security, compliance, and identity (10-15%)
This domain covers the vocabulary and mental models everything else builds on.
- Shared responsibility model and defense in depth
- Zero Trust principles and the CIA triad
- Basic identity terminology: authentication vs. authorization
Domain 2: Describe the capabilities of Microsoft Entra (25-30%)
This is where identity lives. Expect questions on identity services and identity types.
- Authentication methods and multifactor authentication
- Conditional Access and access reviews
- Identity governance and external identities
Domain 3: Describe the capabilities of Microsoft security solutions (35-40%)
The largest single domain, and the reason many candidates underestimate their prep time.
- Microsoft Defender family (Defender for Cloud, Defender XDR, etc.)
- Microsoft Sentinel and security information/event management concepts
- Security posture tools and cloud security capabilities
Domain 4: Describe the capabilities of Microsoft compliance solutions (20-25%)
This domain closes the loop with governance, risk, and regulatory tooling.
- Microsoft Purview capabilities for data governance and protection
- Compliance Manager and compliance score
- Insider risk, eDiscovery, and information protection basics
For a full breakdown of subtopics inside each domain, see the SC-900 Exam Domains 2026: Complete Guide to All 4 Content Areas. Understanding the domain weighting matters more than most candidates realize - because Domain 3 alone carries more weight than Domains 1 and 4 combined, a study plan that ignores this imbalance is likely to underperform on exam day.
| Domain | Weight | Core Theme |
|---|---|---|
| Security, compliance, identity concepts | 10-15% | Shared vocabulary and Zero Trust |
| Microsoft Entra | 25-30% | Identity and access management |
| Microsoft security solutions | 35-40% | Defender, Sentinel, security posture |
| Microsoft compliance solutions | 20-25% | Purview, governance, risk |
How SC-900 Questions Are Actually Written
SC-900 is delivered as a proctored, computer-based exam through Pearson VUE, with Certiport also available for students and educators. The exact total number of questions and the split between scored and unscored items is not publicly disclosed by Microsoft. As a general reference point, Microsoft-wide fundamentals exams typically fall somewhere in the 40-60 question range, but this is not a guarantee specific to SC-900 - treat it as a rough expectation, not a fact to memorize.
What is confirmed is the timing: candidates get 45 minutes of testing time inside a standard 65-minute appointment, with the extra time covering instructions, agreements, and a post-exam survey. Interactive item types are possible on Microsoft fundamentals exams, but the precise mix of formats - multiple choice, drag-and-drop, scenario-based case studies - is not verified for SC-900 specifically. Microsoft does not provide in-exam access to Microsoft Learn documentation, so recall matters more than lookup skill during the test itself.
Because the format itself doesn't map cleanly onto raw memorization, question phrasing tends to reward candidates who can reason about which Microsoft capability solves a described scenario, rather than those who've simply memorized feature lists. If you want a deeper sense of how tough this actually feels in practice, How Hard Is the SC-900 Exam? Complete Difficulty Guide 2026 walks through common friction points.
Key Takeaway
Passing requires a scaled score of 700 out of 1000 - this is not the same as answering 70% of questions correctly, since Microsoft weights questions differently. See SC-900 Passing Score 2026: Exactly What You Need to Pass for the full explanation of how scaling works.
Registering, Fees, and Exam Logistics
Registration happens through Pearson VUE (or Certiport for eligible students/educators), and the exam can typically be scheduled with remote delivery where supported, in addition to in-person test centers. On pricing: the current official U.S. checkout fee is not consistently verified across sources, and while US$99 appears frequently as a third-party reference figure, it should be treated as unofficial. There's no member/non-member pricing tier for this exam, but regional taxes and periodic discount vouchers can shift the final total you pay at checkout. For the most current breakdown of what to actually expect to pay, check SC-900 Certification Cost 2026: Complete Pricing Breakdown before you book.
There are no listed prerequisites tied to a degree, employment history, or prior certification - Microsoft frames this purely as a Fundamentals-level exam open to anyone, though it recommends some prior exposure to Azure and Microsoft 365. If you're mapping out whether you meet any practical expectations before registering, SC-900 Requirements 2026: Eligibility, Prerequisites & How to Qualify covers this in detail. Once earned, the credential doesn't expire and carries no renewal assessment or continuing-education obligation, which sets it apart from many associate and expert-level Microsoft certifications that require periodic renewal.
