Microsoft SC-900 common mistakes
Microsoft SC-900 · Understand the traps and how to avoid them.
Treating Zero Trust as a single product or a checklist item, and describing it as 'trust nothing' rather than naming its guiding principles (verify explicitly, use least privilege access, assume breach).
The term sounds like a marketing slogan and candidates skim the model without anchoring the three principles, so scenario questions about conditional access, segmentation, or continuous verification get answered by product recall instead of principle.
What to do instead
Memorize the three principles as a triad and, for each practice question, ask which principle the scenario illustrates. Practice restating a scenario (for example, re-validating a session mid-use) in terms of 'verify explicitly' or 'assume breach' before choosing an answer.
Confusing authentication, authorization, and identity provisioning, for example describing single sign-on as an authorization method or describing role assignment as authentication.
Everyday usage blurs these words, and the exam uses them precisely in distractors about Entra ID capabilities, access reviews, and privileged identity management.
What to do instead
Write one-line definitions and a concrete example for each: authentication proves who you are (password, token, passkey); authorization decides what you may do (role, permission, policy); provisioning creates and maintains the account and its attributes. Tag each practice question with the category before answering.
Assuming Microsoft Entra ID is a like-for-like replacement for on-premises Active Directory Domain Services, expecting Group Policy, organizational unit structure, or domain-join behavior from it.
Both are called 'Active Directory' in casual conversation, so candidates transfer AD DS mental models to cloud identity questions and pick distractors about domain controllers or GPOs.
What to do instead
Build a two-column comparison: Entra ID is a cloud identity provider using flat users and groups, tokens, and conditional policies; AD DS is a hierarchical directory service with domains, OUs, and Group Policy. Note explicitly where hybrid identity (Entra Connect) bridges them, and check any answer choice for AD DS-only artifacts.
Mixing up the Entra ID editions and which features each includes, for example assuming conditional access or identity protection is available in the free tier.
Feature-to-license mapping is memorization-heavy and vendors change packaging, so candidates rely on vague impressions of 'premium does more' and cannot eliminate close distractors.
What to do instead
Maintain a small feature matrix (free, P1, P2) covering conditional access, self-service password reset for cloud versus hybrid, identity protection risk policies, privileged identity management, and access reviews. Re-verify against current Microsoft documentation before the exam, and drill only the rows you keep missing.
Describing Microsoft Defender products by name without mapping each to the workload it protects, for example assigning Defender for Identity to endpoint protection or Defender for Cloud Apps to email filtering.
The products share a brand and a portal, so names feel interchangeable; candidates learn the family as a list rather than as a workload-to-control mapping.
What to do instead
Draw a table pairing each Defender plan with its protected asset: endpoints, identities, email and collaboration, cloud apps (CASB), cloud infrastructure, and software as a service. For every scenario question, first name the asset being attacked, then select the plan that owns it.
Treating Microsoft Sentinel and Microsoft Defender XDR as the same tool, or describing Sentinel as an endpoint agent rather than a cloud-native SIEM and SOAR platform.
Both surface incidents and alerts in similar dashboards, so the distinction between extended detection and response and security information and event management is glossed over.
What to do instead
Anchor on verbs: Defender XDR detects and responds across Microsoft workloads with built-in correlation; Sentinel ingests logs from many sources, writes analytics rules, and automates response with playbooks. Practice classifying scenarios ('collect firewall logs from a third party', 'automate a response workflow') as Sentinel or Defender before checking the answer.
Confusing Secure Score with a compliance score, or treating Secure Score as a percentage of threats blocked rather than a measure of recommended configuration posture.
Both are displayed as percentages in portals, and candidates do not separate posture improvement recommendations from regulatory control assessment.
What to do instead
State the purpose of each in one sentence: Secure Score measures progress on recommended security configurations in Microsoft Defender XDR; compliance score in Microsoft Purview Compliance Manager measures progress on assessed controls for regulations and standards. Attach each to its portal and its unit of measurement, then self-test with mixed scenarios.
Confusing data loss prevention with insider risk management or with retention labels, for example choosing DLP when the scenario asks about preserving records for a fixed period after deletion.
All three live in Microsoft Purview, operate on the same content, and appear in adjacent navigation, so the candidate pattern-matches on the word 'data' instead of on the intent of the control.
What to do instead
Classify by intent: DLP prevents or blocks sharing of sensitive content in motion; retention labels and policies keep or delete content on a schedule; insider risk management detects risky user behavior. For each scenario, write the intent in three words before scanning the options.
Mixing up sensitivity labels with retention labels, assuming a sensitivity label automatically deletes content or that a retention label applies encryption.
Both are labels applied to content in Microsoft Purview, and both can be applied manually or automatically, so the differing payloads (protection and encryption versus lifecycle) get blurred.
What to do instead
Memorize the payload distinction: sensitivity labels carry protection settings such as encryption and content marking and travel with the file; retention labels carry lifecycle settings such as retain, delete, or event-based disposition. Build a two-column cheat sheet and answer label questions by asking whether the scenario is about confidentiality or about time.
Answering compliance questions with a generic 'Microsoft is compliant, so the customer is covered' instead of applying the shared responsibility model to the specific control being asked about.
Marketing language about certifications encourages the assumption that using a cloud service transfers all obligations, but the exam tests which duties remain with the customer for data, identities, endpoints, and configuration.
What to do instead
For each scenario, split duties explicitly: Microsoft secures the physical and platform layers; the customer secures data classification, identity hygiene, device configuration, and correct use of compliance features. Practice by naming two customer-side duties for every service mentioned, and verify coverage against the Microsoft compliance offerings documentation.