SC-900 vs AZ-900: differences and which certification to take first
Both are Microsoft fundamentals, but they test different things. We compare the outline, difficulty, and who each one is for, and when it makes sense to take both.
The AZ-900 and the SC-900 are two of Microsoft's most popular fundamentals certifications, and it's common to wonder which one to take first. Both are entry level, cost the same, and don't expire, but the focus is different: the AZ-900 covers the Azure cloud in general, while the SC-900 focuses on security, compliance, and identity across Azure and Microsoft 365.
Quick comparison
| AZ-900 | SC-900 | |
|---|---|---|
| Name | Azure Fundamentals | Security, Compliance, and Identity Fundamentals |
| Focus | Cloud concepts and Azure services | Microsoft security, identity, and compliance |
| Duration | 45 minutes | 45 minutes |
| Passing score | 700/1000 | 700/1000 |
| Reference cost | USD 99 | USD 99 |
| Validity | Does not expire | Does not expire |
| Key products | VMs, App Service, Storage, networking, Azure Policy, costs | Entra ID, Defender XDR, Sentinel, Defender for Cloud, Purview |
What each one tests
The AZ-900 is broad and conceptual: IaaS, PaaS, and SaaS, public, private, and hybrid cloud, regions and availability zones, compute, storage, and networking services, governance with Azure Policy, and cost management. Security shows up, but only at an introductory level.
The SC-900 goes deep into exactly that part. It asks about Zero Trust, Conditional Access, MFA, and PIM in Microsoft Entra; about Microsoft Sentinel and Defender XDR for security; and about sensitivity labels, DLP, and Compliance Manager for compliance. A big part of the SC-900 also covers Microsoft 365, not just Azure.
Where they overlap
The two exams share some topics, so studying one helps with the other:
- ▸The shared responsibility model
- ▸Zero Trust and defense in depth
- ▸Microsoft Entra ID, MFA, and Conditional Access at a basic level
- ▸Defender for Cloud and Key Vault
The difference is depth. Where the AZ-900 asks "which service manages identities?", the SC-900 asks "which license do you need to require MFA only for risky sign-ins?".
Which one is harder?
Neither requires hands-on experience. For someone new to tech, the AZ-900 is usually easier because its concepts are more general. The SC-900 has more products with similar names (Defender for Cloud, Defender for Cloud Apps, Defender for Identity...), and that's where points get lost.
If you already work with Microsoft 365 or in a security area, the SC-900 may feel more natural than the AZ-900.
Which one should you take first?
- ▸Start with the AZ-900 if you're new to the cloud or your goal is an Azure path (administration, architecture, or development). It gives you the foundation every other Azure exam takes for granted.
- ▸Start with the SC-900 if your goal is security, compliance, or identity, or if you work more with Microsoft 365 than with Azure.
- ▸Take them together if you're aiming for a cloud security role: the AZ-900 gives you the Azure context and the SC-900 the foundation for SC-200, SC-300, or SC-500.
How to prepare with Brains4Cloud
- ▸AZ-900 guide and AZ-900 cheat sheet for the Azure foundation.
- ▸SC-900 cheat sheet with Entra, Defender, Sentinel, and Purview comparisons.
- ▸Glossary with the terms from both exams explained.
- ▸Practice exams for both certifications with original questions and an explanation for every option. Create your free account and try both.
Frequently asked questions
Is the AZ-900 a prerequisite for the SC-900? No. Neither fundamentals certification has prerequisites.
Do they help you get a job? On their own they are entry-level certifications: they show you know the concepts, not hands-on experience. Their biggest value is organizing your study and serving as a foundation for associate-level certifications.
How long do I need for each one? With steady study, two to four weeks each if you're starting from scratch, and less if you already work with Azure or Microsoft 365.
Put what you learned to the test
Original practice exams with detailed explanations. No brain dumps.