Study guide · Summary
SC-900 Security, Compliance, and Identity Fundamentals
The essentials of every exam domain, with the services the exam asks about most. Tap a service to see its details.
Fundamentals~50 min read4 domains
What the exam covers
D1 · 10–15% of the exam
Security, compliance and identity concepts
Shared responsibility model
In the cloud, security is split between Microsoft and the customer. The more managed the service, the more responsibility Microsoft takes on. But some things are never handed off.
| Responsibility | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Data, configurations, identities and users | Customer | Customer | Customer | Customer |
| Client devices | Customer | Customer | Customer | Shared |
| Applications | Customer | Customer | Shared | Shared |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts, network and datacenter | Customer | Microsoft | Microsoft | Microsoft |
In every model, the customer always keeps their data, identities and access, endpoints and tenant configuration. In the cloud, the physical datacenter is never the customer's responsibility.
For AI solutions, Microsoft adds an AI shared responsibility model with 3 layers: the AI platform (infrastructure, model and safety filters), the AI application (configuration, connectors, plugins) and AI usage (which data and prompts people provide). The customer always owns their data, access, configuration and risks like prompt injection.
Defense in depth
Several layers of security so that if one fails, the next one stops the attacker. No layer depends on another.
Physical
Controlled access to the datacenter
Identity and access
MFA, RBAC and Conditional Access
Perimeter
DDoS protection and firewalls
Network
Segmentation and traffic rules
Compute
Protected, patched VMs and ports
Application
Secure code, no exposed secrets
Data
Encryption and control over who accesses it
Every layer aims to protect the CIA triad: confidentiality, integrity and availability.
Zero Trust model
Zero Trust assumes there is no trusted network: every request is verified as if it came from an open network. Its motto is "never trust, always verify".
Verify explicitly
Authenticate and authorize using every available signal: identity, location, device, service and risk.
Use least privilege access
Grant only the access needed, only for as long as needed (just-in-time and just-enough-access).
Assume breach
Segment access, encrypt end to end and use analytics to detect threats and limit the blast radius.
Zero Trust is applied across 7 pillars: identities, devices, applications, data, infrastructure and networks, plus a seventh, visibility, automation and orchestration, which brings together the signals from the other six (that's where SIEM and SOAR fit).
Encryption and hashing
| Concept | How it works | Typical use |
|---|---|---|
| Symmetric encryption | The same key encrypts and decrypts | Encrypting large volumes of data |
| Asymmetric encryption | Key pair: public encrypts, private decrypts | TLS, digital signatures, key exchange |
| Encryption at rest | Data encrypted while stored | Disks, databases, Storage |
| Encryption in transit | Data encrypted while it travels over the network | HTTPS / TLS |
| Encryption in use | Data protected while it is processed in memory | Confidential computing (secure enclaves) |
| Digital signature | Signed with the private key, verified with the public key | Proving authenticity and integrity |
| Hashing | One-way function: the same text always gives the same hash and it can't be reversed | Storing salted passwords, verifying integrity |
Hashing isn't encryption: there's no key and it can't be reversed. If the question says "the original value can't be recovered", it's hashing.
Governance, risk and compliance (GRC)
Governance
Rules, practices and processes that direct and control the organization.
Risk
Identify, assess and respond to threats that affect business goals.
Compliance
Follow the laws, regulations and standards that apply (GDPR, ISO, etc.).
| Term | Meaning |
|---|---|
| Data residency | Where data is physically stored and which laws apply there |
| Data sovereignty | Data is subject to the laws of the country where it is collected or stored |
| Data privacy | Being transparent about which personal data is collected and how it is used |
Identity concepts
People now work from anywhere, on any device, so the network perimeter is no longer enough: identity is the primary security perimeter.
| Concept | Question it answers | Example |
|---|---|---|
| Authentication (AuthN) | Who are you? | Password + Authenticator code |
| Authorization (AuthZ) | What can you do? | Reader role on a resource group |
| Identity provider (IdP) | Who issues and validates the identity | Microsoft Entra ID, Google, Facebook |
| Directory service | Where users and objects are stored | Active Directory Domain Services (on-premises) |
| Federation | Trust between several providers | Signing in to an app with your work account |
The 4 pillars of an identity infrastructure: administration, authentication, authorization and auditing. Federation doesn't require two-way trust: A can trust B without B trusting A.
