MCS study materials
MCS study resources

MCS study guide

MCS · Work through your exam, one topic at a time.

SC-900, officially Microsoft Certified: Security, Compliance, and Identity Fundamentals, is an entry-level credential that confirms you can describe how Microsoft's cloud security stack fits together rather than configure it. It suits people moving into security, compliance, or identity work; sales and pre-sales staff who need credible vocabulary; IT generalists whose duties now touch Microsoft Entra, Defender, or Purview; and students building a first certification path toward the associate-level security exams. The exam is organized into four areas: foundational concepts of security, compliance, and identity; Microsoft Entra capabilities such as authentication, conditional access, and identity governance; Microsoft security solutions spanning Defender products, Secure Score, and Sentinel; and compliance solutions including Purview, data classification, retention, and audit. Expect a multiple-choice exam with some multiple-response, drag-and-drop, hotspot, and case-study style items - Microsoft documents the exact format and item types on its exam page. The MCS study guide has 4 sections and about 1,637 words.

01

Security, Compliance, and Identity Concepts

The first domain tests whether you can talk about security, compliance, and identity as connected concepts rather than product names. Expect definition and scenario questions that ask you to choose the right principle, not to configure a portal.

430 words, about 2 min
02

Microsoft Entra Capabilities

The second domain covers Microsoft Entra, the cloud identity provider family formerly called Azure AD. Questions focus on what each feature does, which licence it needs, and when to choose Entra ID over traditional Active Directory.

415 words, about 2 min
03

Microsoft Security Solutions

The security solutions domain asks you to place each Microsoft product in the right layer and pick the correct one for a scenario: posture management, threat protection, SIEM/SOAR, or network controls. Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWP) for Azure, AWS, GCP, and on-premises.

405 words, about 2 min
04

Microsoft Compliance Solutions

The compliance domain tests Microsoft Purview, the family covering data governance, data protection, risk, and compliance. Expect scenario questions on classifying and labeling data, retaining or deleting it, and demonstrating compliance.

387 words, about 2 min