Microsoft SC-900 study guide
Microsoft SC-900 · Work through your exam, one topic at a time.
SC-900 is Microsoft's entry-level certification for security, compliance, and identity fundamentals. Microsoft describes it as demonstrating foundational knowledge of security, compliance, and identity concepts and related cloud-based Microsoft solutions, and targets anyone looking to familiarize themselves with those fundamentals across cloud-based and related Microsoft services. The audience is deliberately broad: business stakeholders, new or existing IT professionals, and students. Microsoft recommends familiarity with Azure and Microsoft 365 and an interest in how security, compliance, and identity solutions span both to deliver a holistic, end-to-end approach. Topics on this exam: Describe the concepts of security, compliance, and identity, Describe the capabilities of Microsoft Entra, Describe the capabilities of Microsoft security solutions, and Describe the capabilities of Microsoft compliance solutions. The Microsoft SC-900 study guide has 4 sections and about 1,344 words.
01Security, Compliance, and Identity Concepts
Start with the shared responsibility model . Microsoft is always responsible for physical security, hosts, and the network; the customer is always responsible for data, accounts, and devices. Responsibilities in between (operating system, applications, identity) shift with the service model: IaaS gives the customer the most, SaaS the least. Exam traps usually ask who owns patching or identity configuration under a given model.
375 words, about 2 min02Microsoft Entra Capabilities
Microsoft Entra ID is the cloud identity provider behind Microsoft 365 and Azure. Distinguish Entra ID (cloud directory) from AD DS (on-premises) and from Entra Domain Services (managed domain services in the cloud). A frequent trap: Entra ID does not use traditional OUs or Group Policy. Free, P1, and P2 differ mainly in conditional access and identity protection features.
340 words, about 2 min03Microsoft Security Solutions
Microsoft Defender is a family, not one product. Defender for Cloud is multicloud posture management and workload protection (CSPM and CWP). Defender XDR unifies signals across identities, endpoints, email, and cloud apps. Individual workloads: Defender for Endpoint , Defender for Identity , Defender for Office 365 , Defender for Cloud Apps , and Defender for IoT .
310 words, about 2 min04Microsoft Compliance Solutions
Microsoft Purview covers data governance, risk, and compliance. Core pieces: Data Map (catalog and classification), Information Protection (sensitivity labels, encryption), Data Loss Prevention (DLP) , Insider Risk Management , eDiscovery , Audit , Compliance Manager , and Communication Compliance . Sensitivity labels persist with the content and can encrypt, apply watermarks, and restrict sharing. Retention labels govern how long content is kept and what happens after.
319 words, about 2 min