Microsoft SC-900 introduces the concepts that connect security, compliance and identity across Azure and Microsoft 365. It is designed for people who need to understand what a control does and why an organization uses it, including students, business stakeholders and IT professionals at the beginning of a security-focused path. The exam does not confer administrative authority or prove that someone can operate a production security platform. Its value lies in a shared vocabulary for discussing risk, access, threat protection and information governance.
The official Microsoft skills outline was updated on October 21, 2026. The current focus spans foundational security principles, Microsoft Entra, Microsoft security products, and compliance capabilities in Microsoft Purview. Older descriptions of Azure Active Directory or Microsoft 365 Defender can be useful history but should not substitute for the present product names and exam objectives. This article preserves the original overview of security, compliance and identity concepts while distinguishing the products by the problem each addresses rather than repeating feature marketing.
The SC-900 blueprint connects four areas of responsibility
The current Microsoft study guide lists Describe the concepts of security, compliance, and identity at 10–15%; Describe the capabilities of Microsoft Entra at 25–30%; Describe the capabilities of Microsoft security solutions at 35–40%; and Describe the capabilities of Microsoft compliance solutions at 20–25%. These are exam domain ranges, not a statement that every organization must purchase or configure all products. Candidates should consult Microsoft’s versioned skills guide before scheduling because product names and objective details can change.
A business stakeholder may need to understand why access to sensitive reports is restricted. A new administrator may need to know how sign-in policy, device risk and permissions fit together. A compliance professional may need to distinguish a retention policy from a security alert. The SC-900 objective groups help classify these questions, but a strong learner can also explain how multiple control families interact when the same user works with a protected document in a cloud application.
Microsoft’s current certification overview describes SC-900 as foundational, with general awareness of Azure and Microsoft 365 being helpful. It does not assume that candidates already manage a security operations center or implement every Purview feature. Introductory hands-on demonstrations can clarify the concepts, but exam preparation should be aligned with what the fundamentals guide actually asks candidates to describe.
Security foundations: responsibility, defense in depth and Zero Trust
Shared responsibility separates controls operated by a cloud provider from the controls the customer must manage. The exact boundary depends on infrastructure, platform or software services. Microsoft can maintain the infrastructure for a service while the customer still decides who is authorized, what data may be shared and how identity and records policies are configured. A successful cloud migration does not make the customer’s access-governance responsibilities disappear.
Defense in depth combines controls rather than placing all protection at one boundary. Identity verification, network controls, application validation, encryption, monitoring and recovery each address different ways a system can fail or be abused. The Zero Trust model emphasizes verifying explicitly, using least-privilege access and assuming compromise can occur. It is not a product you purchase once or a claim that every user should be blocked by default. The principles of Zero Trust security help explain why identity, device health and data sensitivity can affect a decision even when traffic originates inside a corporate network.
Authentication establishes that a user or workload is who it claims to be, while authorization determines the actions that identity is allowed to perform. Encryption protects data under defined conditions, whereas hashing can support integrity checks and password-verification workflows when appropriately designed. Neither can replace correct access policy, audit logging or recovery planning. The exam tests these conceptual distinctions because they recur throughout Microsoft Entra, Azure and Microsoft Purview.
Microsoft Entra: identities, authentication and access controls
Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It manages users, groups, applications and service principals, and it participates in authentication and access decisions across supported services. Hybrid identity connects some on-premises identity systems with cloud access, but the architecture and management responsibilities depend on the actual synchronization or federation arrangement. Microsoft Entra is a family of identity capabilities; calling every identity-governance feature simply “Azure AD” obscures present terminology.
Multifactor authentication adds an authentication factor to reduce reliance on a password alone. Conditional Access evaluates signals and policy conditions to make supported access decisions; it is not itself the same thing as a user knowing a password. Role-based access control limits administrative permissions, while Privileged Identity Management can support time-bound elevation and approval workflows where available. These features have licensing and configuration requirements; SC-900 learners should describe their purposes rather than assume every tenant includes every advanced control.
Identity Governance and access reviews help organizations evaluate ongoing entitlements, while Entra ID Protection detects certain identity risks and supports risk-related responses. In a fictional company, an employee who changes departments should lose access they no longer need, even when their sign-in remains valid. The Conditional Access decision model is useful because an authorized user’s authentication success does not automatically justify every permission or device context.
Azure infrastructure security and Defender for Cloud
Azure virtual networks, network security groups, Azure Firewall, Web Application Firewall and DDoS Protection address different layers of network or application exposure. A network security group can filter specified traffic, but cannot ensure an application validates user input. A web application firewall addresses certain HTTP-layer threats but is not a substitute for patching vulnerable application code. Azure Bastion provides a controlled management-access pattern for supported virtual machines, while Azure Key Vault supports secrets, keys and certificates when configured appropriately.
Microsoft Defender for Cloud is used to assess and improve cloud security posture and to protect supported workloads. Cloud Security Posture Management examines configurations and recommendations; cloud workload protection can provide additional threat-focused capabilities. A security score or posture recommendation highlights an issue to investigate, not a guarantee that an environment is compliant or safe. A team still needs responsible owners, approved remediation and evidence that changes actually work.
The Defender for Cloud posture and workload protection topic illustrates why preventative configuration checks and active threat protection are related but separate. A development subscription with unrestricted test accounts may create risk even when every virtual machine has an endpoint agent. A robust design considers both identity permissions and the exposed workloads.
