FundamentalsSC-900
Microsoft Security, Compliance, and Identity Fundamentals
Validate your knowledge of security, compliance, and identity concepts and related Microsoft cloud services — ideal for business stakeholders and IT professionals beginning their security journey.
Study Hours
10h
Prep Time
~4 weeks
Avg. Pass Rate
79%
Topics Covered
Security Concepts
Identity & Access
Microsoft Compliance
Microsoft Defender
Skills measured
Official study guideMicrosoft's own objectives, in the order the exam presents them. Each area links to its section on Microsoft Learn. Checked 2026-10-26.
Describe the concepts of security, compliance, and identity10–15%
This area on Microsoft LearnDescribe security and compliance concepts
- Describe the shared responsibility model
- Describe defense-in-depth
- Describe the Zero Trust model
- Describe encryption and hashing
- Describe Governance, Risk, and Compliance (GRC) concepts
Define identity concepts
- Define identity as the primary security perimeter
- Define authentication
- Define authorization
- Describe identity providers
- Describe the concept of directory services and Active Directory
- Describe the concept of federation
Describe the capabilities of Microsoft Entra25–30%
This area on Microsoft LearnDescribe function and identity types of Microsoft Entra ID
- Describe Microsoft Entra ID
- Describe types of identities, including workload identities
- Describe hybrid identity
Describe authentication capabilities of Microsoft Entra ID
- Describe the authentication methods
- Describe multifactor authentication (MFA)
- Describe password protection and management capabilities
Describe access management capabilities of Microsoft Entra ID
- Describe Microsoft Entra Conditional Access
- Describe Microsoft Entra roles and role-based access control (RBAC)
Describe identity protection and governance capabilities of Microsoft Entra
- Describe Microsoft Entra ID Governance
- Describe access reviews
- Describe the capabilities of Microsoft Entra Privileged Identity Management
- Describe Microsoft Entra ID Protection
Describe the capabilities of Microsoft security solutions35–40%
This area on Microsoft LearnDescribe core infrastructure security services in Azure
- Describe Azure DDoS Protection
- Describe Azure Firewall
- Describe Azure Web Application Firewall (WAF)
- Describe network segmentation with Azure virtual networks
- Describe network security groups (NSGs)
- Describe Azure Bastion
- Describe Azure Key Vault
Describe security management capabilities of Azure
- Describe Microsoft Defender for Cloud
- Describe Cloud Security Posture Management (CSPM)
- Describe how security policies, standards, and recommendations improve the cloud security posture
- Describe enhanced security features provided by cloud workload protection
Describe capabilities of Microsoft Sentinel
- Define the concepts of security information and event management (SIEM) and security orchestration automated response (SOAR)
- Describe threat detection and mitigation capabilities in Microsoft Sentinel
Describe threat protection with Microsoft Defender XDR
- Describe Microsoft Defender XDR services
- Describe Microsoft Defender for Office 365
- Describe Microsoft Defender for Endpoint
- Describe Microsoft Defender for Cloud Apps
- Describe Microsoft Defender for Identity
- Describe Microsoft Defender Vulnerability Management
- Describe Microsoft Threat Intelligence
- Describe the Microsoft Defender portal
Describe the capabilities of Microsoft compliance solutions20–25%
This area on Microsoft LearnDescribe Microsoft Service Trust Portal and privacy principles
- Describe the Service Trust Portal offerings
- Describe the privacy principles of Microsoft
Describe compliance management capabilities of Microsoft Purview
- Describe the Microsoft Purview portal
- Describe Compliance Manager
- Describe the uses and benefits of compliance score
Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview
- Describe the data classification capabilities
- Describe the benefits of Content explorer and Activity explorer
- Describe sensitivity labels and sensitivity label policies
- Describe data loss prevention (DLP)
- Describe records management
- Describe retention policies, retention labels, and retention label policies
Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview
- Describe insider risk management
- Describe eDiscovery solutions in Microsoft Purview
- Describe audit solutions in Microsoft Purview