SC-900: Security, Compliance, and Identity Fundamentals

The SC-900 exam introduces the principles and Microsoft cloud capabilities that help organizations protect identities, systems, and information. It is a fundamentals credential, not a test of advanced security architecture or detailed incident-response command syntax. A good candidate can explain the distinction between authentication and authorization, why modern security assumes compromise is possible, which Microsoft services address different security problems, and how compliance requirements translate into operational controls.

SC-900 is active as of October 10, 2026. Microsoft has announced an English exam update effective October 21, 2026, so the version used by someone testing before that date should not be confused with future objectives. Microsoft's current study guidance groups the material into security and compliance concepts, Microsoft Entra, Microsoft security solutions, and Microsoft compliance solutions. The study goal is a conceptual map of those categories, not memorizing every feature in a product suite whose licensing and user interfaces change frequently.

Understand shared responsibility, risk, and defense in depth

Cloud security begins with an agreement about responsibility. In an infrastructure service, the provider operates physical facilities and underlying infrastructure while the customer makes important decisions about operating-system configuration, identities, applications, and data. In a managed platform, additional responsibilities shift to the provider, but customer permissions and data handling remain central. In a software-as-a-service environment, the provider delivers more of the application stack, yet an organization can still expose confidential data through oversharing or compromised accounts.

Defense in depth uses multiple controls so that one failure does not necessarily lead to total compromise. Identity verification, network boundaries, endpoint protection, encryption, backup, logging, and security awareness address different attack opportunities. They are not interchangeable. A firewall may reduce network exposure but cannot determine whether a logged-in employee is authorized to download all customer records. An encrypted database can protect information on stolen media while leaving an overprivileged application account able to read it.

The Zero Trust approach emphasizes explicit verification, least privilege, and the assumption that an identity or device can be compromised. It is not a Microsoft product that an organization purchases and turns on. For example, a conditional-access decision may consider device health and user risk, while data permissions still decide what files that approved session can reach. The wider Zero Trust architecture helps connect these decisions without claiming that every device or identity is equally trusted.

Risk and compliance overlap but are not the same. A legal or contractual requirement may mandate record retention or privacy controls, while a technical risk assessment evaluates likelihood, exposure, and business impact. A compliance report might show a control is configured even though it is ineffective in a real attack scenario. Learn the difference between preventive, detective, and corrective controls and why evidence of operation matters as much as policy wording.

Distinguish identity, authentication, and authorization

An identity represents a user, application, device, or service. Authentication answers who or what is presenting a credential; authorization determines which resource operations are allowed. Multifactor authentication can strengthen sign-in without correcting an overly broad permission grant. Directory services maintain identity information, while federation and single sign-on can allow trusted authentication across applications. Understanding these terms prevents common errors when interpreting an access problem.

Microsoft Entra ID provides cloud identity and access capabilities for users, groups, applications, and workload identities. Organizations may also connect to on-premises Active Directory, but cloud and hybrid identities have different dependencies. A synchronized account is not the same as a universally shared password store, and a failed sign-in may result from a conditional-access rule rather than an invalid credential. The foundational identity and access management concepts are useful across cloud providers, not only in Microsoft products.

Microsoft Entra's security capabilities include conditional access, MFA options, external identities, and governance controls appropriate to different roles and licenses. Think about an employee accessing confidential documents from a personal device: identity verification, device context, session controls, file permissions, and data protection may all be relevant. A policy should be evaluated in terms of the path to the protected asset instead of whether one checkbox is enabled.

Privileged identities require more scrutiny because they can change the controls that protect other users. Just-in-time role activation, approval processes, access reviews, and emergency-access procedures can reduce this risk. But the business goal remains simple: an account should have the permissions necessary for its work, for no longer than necessary. Candidates need the broad purpose of these controls; detailed PIM deployment scenarios belong to more advanced role-based exams.

Recognize the Microsoft security product families

Microsoft Defender products address different security surfaces. Defender for Endpoint focuses on endpoints and their risks; Defender for Office 365 addresses email and collaboration threats; Defender for Identity supports detection of identity-related behavior; and Defender for Cloud focuses on cloud security posture and workload protections. Defender XDR can correlate evidence across supported products, but individual subscriptions, connectors, and licenses affect actual coverage. Avoid describing the portfolio as one undifferentiated antivirus service.

Microsoft Sentinel is a security information and event management and orchestration platform that can ingest records from many sources, support analytics, and coordinate response workflows. A SIEM does not prevent every attack simply because it receives logs. Its value depends on signal coverage, correlation rules, triage, and operational ownership. The SIEM and event-correlation fundamentals explain how records become actionable information without implying that collecting data is the same as responding to an incident.

