MCS study guide
MCS · Work through your exam, one topic at a time.
SC-900, officially Microsoft Certified: Security, Compliance, and Identity Fundamentals, is an entry-level credential that confirms you can describe how Microsoft's cloud security stack fits together rather than configure it. It suits people moving into security, compliance, or identity work; sales and pre-sales staff who need credible vocabulary; IT generalists whose duties now touch Microsoft Entra, Defender, or Purview; and students building a first certification path toward the associate-level security exams. The exam is organized into four areas: foundational concepts of security, compliance, and identity; Microsoft Entra capabilities such as authentication, conditional access, and identity governance; Microsoft security solutions spanning Defender products, Secure Score, and Sentinel; and compliance solutions including Purview, data classification, retention, and audit. Expect a multiple-choice exam with some multiple-response, drag-and-drop, hotspot, and case-study style items - Microsoft documents the exact format and item types on its exam page. The MCS study guide has 4 sections and about 1,637 words.
01Security, Compliance, and Identity Concepts
The first domain tests whether you can talk about security, compliance, and identity as connected concepts rather than product names. Expect definition and scenario questions that ask you to choose the right principle, not to configure a portal.
430 words, about 2 min02Microsoft Entra Capabilities
The second domain covers Microsoft Entra, the cloud identity provider family formerly called Azure AD. Questions focus on what each feature does, which licence it needs, and when to choose Entra ID over traditional Active Directory.
415 words, about 2 min03Microsoft Security Solutions
The security solutions domain asks you to place each Microsoft product in the right layer and pick the correct one for a scenario: posture management, threat protection, SIEM/SOAR, or network controls. Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWP) for Azure, AWS, GCP, and on-premises.
405 words, about 2 min04Microsoft Compliance Solutions
The compliance domain tests Microsoft Purview, the family covering data governance, data protection, risk, and compliance. Expect scenario questions on classifying and labeling data, retaining or deleting it, and demonstrating compliance.
387 words, about 2 min