Microsoft Sentinel and Defender XDR are not interchangeable
Microsoft Sentinel is a cloud-based security information and event management (SIEM) and security orchestration, automation and response (SOAR) solution. It can ingest supported telemetry, analyze signals and help security teams investigate and automate responses. An incident in Sentinel can involve multiple signals from different environments; its usefulness depends on appropriate connectors, data quality, rules, staffing and response processes. Buying or enabling a SIEM does not automatically establish that a security operations center is effective.
Microsoft Defender XDR integrates threat-protection and investigation capabilities across supported security domains. Products such as Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps address different surfaces while contributing to the broader investigation experience. The Microsoft Defender portal brings together supported operations; a candidate should understand why an endpoint alert and a suspicious sign-in may be related, without assuming a single product replaces identity governance or information protection.
For a small exercise, imagine an employee opening a malicious attachment and then attempting to access a sensitive cloud file. Endpoint telemetry, email protection, identity signals and data controls may contribute separate evidence. The Defender for Endpoint protection model is relevant to the device side, while Sentinel provides a broader monitoring and response context. The goal in SC-900 is to describe what each product class contributes, not to perform an entire professional incident investigation.
Microsoft Purview: classification, retention, DLP and investigations
Microsoft Purview supports compliance and information-governance capabilities across supported data and Microsoft 365 environments. Classification and sensitivity labels help an organization identify information and apply appropriate protection. Data loss prevention can help detect or restrict specified sharing or movement patterns according to policies. Retention labels and policies address how long records should be kept or disposed of under an organization’s requirements. These are different decisions: a label indicating confidentiality does not automatically define a legally appropriate retention duration.
Purview Compliance Manager helps evaluate compliance-related actions against selected frameworks and improvement tasks, but a compliance score is not a legal certification. The Service Trust Portal provides Microsoft information about compliance, audit documentation and service commitments within its stated scope. A supplier’s audit report does not eliminate the customer’s responsibility for policy, data classification, access or evidence. An effective control program must connect the external assurance to the organization’s actual processing of information.
Microsoft Purview also includes supported insider-risk, eDiscovery and audit capabilities. An investigation may need to preserve and collect relevant records under legal authority, while routine data-loss prevention policies aim to reduce inappropriate disclosure. The Purview information-protection competencies provide deeper context for those who later work in information governance. For SC-900, focus on each capability’s purpose, ownership and limitations instead of memorizing a long administration wizard.
Put the products together in one realistic decision scenario
Consider a fictional nonprofit with employees, volunteers and external collaborators. It uses Microsoft 365 for documents, Azure for a small public service and a central identity tenant. Volunteer access should expire after their engagement ends; financial files need restricted sharing; and the public service must be protected against common web threats. Write the requirement first and assign a control family only after identifying the problem.
Microsoft Entra identity and governance can address sign-in, permissions and access review. Appropriate Conditional Access policies can respond to supported identity and device conditions. Purview labels and DLP can help govern sensitive files and sharing. Azure network and application controls protect the hosted service at other layers. Defender XDR can help investigate supported threats, while Sentinel can correlate monitoring information where the organization has the required configuration and data sources. These features reinforce one another, but the team should not claim any single subscription solves all risks.
For each proposed feature, ask how success would be verified. A review should show that volunteer access was actually removed; a data policy should be tested with synthetic records and an authorized sharing attempt; an alert should reach a named owner and lead to a documented response. Real controls need configuration, people and evidence. This exercise distinguishes conceptual familiarity from production implementation and gives a fundamentals learner a concrete way to explain the shared-responsibility model.
Choose a study sequence for the active October 2026 exam
Start with the official SC-900 skills-measured guide dated October 21, 2026 and build a short map of the four domain groups. Study shared responsibility, Zero Trust and identity terminology first, then Microsoft Entra’s sign-in and governance capabilities, then Defender for Cloud, Defender XDR, Sentinel and infrastructure protections, and finally Purview and compliance concepts. Microsoft Learn provides official modules for each group and a practice assessment accessible through its current preparation experience. Product details can change, so use the live issuer guide rather than a static older study chart.
Make a concept comparison sheet rather than memorizing brand names. For example, compare Conditional Access with role-based authorization, Defender for Cloud posture with Defender XDR investigations, and retention with DLP. Use short case scenarios: a contractor changes roles, a workload is exposed on the internet, a suspicious email prompts an investigation, or a sensitive report is shared externally. Identify the control family and explain what it cannot do. The SC-900 preparation starting point is most useful when the reader understands these boundaries.
The fundamentals certification is a useful introduction, not automatic entry into a specialist engineering role or a guarantee of salary improvement. Microsoft’s current credential policy says fundamentals certifications do not expire; the one-year renewal assessment rules for eligible role-based credentials are different. Check the active exam page for the exact registration, language and scheduling conditions before paying. Continue building practical work examples if you later pursue identity, security operations or compliance administration.
Use SC-900 to develop clearer security conversations
The strongest outcome from SC-900 study is being able to explain why a business needs an identity control, which product family is relevant to a threat, and how governance or compliance requirements relate to the protection of data. These ideas apply beyond a certification exam, but the Microsoft product names and options should always be verified against current documentation. A security-aware workforce still needs enforceable policies, capable operators and rehearsed responses.
The original page’s promise that the badge directly produces career returns or measurable risk reduction should be treated as marketing rather than an established result. The exam validates specified foundational knowledge; it does not prove that a candidate has designed a resilient enterprise security program. Build on that foundation through examples, authorized practice and current Microsoft guidance, choosing the next specialization according to the work you want to perform.