Microsoft Defender for Cloud helps organizations identify security posture issues and implement workload protections for supported cloud resources. A posture recommendation can reveal public exposure, missing hardening, or inadequate monitoring. Yet risk must be evaluated in context: a recommendation is evidence to investigate, not a verdict that every resource has already been compromised. The Defender for Cloud posture model becomes more concrete when considering how teams prioritize and verify remediation.

Security Copilot and related AI assistants may help explain findings, summarize incidents, or support investigations, but generated outputs can be wrong or incomplete. Human operators must verify their conclusions against underlying evidence, particularly when a response could disable users, interrupt services, or expose sensitive information. Knowing the limits of security tools is part of foundational competence.

Connect compliance, information protection, and privacy

Microsoft Purview is a family of information protection, data governance, and compliance capabilities. Sensitivity labels may classify or protect content, data loss prevention can constrain risky transfers, retention policies affect how long information is preserved, and auditing records selected activities. These solve different problems. Keeping a document for seven years does not automatically encrypt it, and encrypting a document does not establish the right retention schedule.

An organization might classify payroll data as confidential, restrict its external sharing, and retain certain records under applicable law. The protection strategy needs business rules, not merely a product setting. False-positive DLP matches can interfere with legitimate work; overly permissive policies can let data move without oversight. The relationship between data classification and DLP is valuable because the correct treatment of information depends on its meaning and context.

Privacy is concerned with appropriate collection, processing, disclosure, retention, and use of information about people. Security controls can help protect privacy, but encryption and access restriction do not by themselves make every data-processing activity lawful. Legal obligations vary by jurisdiction and industry. SC-900 candidates should understand why compliance solutions support organizational policy and evidence, rather than assume Microsoft certifications provide legal advice.

Information governance also applies to AI-assisted work. If a user already has access to overshared files, an AI assistant may make those files more discoverable. Reviewing permissions, data classification, retention, and consent remains essential before broad deployment. Product protection claims should be evaluated against actual tenant configurations and organization-specific requirements.

Apply fundamentals to realistic decisions

Consider a small company introducing Microsoft 365 and Azure. It has remote employees, shared finance documents, virtual machines, and external contractors. Start by mapping identities and important information, choosing appropriate authentication methods, limiting administrative rights, and determining how guest access is managed. Then evaluate endpoint protection, security monitoring, document labels, backup, and incident ownership. A layered plan is more credible than buying a security subscription without defining what it must protect.

The same scenario offers useful exam practice. Which component handles user sign-in? What is the difference between an identity risk signal and a permission grant? When would retention be relevant rather than DLP? Which product can help correlate threats across endpoints and email? Why might a private network path still require data-level authorization? Explain the reason for each choice, not just the product name. Most fundamentals questions reward recognizing responsibilities and relationships.

Compare two plausible solutions rather than one obviously incorrect answer. For instance, both identity permissions and DLP may affect whether data leaves an organization, but one controls resource access and the other can inspect or govern particular actions. A security dashboard may reveal a configuration problem, while an incident-response workflow investigates a suspected attack. Studying the distinction between overlapping controls makes new product features easier to understand.

Build a concept glossary in your own language and use simple practice exercises: identify roles in a sample permission hierarchy, classify business documents, or walk through what happens after a risky login. Hands-on familiarity with a safe demonstration tenant can help, but SC-900 does not demand that a beginner deploy a complete enterprise security operations center.

Prepare for SC-900 without importing an outdated syllabus

Use the official Microsoft Learn skills outline corresponding to the exam date. The October 21, 2026 English revision is a future event at the time of this checkpoint, and Microsoft may deploy localized versions later. Verify updates shortly before scheduling; do not assume a third-party objective distribution remains authoritative after a provider announcement. Exam fees, language availability, and delivery rules may also vary by region or change over time.

SC-900 is suitable for learners who need vocabulary and a broad conceptual understanding before choosing a role-based security credential. It does not certify someone to design enterprise-wide security strategy or perform advanced threat hunting. Identity practitioners may later consider SC-300; operations analysts may consider SC-200; people focusing on sensitive information might pursue SC-401. These are related professional directions, not required sequential stages for every candidate.

The most durable preparation outcome is the ability to explain what a security control does, which problem it addresses, who operates it, and what failure it cannot prevent. That reasoning survives future product renames and examination revisions. Before publication, the article still requires a current official-outline check, live HTTP and redirect validation for internal links, and independent editorial approval.