SC-900 Cheat Sheet
Security, Compliance, and Identity Fundamentals — Quick reference for the exam
CLI Commands
24Connect-MgGraph -Scopes "User.Read.All","Policy.Read.All","AuditLog.Read.All"TOPConnects to Microsoft Graph with delegated permissions. Replaces the AzureAD and MSOnline modules, which are retired
Get-MgUser -All -Property DisplayName,UserType | Select DisplayName,UserTypeTOPLists users: UserType tells members (Member) apart from B2B guests (Guest)
Get-MgIdentityConditionalAccessPolicy | Select DisplayName,StateTOPLists Conditional Access policies. State: enabled, disabled, or enabledForReportingButNotEnforced (report-only)
Get-MgAuditLogSignIn -Top 20Latest sign-ins with their result and location. Reading logs through Graph requires Entra ID P1
Get-MgServicePrincipal -Filter "servicePrincipalType eq 'ManagedIdentity'"TOPLists managed identities, one type of workload identity (along with apps and service principals)
az ad sp list --display-name "MyApp" --query "[].{name:displayName,id:appId}"Finds an application's service principal from the Azure CLI
Comparisons
7| Principle | What it means | Microsoft example |
|---|---|---|
| Verify explicitly | Authenticate and authorize with every signal: identity, location, device, risk | Conditional Access + MFA |
| Least privilege | Grant only the access needed, for only as long as needed (JIT/JEA) | PIM, custom roles, access reviews |
| Assume breach | Segment, encrypt end to end, and minimize the blast radius | NSG, Azure Firewall, Defender XDR, Sentinel |
Quick Reference
31D1 · Security, compliance, and identity concepts
Data, devices, and accounts are always the customer's. Datacenter, network, and physical hosts are always Microsoft's
Layers: physical, identity, perimeter, network, compute, application, and data
Confidentiality, integrity, and availability
Hashing = one-way (salted passwords). Encryption = reversible with the key
Symmetric = one shared key. Asymmetric = public/private key pair
Authentication = who you are. Authorization = what you can do
Trust between identity providers; it doesn't have to be bidirectional
Governance (rules), risk (threats), and compliance (laws and standards)
D2 · Microsoft Entra
Applications, service principals, and managed identities
System-assigned (tied to one resource) vs. user-assigned (standalone, shareable)
Entra Connect Sync or Cloud Sync. Methods: PHS, PTA, or federation
Free: requires MFA registration and blocks legacy authentication. Can't coexist with Conditional Access
Global and custom banned password lists + smart lockout
Eligible roles activated just in time, with approval and justification (P2)
User risk (compromised account) vs. sign-in risk (suspicious sign-in)
Identities for AI agents, each with an assigned human owner
D3 · Security solutions
CNAPP: CSPM + CWP + DevSecOps for Azure, AWS, GCP, and hybrid
Free: recommendations, secure score, and inventory. Defender CSPM adds attack paths
Microsoft cloud security benchmark: the standard Defender for Cloud applies by default
SIEM collects and analyzes. SOAR automates response (Logic Apps playbooks)
SIEM + SOAR. Primary experience in the Defender portal; leaves the Azure portal on Mar 31, 2027
Defender XDR contains in-progress attacks (disables users, isolates devices) automatically
Built into the Defender portal and Sentinel. The standalone MDTI portal retired on Aug 1, 2026
D4 · Compliance solutions
Microsoft's SOC reports, ISO certifications, and compliance documents
Control, transparency, security, strong legal protections, no content-based targeting, benefits to you
Progress on improvement actions. Mandatory preventive ones add more points. It doesn't certify compliance
Sensitive information types, trainable classifiers, and Exact Data Match
Content = what sensitive data exists and where. Activity = what was done with it
Retention wins over deletion, and the longest retention period wins
Internal risk (data theft when leaving). User names pseudonymized by default
Standard: on, 180 days. Premium: 1 year by default, up to 10 years with an add-on
Ready to practice?
Put what you learned to the test with original SC-900 exam questions.
Start SC-900 mock examUnlimited mock exams with the Pro plan