- SC-900 tests four domains, with Microsoft security solutions weighted heaviest at 35-40%.
- You need 700 out of 1000 scaled points to pass - not necessarily 70% of items correct.
- Testing time is 45 minutes inside a standard 65-minute proctored appointment.
- The credential doesn't expire, so there's no renewal assessment or continuing-education requirement.
What Is SC-900 Certification?
SC-900, formally titled Microsoft Security, Compliance, and Identity Fundamentals, is an entry-level credential from Microsoft that validates a baseline understanding of security, compliance, and identity concepts across the Microsoft ecosystem. Unlike associate or expert-level Microsoft exams that dig into hands-on configuration, SC-900 is deliberately conceptual - it checks whether you understand what tools like Microsoft Entra, Microsoft Purview, and Microsoft Defender do, why organizations use them, and how they fit together, rather than asking you to script a deployment.
If you've landed here searching for "SC-900," it's worth stating plainly: this article covers only Microsoft's Security, Compliance, and Identity Fundamentals exam. Other unrelated credentials happen to share the SC-900 code elsewhere, but nothing on this page borrows from them.
For a broader breakdown of naming and scope, see What Is SC-900? and SC-900 Meaning. If you're still untangling the acronym itself, What Does SC-900 Stand For? and What Does SC-900 Mean? cover that ground directly.
Who SC-900 Is Designed For
SC-900 is positioned as a starting point rather than a career-defining exam. Microsoft doesn't list a formal degree, prior certification, employment history, or minimum training-hour requirement to sit for it - anyone can register. That said, familiarity with Azure and Microsoft 365 concepts is recommended, since the exam assumes you at least recognize the products it discusses.
In practice, candidates fall into a few common buckets:
- IT professionals pivoting toward security, compliance, or identity roles who want a structured way to learn Microsoft's terminology before tackling associate-level exams.
- Students and career-changers using Certiport-based delivery (in addition to Pearson VUE) to build a credential before entering the workforce.
- Non-technical stakeholders - project managers, compliance officers, sales engineers - who need enough shared vocabulary to work alongside security and IT teams.
A full breakdown of who qualifies and what's expected going in lives in SC-900 Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Exam Format and Delivery
SC-900 is delivered as a proctored, computer-based exam through Pearson VUE, with Certiport also listed as an option for students and educators. The appointment itself is scheduled for 65 minutes, but the actual testing time allotted for answering questions is 45 minutes - the difference covers check-in, agreements, and a post-exam survey.
Microsoft has not disclosed the exact question count for SC-900 specifically. Across Microsoft certification exams generally, question counts typically fall somewhere in the 40-60 range, but that's a Microsoft-wide pattern, not a guarantee for this exam. Expect a mix of question formats - multiple choice, drag-and-drop matching, and possibly other interactive item types - though Microsoft hasn't published the exact type mix or confirmed whether the exam adapts to your answers.
One detail worth internalizing early: there is no in-exam access to Microsoft Learn documentation. Whatever you know when you sit down is what you have. Remote delivery is available where supported by your region and testing provider.
Key Takeaway
Budget your 45 minutes of testing time as if every question counts equally - don't burn disproportionate time on any single item, since you can't verify facts against outside documentation mid-exam.
The Four SC-900 Exam Domains
SC-900 content is organized into four domains, and the weighting tells you exactly where to invest your study hours. This is the single most SC-900-specific thing about exam prep: the domains aren't evenly split, and one of them dominates.
Domain 1: Describe the concepts of security, compliance, and identity (10-15%)
The smallest domain, but foundational. It covers shared responsibility models, the Zero Trust methodology, encryption and hashing basics, and core compliance concepts.
- Understand Zero Trust principles: verify explicitly, least privilege, assume breach
- Know the shared responsibility model across IaaS, PaaS, and SaaS
Domain 2: Describe the capabilities of Microsoft Entra (25-30%)
This domain covers identity services - authentication, authorization, identity governance, and access management under the Microsoft Entra umbrella.
- Authentication methods, Conditional Access, and identity protection concepts
- External identities, identity governance, and privileged access management basics
Domain 3: Describe the capabilities of Microsoft security solutions (35-40%)
The largest domain by far - nearly two-fifths of the exam. It spans Microsoft's broader security tooling beyond identity.
- Microsoft Defender family (Defender for Cloud, Defender for Endpoint, Defender XDR)
- Microsoft Sentinel concepts and extended detection/response fundamentals
- Security posture management and cloud security capabilities
Domain 4: Describe the capabilities of Microsoft compliance solutions (20-25%)
Covers Microsoft Purview and the broader compliance toolset for data governance, protection, and regulatory response.
- Compliance Manager, data classification, and information protection
- Insider risk management, eDiscovery, and data lifecycle management basics
Because Domain 3 alone accounts for more than a third of the exam, it deserves the most repetition in your review cycle. For a deep dive into each domain with topic-by-topic breakdowns, read SC-900 Exam Domains 2026: Complete Guide to All 4 Content Areas.
| Domain | Weight | Core Focus |
|---|---|---|
| Security, Compliance, Identity Concepts | 10-15% | Zero Trust, shared responsibility, encryption basics |
| Microsoft Entra | 25-30% | Identity, authentication, access management |
| Microsoft Security Solutions | 35-40% | Defender family, Sentinel, security posture |
| Microsoft Compliance Solutions | 20-25% | Purview, data protection, eDiscovery |
Registration, Fees, and Scheduling
Registration happens through Pearson VUE, with Certiport as an alternate channel primarily used by academic institutions. On the fee: Microsoft's current official U.S. checkout price is not consistently verified across sources, and a commonly cited US$99 figure should be treated as a third-party reference point rather than confirmed pricing. There's no member versus non-member pricing distinction to worry about, but regional taxes and occasional discount vouchers can shift your final total. Always confirm the exact price at checkout before assuming a number from a blog post - including this one.
