An administrator wants users to be required to complete multifactor authentication only when they sign in from outside the corporate network. Which Entra capability provides this?

Entra ID Protection risk detection

A security team wants a single service that collects security data from Microsoft and non-Microsoft sources, detects threats with analytics, and automates responses with playbooks. Which Microsoft service is this?

Microsoft Defender for Endpoint

Who should take SC-900?

Anyone who needs the map of Microsoft security, compliance and identity: new security and IT staff, compliance teams, and people about to take SC-200, SC-300 or SC-400.

It is conceptual. You need to know what each service does and which problem it solves, not how to configure it.

How long should I study?

Fifteen to twenty-five hours for most people; less if you already work in Microsoft 365 or Azure.

No, Fundamentals certifications do not need renewing.

SC-900 or AZ-900 first?

AZ-900 if you are new to Azure in general; SC-900 if security and identity is your focus. They overlap on the concepts domain only.

All certifications

Microsoft · SC-900 · Fundamentals

Microsoft Security, Compliance, and Identity Fundamentals

Security, compliance and identity concepts and the Microsoft Entra, Defender and Purview capabilities that deliver them.

Free practice: 210 questions written to the official exam guide, with the diagnostic, practice papers, timed mocks, a study plan and an explanation on every answer.

Official exam page

Find out where you stand on SC-900

20 questions drawn in the exam’s own domain weights. You get a report straight away: your score against the pass mark, where the points went, and what to study first.

Questions: 20
Time: about 20 minutes
Cost: free

Your email

Your answers save as you go, and the report stays in your record. A new email needs no code.

· your answers stay on this device and you can save the report at the end.

The course

The diagnostic shows where you stand. Then you learn the syllabus chapter by chapter, answer that chapter’s questions, and move on. When every chapter is mastered, you sit full timed mocks in the real exam’s shape.

13 chapters, about 10 hours in all. Each is a 45-minute study session with quick checks, then a 10-question quiz on that chapter.

Concepts of security, compliance, and identity12% of the exam

Security and compliance concepts45 min
Identity concepts45 min

Capabilities of Microsoft Entra28% of the exam

Microsoft Entra ID and identity types45 min
Authentication in Microsoft Entra ID45 min
Conditional Access and roles45 min
Identity protection and governance45 min

Capabilities of Microsoft security solutions37% of the exam

Core infrastructure security in Azure45 min
Security management with Microsoft Defender for Cloud45 min
SIEM and SOAR with Microsoft Sentinel45 min
Threat protection with Microsoft Defender XDR45 min

Capabilities of Microsoft compliance solutions23% of the exam

Service Trust Portal, privacy and Compliance Manager45 min
Information protection, DLP and data lifecycle in Microsoft Purview45 min
Insider risk, eDiscovery and audit in Microsoft Purview45 min

About the Microsoft Security, Compliance, and Identity Fundamentals (SC-900) exam

SC-900 is Microsoft's entry certification for security, compliance and identity. It is for people who need to understand how Microsoft secures identities, devices, data and cloud workloads: IT and security staff new to the Microsoft stack, compliance and privacy professionals, business stakeholders, and anyone preparing for the SC-200, SC-300 or SC-400 role-based exams.

The exam has four domains: the concepts (zero trust, shared responsibility, defence in depth, encryption, identity), Microsoft Entra (identity and access, conditional access, identity governance), Microsoft security solutions (the largest domain: Defender for Cloud, Defender XDR, Sentinel, network and infrastructure security in Azure), and Microsoft compliance solutions (Purview, data classification, records management, insider risk and eDiscovery, plus the Service Trust Portal).

There are no prerequisites and it does not expire. Fifteen to twenty-five hours of study is typical.

The exam at a glance

Questions: 40 to 60 questions, multiple choice, multiple response, drag and drop, and hot area
Time: 45 minutes
Pass mark: 700 out of 1,000
Exam fee: About US$99
Valid for: Does not expire
Where you sit it: Pearson VUE test centre or online proctored; free Microsoft practice assessment available
Prerequisites: None

As published in the vendor’s exam guide at the time of writing. Fees vary by country and change; the vendor’s page is the source of truth.

