SC-500 study guide
SC-500 · Work through your exam, one topic at a time.
SC-500, the Microsoft Certified: Security, Compliance, and Identity Fundamentals credential, is an entry-level certification for people who want a working vocabulary in cloud security rather than deep hands-on administration. It suits career changers, helpdesk and IT support staff, sales and pre-sales engineers, project managers, and auditors or GRC staff who need to talk credibly with technical teams. The exam is organized into four equally weighted domains: core concepts of security, compliance, and identity; the capabilities of Microsoft Entra; Microsoft security solutions; and Microsoft compliance solutions. Expect a broad survey rather than deep configuration - the emphasis is on recognizing what a given service does, which problem it solves, and when to reach for it. The SC-500 study guide has 4 sections and about 1,175 words.
01Security, Compliance, and Identity Concepts
Security, compliance, and identity are related but distinct. Security protects assets (confidentiality, integrity, availability).
302 words, about 2 min02Microsoft Entra Capabilities
Microsoft Entra is the cloud identity and access management family (successor branding for Azure AD). Core capabilities: Entra ID (directory, SSO, MFA, Conditional Access), Entra ID Governance (access reviews, entitlement management, lifecycle workflows, PIM), Entra Verified ID (decentralized identity), Entra Permissions Management (CIEM for multicloud), and Entra Internet/Private Access (SSE).
288 words, about 1 min03Microsoft Security Solution Capabilities
Microsoft's security stack spans identity, endpoints, cloud, and data. Microsoft Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP).
300 words, about 2 min04Microsoft Compliance Solution Capabilities
Microsoft Purview covers data governance and compliance. Core areas: data classification (sensitive information types, trainable classifiers), Data Loss Prevention (DLP) to block sensitive data leaving, retention and deletion policies and labels, records management , Insider Risk Management , eDiscovery , Audit , Communication Compliance , and Compliance Manager for control assessment.
285 words, about 1 min