Free SC-900 practice exam: Security, Compliance, and Identity Fundamentals exam guide (2026)
Format, the official domains in effect from October 2026, and the recent Entra, Defender, and Purview changes you need to know to pass the SC-900.
The SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is the entry point to Microsoft's security world. It doesn't require prior experience, but it does expect you to tell clearly what each product does: Microsoft Entra for identity, Defender and Sentinel for security, and Purview for compliance. Most questions are scenarios like "a company needs X — which solution should it use?".
Watch out for old material: the English version of the exam is updated on October 21, 2026, and several names and services in the outline have changed in recent months.
What you need to know about the exam
| Questions | ~40-60 |
| Duration | 45 minutes |
| Reference cost | USD 99 (varies by country) |
| Passing score | 700 out of 1000 (scaled) |
| Languages | Offered in many languages, including Spanish |
| Validity | Does not expire |
| Prerequisites | None; basic familiarity with Azure and Microsoft 365 helps |
Official domains and their weight
| Domain | Weight | Main content |
|---|---|---|
| Security, compliance, and identity concepts | 10-15% | Shared responsibility, defense in depth, Zero Trust, encryption and hashing, GRC, authentication and federation |
| Capabilities of Microsoft Entra | 25-30% | Identity types (including workload identities), hybrid identity, MFA, Conditional Access, roles, ID Governance, PIM, and ID Protection |
| Microsoft security solutions | 35-40% | Azure network security, Key Vault, Defender for Cloud, Microsoft Sentinel, and Defender XDR |
| Microsoft compliance solutions | 20-25% | Service Trust Portal, privacy, Purview, Compliance Manager, labels, DLP, retention, insider risk, eDiscovery, and audit |
The security domain is more than a third of the exam, and it's where products with similar names get mixed up the most. It deserves the biggest share of your study time.
Domain 1: concepts (10-15%)
It's the shortest, but its concepts are used throughout the exam. You need to master the three Zero Trust principles (verify explicitly, least privilege, and assume breach), the shared responsibility model, defense in depth, and the difference between encryption and hashing. It also asks about authentication vs. authorization and identity federation.
Domain 2: Microsoft Entra (25-30%)
It revolves around Microsoft Entra ID. The most-asked topics:
- ▸Conditional Access and multifactor authentication
- ▸Phishing-resistant methods, such as passkeys (FIDO2)
- ▸Workload identities: apps, service principals, and managed identities
- ▸Privileged Identity Management, ID Protection, and ID Governance
Domain 3: security solutions (35-40%)
This covers Azure infrastructure security (NSGs, Azure Firewall, WAF, DDoS Protection, Azure Bastion, and Key Vault), Defender for Cloud and its CSPM, Microsoft Sentinel as a SIEM and SOAR, and the Microsoft Defender XDR suite.
Domain 4: compliance solutions (20-25%)
Everything lives in Microsoft Purview: sensitivity labels, DLP, retention policies and labels, Compliance Manager, insider risk management, and eDiscovery. Outside Purview, the Service Trust Portal is where Microsoft publishes its audit reports.
Recent changes that can cost you points
If you're studying with notes from 2024 or 2025, review these changes:
- ▸Azure AD is now Microsoft Entra ID. The old name no longer appears in questions.
- ▸Passkeys by default. Since September 2026 they are the default method in Entra ID, and Microsoft retires its own SMS and voice delivery starting February 2027.
- ▸Built-in threat intelligence. The standalone Defender Threat Intelligence portal retired in August 2026; its features live in the Microsoft Defender portal and Sentinel.
- ▸Sentinel in the Defender portal. That's its primary experience, and the Azure portal experience retires in March 2027.
- ▸Unified eDiscovery. It's no longer "eDiscovery (Standard)" and "(Premium)" as separate products, but premium features based on licensing.
Common mistakes that make people fail
- ▸Confusing Defender for Identity with Entra ID Protection. The first protects on-premises AD DS; the second evaluates the risk of cloud identities.
- ▸Mixing up CSPM and SIEM. Defender for Cloud improves security posture; Sentinel collects and analyzes events to detect and investigate incidents.
- ▸Thinking sensitivity labels and retention labels do the same thing. One protects content (encryption, markings); the other defines how long it's kept.
- ▸Forgetting about licenses. Conditional Access requires Entra ID P1; PIM and ID Protection require P2.
How to prepare with Brains4Cloud
- ▸SC-900 cheat sheet: Defender comparisons, Entra licenses, network controls, and Purview labels on a single page.
- ▸Security glossary: more than 40 SC-900 terms explained, with the context in which they appear on the exam.
- ▸Practice exam: 290 original questions aligned with the current outline, including single choice, multiple choice, fill-in, and matching, with an explanation for every option. Create your free account and take your first mock exam.
Frequently asked questions
Is the SC-900 hard? It's a fundamentals exam, so it doesn't require hands-on experience. The difficulty is the number of products and the fact that many have similar names. With two or three weeks of steady study and scenario practice, it's very approachable.
What languages is the SC-900 offered in? English, Spanish, Japanese, Chinese, Korean, French, German, Portuguese (Brazil), Italian, and more. Outline updates reach the English version first, and localized versions about eight weeks later.
Does the SC-900 expire? No. Microsoft fundamentals certifications don't expire or require renewal.
Which certification comes after the SC-900? It depends on your role: SC-200 (security operations), SC-300 (identity), or SC-500, which replaced AZ-500 as the cloud security engineer certification.
Put what you learned to the test
Original practice exams with detailed explanations. No brain dumps.