- SC-900 is Microsoft's Security, Compliance, and Identity Fundamentals exam, delivered via Pearson VUE or Certiport.
- Microsoft security solutions is the largest domain at 35-40% of the exam.
- Testing time is 45 minutes inside a standard 65-minute appointment.
- Passing requires a scaled score of 700 out of 1000, not a flat 70% correct.
What SC-900 Actually Is
SC-900 is the official exam code for Microsoft Certified: Security, Compliance, and Identity Fundamentals, a Microsoft Corporation credential that validates foundational knowledge of security, compliance, and identity concepts across Microsoft's cloud platform. It is not a hands-on engineering exam - it's a fundamentals-level assessment that checks whether you understand how Microsoft Entra, Microsoft security solutions, and Microsoft compliance solutions fit together conceptually.
If you're trying to figure out exactly what this credential covers before you commit study time, the deep-dive breakdown at SC-900 Certification is a good companion piece to this overview. This article focuses on the practical mechanics: what's tested, how the exam is delivered, and what it takes to register and pass.
Who SC-900 Is Designed For
Microsoft positions SC-900 as an entry point, not a capstone. There is no formal degree requirement, no prior certification prerequisite, and no mandated employment or training-hour minimum listed for this exam. That said, Microsoft recommends general familiarity with Azure and Microsoft 365 concepts before attempting it - you don't need hands-on admin experience, but you should recognize how cloud services, identity, and security fit together at a high level.
This makes SC-900 popular with a wide range of candidates:
- IT professionals moving toward security, compliance, or identity-focused roles
- Business stakeholders (sales, support, compliance staff) who need to speak intelligently about Microsoft security concepts
- Students and career-changers building a first Microsoft credential before attempting associate-level exams
- Technical staff who touch Microsoft Entra, Defender, Purview, or Intune, but not as their primary role
For a fuller look at eligibility expectations and recommended background, see SC-900 Requirements 2026: Eligibility, Prerequisites & How to Qualify. If you're weighing whether the effort is worth it relative to your career goals, Is the SC-900 Certification Worth It? Complete ROI Analysis 2026 covers that decision in more depth, and SC-900 Jobs looks at the kinds of roles that reference this credential.
The Four Exam Domains
SC-900 content is organized into four domains, each with a published weight range. Understanding these weights is the single most useful thing you can do before building a study plan, because they tell you exactly where your time should go.
Domain 1: Describe the concepts of security, compliance, and identity (10-15%)
Covers foundational vocabulary and models: the shared responsibility model, defense in depth, the Zero Trust model, encryption and hashing basics, and core governance/risk/compliance concepts. This domain is small in weight but sets up terminology used everywhere else on the exam.
- Zero Trust guiding principles
- Shared responsibility model across cloud service types
- Basic cryptography and compliance terminology
Domain 2: Describe the capabilities of Microsoft Entra (25-30%)
Focuses on identity: authentication and authorization concepts, Microsoft Entra ID features like Conditional Access, identity governance, and external identities. This is the second-largest domain and demands real conceptual clarity, not just memorized feature names.
- Authentication methods and multifactor authentication concepts
- Conditional Access and identity protection capabilities
- Identity governance features (access reviews, entitlement management)
Domain 3: Describe the capabilities of Microsoft security solutions (35-40%)
The largest domain by far, covering Microsoft Defender products, Microsoft Sentinel, cloud security posture tools, and security management capabilities. Because it carries the most weight, underestimating it is the most common way candidates lose points.
- Microsoft Defender family capabilities (endpoint, cloud, identity, etc.)
- Microsoft Sentinel's role in SIEM/SOAR scenarios
- Security posture and management tooling
Domain 4: Describe the capabilities of Microsoft compliance solutions (20-25%)
Covers Microsoft Purview capabilities for compliance management, information protection, data lifecycle management, insider risk, and eDiscovery concepts. It's smaller than Domain 3 but still a substantial fifth of the exam.
- Compliance Manager and compliance score concepts
- Information protection and data lifecycle management
- Insider risk management and eDiscovery basics
Notice that Domains 2 and 3 together make up 60-70% of the exam. That single fact should shape your entire study sequence. For a domain-by-domain walkthrough with more granular subtopics, SC-900 Exam Domains 2026: Complete Guide to All 4 Content Areas goes further than the summary above.
Key Takeaway
Domains 2 and 3 (Microsoft Entra and Microsoft security solutions) combine for roughly two-thirds of the exam - prioritize them over Domain 1's terminology review.
Exam Format, Timing, and Delivery
SC-900 is delivered as a proctored, computer-based exam. The total scheduled testing time is 45 minutes, though your overall appointment - including check-in, the NDA agreement, and a post-exam survey - runs about 65 minutes. That extra time isn't padding for the questions themselves; it's administrative overhead you should plan for when you book a slot.
Microsoft doesn't publish the exact number of scored versus unscored questions for SC-900, and the exact item-type mix (multiple choice, drag-and-drop, case-study style, or other interactive formats) isn't fully disclosed either. What is known: across Microsoft certification exams generally, question counts often fall in a 40-60 range, but this is a Microsoft-wide pattern, not a guarantee specific to SC-900. Treat any exact number you see elsewhere as an estimate.
Delivery is proctored, either in person at a testing center or remotely where remote proctoring is supported. There is no in-exam access to Microsoft Learn or any other reference material - you're expected to know the concepts, not look them up mid-test.