For the full pricing mechanics, including how vouchers and regional variation typically work, see SC-900 Certification Cost 2026: Complete Pricing Breakdown. If you're trying to plan around specific testing windows or deadlines, check SC-900 Exam Dates 2026: Testing Windows, Deadlines & Scheduling - this is also where the English-language outline update effective July 28, 2026 becomes relevant if you're scheduling near that date.
How SC-900 Is Scored
SC-900 uses a scaled scoring model, with a passing score of 700 out of 1000. This is not the same as needing 70% of questions correct - scaled scoring weights items differently, and Microsoft doesn't publish the exact conversion formula. Some questions may be unscored pilot items mixed into the exam, though the exact scored-versus-unscored breakdown for SC-900 isn't disclosed.
Microsoft also does not publish a pass rate for SC-900. Any specific percentage you see claimed elsewhere online is not an officially confirmed figure. If you want a clear-eyed look at what's actually known (and not known) about pass rates, read SC-900 Pass Rate 2026: What the Data Shows. And if you want the scoring mechanics explained in more depth, SC-900 Passing Score 2026: Exactly What You Need to Pass walks through what the 700/1000 threshold actually means for how many questions you can afford to miss.
What SC-900 Signals to Employers
Because SC-900 requires no prior work experience and skips hands-on configuration tasks, it functions primarily as a vocabulary and orientation credential. Employers hiring for entry-level IT support, security operations center analyst trainee roles, compliance coordination, or sales/pre-sales engineering positions sometimes use it as a screening signal that a candidate understands Microsoft's security and compliance ecosystem at a conceptual level.
It's rarely, if ever, a standalone qualification for a security engineering role - it's more commonly a stepping stone toward associate-level Microsoft certifications (in Entra, Security Operations, or Information Protection) that do test hands-on skills. If you're weighing whether the time investment is worth it relative to your career goals, Is the SC-900 Certification Worth It? Complete ROI Analysis 2026 lays out the tradeoffs honestly, and SC-900 Salary Guide 2026: Complete Earnings Analysis covers how it factors into compensation conversations. For a sense of what roles actually list it as a preferred qualification, see SC-900 Jobs.
A meaningful point in SC-900's favor: as a Fundamentals-level credential, it does not expire, and there's no renewal exam or continuing-education credit requirement to maintain it. Once you pass, it stays on your record indefinitely.
Building a Domain-Aware Study Plan
Given the domain weighting, a smart prep sequence front-loads breadth in Domain 1, builds depth steadily through Domain 2, spends the most repetition on Domain 3, and closes with Domain 4 compliance concepts before a full review pass.
Foundations (Domain 1)
- Learn Zero Trust principles and shared responsibility model
- Get comfortable with core compliance and identity terminology
Identity Deep Dive (Domain 2)
- Study Microsoft Entra authentication and Conditional Access
- Review identity governance and external identity concepts
Security Solutions (Domain 3 - highest weight)
- Map out the Defender family and what each product covers
- Study Microsoft Sentinel and security posture management basics
- Revisit this domain more than any other - it's over a third of the exam
Compliance Solutions (Domain 4)
- Learn Microsoft Purview capabilities: classification, protection, governance
- Cover eDiscovery and insider risk management at a conceptual level
Full Review and Practice
- Run timed practice questions covering all four domains
- Revisit weak domains identified during practice sessions
This timeline is a starting framework, not a rigid schedule - compress or stretch it based on your existing familiarity with Azure and Microsoft 365. For a more detailed week-by-week methodology and first-attempt strategy, see SC-900 Study Guide 2026: How to Pass on Your First Attempt. If you want a fast reference during your final review days, SC-900 Cheat Sheet 2026: One-Page Review of Must-Know Facts condenses the must-know terms into one page, and SC-900 Training covers structured course options if self-study isn't your preferred path.
Once you've covered the material, running full-length timed practice tests on our SC-900 practice test platform is the most direct way to see how your knowledge holds up against exam-style questions across all four domains. If you're still deciding how much difficulty to expect relative to your background, How Hard Is the SC-900 Exam? Complete Difficulty Guide 2026 breaks that down in more detail, and you can return to the practice test homepage anytime to gauge readiness before booking your Pearson VUE appointment.
Frequently Asked Questions
No. SC-900 tests conceptual understanding of security, compliance, and identity capabilities rather than requiring you to configure live environments or write scripts.
No formal prerequisite is required - no degree, prior certification, or employment history is mandated. Familiarity with Azure and Microsoft 365 concepts is recommended but not enforced at registration.
Domain 3, Microsoft security solutions, carries the heaviest weight at 35-40% of the exam, making it the domain worth the most repeated review.
No. As a Fundamentals-level credential, SC-900 does not expire, and there is no renewal assessment or continuing-education requirement to maintain it.
You get 45 minutes of testing time within a standard 65-minute proctored appointment, with the extra time covering check-in and exam procedures.