D2 · 25–30% of the exam
Microsoft Entra capabilities
Microsoft Entra ID and identity types
Tap a service to see its details.
| Identity type | What it is |
|---|---|
| Users (members) | Employees of the organization |
| Guests (B2B collaboration) | External partners who authenticate with their own organization and are added as guests |
| Workload identities | Applications, service principals and managed identities |
| AI agents (Entra Agent ID) | Identities created from a blueprint, with an accountable human sponsor |
| Devices | Registered, Entra joined or hybrid Entra joined |
| Groups | Security or Microsoft 365; with assigned or dynamic membership |
| Microsoft Entra External ID | What it's for |
|---|---|
| B2B collaboration | Invite partners into your workforce tenant |
| B2B direct connect | Mutual trust between two Entra organizations (Teams shared channels); users aren't added as guests |
| CIAM (external tenant) | Customer sign-up and sign-in for your apps, including social accounts |
Authentication: methods, MFA and passwords
Tap a service to see its details.
| Method | Phishing-resistant | Note |
|---|---|---|
| Passkey (FIDO2) | Yes | Hardware key or passkey on the phone |
| Windows Hello for Business | Yes | Biometrics or PIN bound to the device |
| Certificate-based authentication | Yes | X.509 certificates or smart cards |
| Passkey in Microsoft Authenticator | Yes | The passkey lives in the phone app |
| Microsoft Authenticator (push) | No | Number matching stops MFA fatigue |
| SMS / voice call | No | Open to phishing |
Password protection
Global and custom banned password lists
Smart lockout
Locks out attackers guessing passwords, not the real user
SSPR
Self-service password reset: users reset their own password without calling support
Security defaults
Free: require MFA registration and block legacy authentication
Access management: Conditional Access and roles
Tap a service to see its details.
Signals
User or group, location, device, application, real-time risk
Decision
Block, grant with controls (MFA, compliant device) or grant
Enforcement
The policy is applied and the user gets (or doesn't get) access
| Aspect | Microsoft Entra roles | Azure RBAC roles |
|---|---|---|
| Control | Directory objects: users, groups, apps | Azure resources: VMs, Storage, networks |
| Scope | Tenant or administrative unit | Management group, subscription, resource group or resource |
| Examples | Global Administrator, User Administrator | Owner, Contributor, Reader |
Built-in roles can't be changed. If none fits, you create a custom role (requires Entra ID P1) with only the permissions needed: least privilege.
Global Secure Access is Microsoft's Security Service Edge (SSE) solution: it brings Conditional Access to network traffic. Entra Internet Access is a Secure Web Gateway (web filtering, TLS inspection) and Entra Private Access replaces the VPN with per-app access (ZTNA).
Identity protection and governance
Tap a service to see its details.
| License | What it enables (examples) |
|---|---|
| Entra ID Free | Users and groups, SSO, security defaults |
| Entra ID P1 | Conditional Access, custom roles, dynamic groups |
| Entra ID P2 | ID Protection, PIM, basic access reviews and entitlement management |
| Entra ID Governance | All P2 governance features, plus lifecycle workflows and advanced capabilities |
Access reviews check whether access is still needed. PIM controls when a privileged role is used. ID Protection detects whether an account looks compromised. Three different answers to three different questions.
D3 · 35–40% of the exam
Microsoft security solutions
Core infrastructure security in Azure
Tap a service to see its details.