If you want a more detailed breakdown of how difficulty is distributed and what makes certain domains harder than others in practice, How Hard Is the SC-900 Exam? Complete Difficulty Guide 2026 is worth reading before exam day.
Registration, Fees, and Scheduling
SC-900 is administered through Pearson VUE, and Certiport is also listed as an option, particularly for students and educators taking the exam through academic channels. Both routes lead to the same Microsoft credential.
On pricing: the current official U.S. checkout fee is not independently verified at the time of writing. You'll sometimes see US$99 referenced online, but that figure comes from third-party sources, not a confirmed Microsoft listing - treat it as a rough reference point rather than a guaranteed price. Member and non-member pricing tiers do not apply to this exam, but regional taxes and occasional discount vouchers can shift your actual total depending on where you test. Because pricing specifics change and vary by region, the dedicated cost breakdown at SC-900 Certification Cost 2026: Complete Pricing Breakdown is the better resource to check before you pay.
For scheduling logistics - how far in advance to book, how testing windows work, and what to do if you need to reschedule - see SC-900 Exam Dates 2026: Testing Windows, Deadlines & Scheduling. One detail worth flagging early: Microsoft has an English-language outline update effective July 28, 2026, so if your target date is near that window, double-check which version of the objectives your study materials reflect.
How Scoring and Passing Work
SC-900 uses a scaled scoring system with a passing score of 700 out of a possible 1000 points. This is a critical distinction: 700/1000 is not the same as "70% of questions correct." Scaled scoring accounts for question difficulty and weighting, so two candidates who answer a different number of questions correctly could both land on either side of the passing line depending on which questions they got right.
Microsoft does not publicly disclose SC-900's pass rate, so any specific percentage you see cited elsewhere isn't an official figure. If you're researching how attainable the exam is in practice, SC-900 Pass Rate 2026: What the Data Shows looks at what's actually knowable versus speculative on this topic. For the mechanics of scaled scoring itself and how to interpret a score report, SC-900 Passing Score 2026: Exactly What You Need to Pass goes deeper.
| Attribute | Detail |
|---|---|
| Testing time | 45 minutes |
| Total appointment length | 65 minutes |
| Passing score | 700 / 1000 (scaled) |
| Delivery | Proctored, computer-based; remote option where supported |
| Largest domain | Microsoft security solutions, 35-40% |
| Credential validity | Does not expire; no renewal assessment required |
A Domain-Aware Way to Prepare
Generic study advice - spaced repetition, active recall, timed practice - is genuinely useful, but it only helps if it's applied against SC-900's actual weight distribution. Since Domain 3 (Microsoft security solutions) alone accounts for 35-40% of the exam, it deserves the largest share of your calendar, not an equal split across all four domains.
Foundations first
- Work through Domain 1 concepts: Zero Trust, shared responsibility, encryption basics
- Build the vocabulary you'll reuse in every later domain
Identity depth
- Study Microsoft Entra capabilities: authentication, Conditional Access, identity governance
- Practice distinguishing similar-sounding Entra features
Heaviest domain gets the most time
- Spend two full weeks on Microsoft security solutions given its 35-40% weight
- Map out Defender products, Sentinel's role, and security posture tooling
Compliance and final review
- Cover Microsoft compliance solutions: Purview, information protection, insider risk
- Run timed practice questions weighted toward Domains 2 and 3
For a more complete week-by-week plan with resource recommendations, the SC-900 Study Guide 2026: How to Pass on Your First Attempt expands on this structure. And if you want a compact reference for last-minute review, the SC-900 Cheat Sheet 2026: One-Page Review of Must-Know Facts condenses the must-know points by domain. Practicing under realistic timed conditions on our SC-900 practice test platform is one of the most direct ways to see how your knowledge holds up against the 45-minute clock before exam day.
What Happens After You Pass
Once you earn Microsoft Certified: Security, Compliance, and Identity Fundamentals, the credential does not expire. There's no renewal assessment and no continuing-education credit requirement to maintain it - a notable difference from many associate and expert-level Microsoft certifications that require periodic renewal.
Because SC-900 is a fundamentals badge, it's commonly used as a stepping stone toward associate-level Microsoft certifications in security, identity, or compliance, or as a credential that supports a resume for roles touching Microsoft 365 security, Azure identity administration, or compliance operations. If you're mapping out how this credential fits into a broader learning path, SC-900 Training covers structured learning options, and SC-900 Salary Guide 2026: Complete Earnings Analysis discusses how the credential factors into compensation conversations without relying on invented figures.
Curious readers researching the credential from different angles often land on related explainer pages - SC-900 Meaning, What Does SC-900 Stand For?, and What Is SC-900 Certification? all approach the same core facts from slightly different search angles, and cross-referencing them can help confirm you're studying the right exam before you register through the practice test hub.
Frequently Asked Questions
No. It's a fundamentals-level exam focused on conceptual understanding of Microsoft security, compliance, and identity capabilities, not hands-on configuration or scripting tasks.
Testing time is 45 minutes. Your full appointment, including check-in and paperwork, runs about 65 minutes total.
No formal prerequisite, prior certification, degree, or training-hour requirement is listed. Microsoft does recommend general familiarity with Azure and Microsoft 365 concepts.
You need a scaled score of 700 out of 1000. This is not the same as answering 70% of questions correctly, since scoring accounts for question weighting.
No. It's a fundamentals credential with no expiration date and no renewal assessment or continuing-education requirement.