What is on the exam, domain by domain

Concepts of security, compliance, and identity
The shared responsibility model, defence in depth, zero trust, encryption and hashing, governance, risk and compliance, and the identity concepts: identity as the security perimeter, authentication, authorisation, identity providers, directory services and federation.
12% of the paper
Capabilities of Microsoft Entra
Entra ID as the identity service, identity types, hybrid identity, authentication methods and MFA, conditional access, roles, and identity governance and protection.
28% of the paper
Capabilities of Microsoft security solutions
The largest domain. Azure infrastructure security (DDoS Protection, Firewall, WAF, virtual network segmentation, NSGs, Bastion, Key Vault), Defender for Cloud and its posture management, Microsoft Sentinel as SIEM and SOAR, and the Defender XDR family for endpoints, identity, Office 365 and cloud apps.
37% of the paper
Capabilities of Microsoft compliance solutions
The Service Trust Portal and Microsoft's privacy principles, Microsoft Purview Compliance Manager, data classification, sensitivity labels, data loss prevention, retention and records management, insider risk, eDiscovery and audit.
23% of the paper

How to prepare

Complete the free Microsoft Learn path for SC-900, then take Microsoft's free practice assessment before and after.
Learn the product families by job: Entra for identity, Defender for protection and detection, Sentinel for SIEM and SOAR, Purview for data and compliance. Most questions ask which family a described capability lives in.
Understand conditional access as if-then logic (signals, decisions, controls); it is the single most examined Entra topic.
Know the difference between the Service Trust Portal (Microsoft's own compliance evidence) and Compliance Manager (your organisation's posture).
Fifteen to twenty-five hours of study is enough. Book when the practice assessment is consistently above 80%.

Sample questions

Three questions in the exam’s style, written by Square 1 against the published domains. They are ours, not the vendor's. The answer and the reasoning are under each one; the practice papers on this page draw from a bank written the same way, with an explanation on every question.

Question 1 · Capabilities of Microsoft Entra
An administrator wants users to be required to complete multifactor authentication only when they sign in from outside the corporate network. Which Entra capability provides this?
1. Self-service password reset
2. Conditional access
3. Entra ID Protection risk detection
4. Privileged Identity Management
Answer: B. Conditional access policies evaluate signals such as location and apply controls such as requiring MFA. Self-service password reset handles resets, ID Protection detects risky sign-ins, and PIM manages just-in-time privileged roles.
Question 2 · Capabilities of Microsoft security solutions
A security team wants a single service that collects security data from Microsoft and non-Microsoft sources, detects threats with analytics, and automates responses with playbooks. Which Microsoft service is this?
1. Microsoft Defender for Endpoint
2. Microsoft Sentinel
3. Azure Bastion
4. Microsoft Purview
Answer: B. Microsoft Sentinel is the cloud-native SIEM and SOAR: it ingests data from many sources, applies analytics and runs automated playbooks. Defender for Endpoint protects devices, Bastion provides secure VM access, and Purview is compliance and data governance.
Question 3 · Capabilities of Microsoft compliance solutions
A compliance officer wants to prevent employees from emailing documents that contain credit card numbers outside the organisation. Which Microsoft Purview capability should be used?
1. Retention labels
2. Data loss prevention policies
3. eDiscovery
4. Compliance Manager
Answer: B. Data loss prevention policies detect sensitive information types such as credit card numbers and block or warn on sharing. Retention labels govern how long content is kept, eDiscovery finds content for legal cases, and Compliance Manager tracks regulatory posture.

Questions people ask before they book

Who should take SC-900?: Anyone who needs the map of Microsoft security, compliance and identity: new security and IT staff, compliance teams, and people about to take SC-200, SC-300 or SC-400.
Is it technical?: It is conceptual. You need to know what each service does and which problem it solves, not how to configure it.
How long should I study?: Fifteen to twenty-five hours for most people; less if you already work in Microsoft 365 or Azure.
Does SC-900 expire?: No, Fundamentals certifications do not need renewing.
SC-900 or AZ-900 first?: AZ-900 if you are new to Azure in general; SC-900 if security and identity is your focus. They overlap on the concepts domain only.