Everything starts with segmentation with virtual networks: each VNet is isolated by default, and splitting it into subnets limits how far an attacker can move.
| Scenario | Service |
|---|---|
| Block port 3389 from the internet to a subnet | NSG |
| Protect a website from SQL injection | WAF |
| One central point that filters outbound traffic by FQDN | Azure Firewall |
| Manage VMs without exposing them to the internet | Azure Bastion |
| Move the database password out of the code | Azure Key Vault |
| Massive traffic tries to take down a public app | DDoS Protection |
Security management with Defender for Cloud
Tap a service to see its details.
| Pillar | What it does | Example |
|---|---|---|
| CSPM (posture) | Finds weak configurations and gives recommendations | Storage with public access, unpatched VM |
| CWP (workloads) | Detects active threats and raises alerts | Defender for Servers, Storage, SQL, Containers |
| DevSecOps | Security for code and pipelines | Scanning repositories and infrastructure as code |
Policy
An Azure Policy rule evaluates a setting (e.g. "Storage must use HTTPS")
Standard
A set of policies, like the Microsoft cloud security benchmark (applied by default)
Recommendation
Anything that doesn't comply shows up with steps to fix it
Secure score
Every fixed recommendation raises the posture score
Foundational CSPM is free (policies, recommendations, secure score and multicloud coverage). Defender CSPM adds attack paths and regulatory compliance; the workload protection plans add threat alerts.
Microsoft Sentinel: SIEM and SOAR
Tap a service to see its details.
Collect
Data connectors for Microsoft and third parties
Detect
Analytics rules and AI that create incidents
Investigate
Incident graph and hunting with KQL
Respond
Playbooks with Azure Logic Apps
SIEM (Security Information and Event Management) collects and correlates data to detect threats. SOAR (Security Orchestration, Automation and Response) automates the response. Sentinel is both.
Threat protection with Defender XDR
Tap a service to see its details.
| Product | Protects | Key capability |
|---|---|---|
| Defender for Endpoint | Devices (PCs, servers, mobile) | EDR and attack surface reduction |
| Defender for Office 365 | Email, Teams, SharePoint and OneDrive | Safe Links and Safe Attachments |
| Defender for Identity | On-premises Active Directory | Sensors on domain controllers |
| Defender for Cloud Apps | SaaS apps (CASB) | Discover shadow IT and control sessions |
| Defender Vulnerability Management | Software and configuration inventory | Prioritize vulnerabilities by risk |
| Microsoft Threat Intelligence | Context about attackers | Intel explorer and threat analytics reports in the Defender portal |
| Microsoft Security Exposure Management | The whole attack surface | Attack surface map, attack paths and critical assets |
The Microsoft Defender portal brings it all into one place: XDR incidents and alerts, Sentinel, advanced hunting, Threat Intelligence, Exposure Management and Microsoft Secure Score. Microsoft Security Copilot is built in to summarize incidents and write queries in natural language.
Defender for Cloud (posture and workloads in Azure, AWS and GCP) and Defender XDR (endpoints, identity, email and SaaS) are different products with similar names. Both show up in the Defender portal today, but each protects different surfaces.
D4 · 20–25% of the exam
Microsoft compliance solutions
Service Trust Portal and privacy principles
The Service Trust Portal publishes independent audit reports (ISO, SOC, GDPR, FedRAMP, PCI), whitepapers and documentation on how Microsoft protects data in its cloud services. Some documents require signing in with an organizational account and accepting a non-disclosure agreement.
Microsoft's privacy commitment is organized into 4 areas:
You control your data
It's yours: view, change or delete it. It isn't used for advertising
Know where your data is
You choose the location, with data residency options
Data secured at rest and in transit
Encryption up to AES-256, TLS and IPsec
Microsoft defends your data
Government requests are redirected to you and challenged in court
Current official SC-900 material presents privacy in 4 areas: data control, data location, data security and data defense. Older guides list 6 principles (control, transparency, security, strong legal protections, no content-based targeting and benefits to you).
