Microsoft SC-900 study plan

Define the shared responsibility model and explain how it shifts across IaaS, PaaS, and SaaS

Distinguish the three cloud service models and identify which security duties remain with the customer in each

Describe defense in depth and order its layers from physical security to data

Explain Zero Trust principles and contrast them with perimeter-based security

Describe how Microsoft Defender for Cloud calculates secure score and generates recommendations

Differentiate the Defender workload protection plans available across servers, storage, databases, containers, and apps

Explain how Microsoft Sentinel ingests data through connectors and uses analytics rules to create incidents

Distinguish automation rules, playbooks, and workbooks within Sentinel

Compare Microsoft Defender XDR and Sentinel in terms of scope and use case

Describe Microsoft Entra ID and contrast it with on-premises Active Directory Domain Services

Differentiate Entra ID editions (Free, P1, P2) by the features each unlocks

Explain how single sign-on, multifactor authentication, and password protection reduce credential risk

Describe Conditional Access policy components: assignments, conditions, and access controls

Identify when to use Entra ID Protection risk detections versus Conditional Access alone

Explain how hybrid identity works through password hash synchronization, pass-through authentication, and federation

Describe the purpose and mechanics of self-service password reset and how it is enabled for users

Differentiate Entra ID security groups, Microsoft 365 groups, and administrative units

Explain Privileged Identity Management concepts: eligible versus active assignments, approvals, and access reviews

Describe how entitlement management governs access packages and external collaboration

Define core security concepts including threat, vulnerability, risk, and attack surface

Differentiate authentication, authorization, and accounting in identity scenarios

Describe encryption approaches: symmetric versus asymmetric, at rest versus in transit

Explain the role of governance, risk, and compliance activities inside a security program

Describe how Microsoft Purview Insider Risk Management and Microsoft Defender for Cloud Apps address data and app risks

Describe the data classification taxonomy in Microsoft Purview from public to highly confidential

Explain how sensitivity labels apply protection across files, emails, and containers

Differentiate data loss prevention policies from retention policies and retention labels

Describe how Microsoft Purview Data Map and the unified catalog support data discovery

Explain the purpose of insider risk management and communication compliance

Describe how Microsoft Purview eDiscovery handles the identification, preservation, and review of content

Explain audit log retention and how Microsoft Purview Audit supports investigations

Differentiate compliance score from Defender secure score in purpose and audience

Describe how Microsoft Priva addresses privacy risk management and subject rights requests

Explain how service trust portal and compliance manager artifacts support regulatory assessments

Reconstruct the domain weighting of the exam and allocate remaining study time proportionally

Complete a timed full-length practice assessment and categorize every missed item by domain

Re-teach the five weakest objectives aloud in plain language without notes

Review identity and compliance feature-to-edition mappings for accuracy