One outline change worth noting for anyone planning ahead: the English-language exam outline is scheduled to update effective July 28, 2026. If your target test date is near that window, cross-check SC-900 Exam Dates 2026: Testing Windows, Deadlines & Scheduling so your study materials match the version of the outline you'll actually be tested on.
Who Actually Hires for SC-900 Knowledge
SC-900 sits at the entry point of Microsoft's security-and-compliance certification path, so it's rarely the sole credential behind a job offer. Instead, it tends to function as a signal - proof that a candidate already understands Microsoft's security, identity, and compliance vocabulary before starting a role or moving into a specialized associate-level certification. It's common among:
- IT support staff transitioning toward security or identity-focused roles
- Compliance and governance professionals who need to speak the same language as IT teams
- Students and early-career professionals building a Microsoft security foundation
- Sales, pre-sales, and partner-facing roles that need to explain Microsoft security capabilities to customers
Because it's a fundamentals-level credential rather than a role-based one, it's rarely the single deciding factor in hiring decisions - it works best paired with hands-on experience or a follow-on associate certification. For a realistic look at how this plays out in job postings and career moves, see SC-900 Jobs and the broader analysis in Is the SC-900 Certification Worth It? Complete ROI Analysis 2026. If compensation impact specifically is your concern, SC-900 Salary Guide 2026: Complete Earnings Analysis lays out what's known and what isn't.
Turning the Meaning Into a Study Plan
Once you understand what SC-900 actually measures, the study plan almost writes itself: spend the most time where the exam spends the most weight. Given that Microsoft security solutions carries 35-40% of the exam - more than double the smallest domain - a plan that treats all four domains equally is misallocating effort.
Foundational Vocabulary
- Learn Zero Trust, shared responsibility, and CIA triad terminology (Domain 1)
- Get comfortable distinguishing authentication from authorization
Microsoft Entra Deep Dive
- Study Conditional Access, MFA, and identity governance (Domain 2)
- Practice scenario questions distinguishing identity types
Microsoft Security Solutions
- Dedicate double the time here given the 35-40% weight (Domain 3)
- Map Defender products and Microsoft Sentinel to their use cases
Compliance and Final Review
- Cover Microsoft Purview, Compliance Manager, and eDiscovery (Domain 4)
- Run full-length practice questions to simulate the 45-minute pace
This kind of domain-weighted scheduling - rather than a generic day-by-day study calendar - is the difference between studying for "a Microsoft exam" and studying for SC-900 specifically. For a more detailed week-by-week breakdown with resource recommendations, the SC-900 Study Guide 2026: How to Pass on Your First Attempt expands on this same domain-first logic. It's also worth keeping a condensed reference nearby during final review - the SC-900 Cheat Sheet 2026: One-Page Review of Must-Know Facts is built for exactly that last-mile pass.
Regardless of which resources you choose, practicing under realistic timed conditions matters because the appointment window is fixed at 45 minutes of testing time. Running full practice sets on our SC-900 practice test platform before exam day helps you get a feel for pacing so you're not caught off guard by the clock. Repeating that process a few times through the practice tests also surfaces which domain is actually your weak point, rather than the one you assume it is.
Frequently Asked Questions
No. As a Fundamentals-level credential, SC-900 does not expire, and there is no renewal assessment or continuing-education requirement once you've passed.
No. It tests conceptual understanding of Microsoft security, compliance, and identity capabilities rather than hands-on configuration skills, which is why no formal training-hour or lab requirement is listed.
The exact number and the scored/unscored split are not publicly disclosed. Microsoft fundamentals exams generally fall in a 40-60 question range, but this isn't confirmed specifically for SC-900.
You need a scaled score of 700 out of 1000. This scaled system means passing isn't the same as answering exactly 70% of questions correctly.
No formal prerequisite is listed - no degree, prior certification, or employment requirement - though Microsoft recommends familiarity with Azure and Microsoft 365 concepts beforehand.