Compliance management with Microsoft Purview
Tap a service to see its details.
| Compliance Manager element | What it is |
|---|---|
| Controls | Requirements of a regulation; implemented by Microsoft, the customer or both (shared) |
| Assessments | Groups of controls from a regulation (e.g. ISO 27001) |
| Regulations | Over 360 ready-made templates to create assessments, or custom templates |
| Improvement actions | Concrete steps to meet a control, with instructions |
| Action type | Points |
|---|---|
| Preventive mandatory | 27 |
| Preventive discretionary | 9 |
| Detective or corrective mandatory | 3 |
| Detective or corrective discretionary | 1 |
Compliance score measures your progress on improvement actions. A high score doesn't certify that the organization complies with a regulation.
Information protection and data lifecycle
Tap a service to see its details.
| Capability | What it's for |
|---|---|
| Sensitive information types | Detect patterns like credit card or passport numbers |
| Trainable classifiers | Recognize content by its context (contracts, résumés) with AI |
| Data explorer (formerly Content explorer) | See which items have labels or sensitive data, and where they are |
| Activity explorer | See what was done with that data: labeled, copied, deleted |
| Data Loss Prevention (DLP) | Stop sensitive data from being shared inappropriately, in Exchange, SharePoint, OneDrive, Teams, devices and more |
The official skills outline still says Content explorer, but in the Purview portal it's now called Data explorer. DLP policies are tested in simulation mode before they're enforced.
| Element | Applies to | What it's for |
|---|---|---|
| Retention policy | Whole locations (Exchange, SharePoint) | Keep and/or delete all content |
| Retention label | Individual items | Retention per document or email |
| Retention label policy | Locations and users | Publish or auto-apply the labels |
| Records management | Content declared as a record | Immutable records with disposition review |
Principles of retention: retention wins over deletion, and when there are several retention periods, the longest one wins.
Insider risk, eDiscovery and audit
| Solution | What it solves | Key detail |
|---|---|---|
| Insider Risk Management | Risks from insiders: data theft or leaks | Uses policy templates; users are pseudonymized by default |
| eDiscovery | Find and preserve content for legal cases | Cases, searches, holds and export; premium features (review sets, analytics) require E5 |
| Audit (Standard) | Log user and admin activities | On by default, 180-day retention |
| Audit (Premium) | Deeper forensic investigations | 1 year by default for Entra, Exchange, OneDrive and SharePoint; up to 10 years with an add-on |
If the scenario is "a departing employee downloads thousands of files", the answer is Insider Risk Management. If it's "a lawyer needs every email in a case", it's eDiscovery.
Tips for exam day
- Sort every question by product family: Entra = identity, Defender = threats, Sentinel = SIEM/SOAR, Purview = compliance and data. Placing the family rules out half the options.
- Zero Trust has 3 principles: verify explicitly, use least privilege access and assume breach. "Never trust, always verify".
- In shared responsibility, data, devices and accounts always belong to the customer, whether it's IaaS, PaaS or SaaS.
- Licensing: Conditional Access requires P1. ID Protection and PIM require P2. Security defaults are free.
- PIM = just-in-time. If the question mentions activating a role for a limited time, with approval or justification, the answer is PIM.
- NSGs filter IPs and ports (layer 4). WAF protects web apps from SQL injection and XSS (layer 7). Azure Firewall protects the whole network. Bastion = RDP/SSH without a public IP.
- Defender for Cloud: CSPM improves posture (secure score, recommendations). CWP protects workloads with threat alerts.
- SIEM collects and detects; SOAR automates the response. Sentinel does both, and its playbooks are built with Logic Apps.
- Sensitivity label = classify and protect. Retention label = keep or delete. They are different concepts the exam mixes on purpose.
- Compliance score measures your progress on improvement actions. It doesn't mean the organization complies with a standard.
Was this guide helpful?