SC-500
Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-500)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
SC-500, the Microsoft Certified: Security, Compliance, and Identity Fundamentals credential, is an entry-level certification for people who want a working vocabulary in cloud security rather than deep hands-on administration. It suits career changers, helpdesk and IT support staff, sales and pre-sales engineers, project managers, and auditors or GRC staff who need to talk credibly with technical teams. The exam is organized into four equally weighted domains: core concepts of security, compliance, and identity; the capabilities of Microsoft Entra; Microsoft security solutions; and Microsoft compliance solutions. Expect a broad survey rather than deep configuration - the emphasis is on recognizing what a given service does, which problem it solves, and when to reach for it. Preparation works best in layers: read the official skills outline first, then work through the Microsoft Learn learning paths for each domain, then test yourself with practice questions and re-read only the areas you miss. Because the domains are weighted evenly, a weak domain costs you as much as a strong one, so budget study time across all four. This page is independent study material and is not affiliated with or endorsed by Microsoft; always confirm current exam details on Microsoft's official certification site.
What you'll study
About SC-500 preparation
What is the format of the SC-500 exam?
Microsoft fundamentals exams are typically delivered at a test center or online with live proctoring, and the question mix can include multiple choice, multiple select, drag-and-drop, hot area, and short case-study items. The authoritative list of item types and delivery options is published by Microsoft on its certification exam page.
How long is the exam and how many questions are there?
Microsoft publishes the current duration and question count for each exam on its official certification pages, and these can change between releases. Rather than rely on secondhand figures, check the exam details page on Microsoft's site before you book so you can plan your pacing.
What score do I need to pass?
Microsoft does not publish a fixed passing score for its exams; scores are scaled and the threshold is set per exam and can be revised. The official exam page is the only reliable place to confirm current scoring information. Plan to know the material well rather than aiming at a number.
How much does the exam cost and how long is the certification valid?
Fees vary by country and currency, and Microsoft fundamentals certifications generally do not require periodic renewal in the way role-based certifications do. Because pricing and validity policy can change, confirm both on Microsoft's official certification site rather than relying on older blog posts.
How hard is SC-500 for someone new to security?
It is designed as a fundamentals exam, so no prior administration experience is assumed. The difficulty is breadth, not depth: you need to recognize many services and their purposes. Candidates with some IT background usually find it approachable; complete beginners should expect several weeks of steady reading and self-testing.
What study order do you recommend?
Start with domain 1 to build shared vocabulary around threats, encryption, authentication, and authorization, since later domains assume it. Then take Entra, followed by security solutions, then compliance. Finish with practice questions across all four domains, because they carry equal weight and a neglected domain is the most common reason for a near miss.
Can I retake the exam if I fail?
Microsoft allows retakes, but the rules differ between fundamentals and role-based exams, including any waiting period and whether the first retake is free. The retake policy is stated on Microsoft's official exam policy pages; read it before your first attempt so you know your options.
What are the most common failure modes?
Candidates most often confuse overlapping services - for example mixing up identity protection features, or conflating data governance with data loss prevention. Others memorize product names without learning the scenario each one addresses. Practice questions framed as short business scenarios expose both problems faster than rereading documentation.
Do I need hands-on experience with the products?
No, but a free Microsoft Learn sandbox or trial tenant helps concepts stick. Creating a user, assigning a role, and looking at a compliance portal dashboard turns abstract descriptions into something you can reason about. Even an hour of clicking through a trial environment improves recall on scenario questions.
Is this page an official Microsoft resource?
No. This is independent study material prepared by a third party and is not affiliated with, endorsed by, or sponsored by Microsoft. Use it alongside the official skills outline and Microsoft Learn content, and treat Microsoft's own certification pages as the final authority on exam logistics.