Microsoft Certified: Security, Compliance, and Identity Fundamentals
SC-900 establishes the vocabulary of Microsoft's security, compliance and identity products: what the concepts mean, which product does what, and how the pieces relate.
Three quarters of an hour, nothing gating entry, and no expiry at all.
Exam facts
- Exam code
- SC-900
- Level
- Foundational
- Field
- Cybersecurity
- Access
- Paid
- Assessment
- Proctored exam
- Duration
- 45 minutes
- Questions
- about 40 to 60 (Microsoft does not publish a fixed number)
- Passing score
- 700 of 1,000 (scaled)
- Languages
- English, German, French, Spanish, Italian, Portuguese, Japanese, Korean, Chinese, Arabic, Indonesian, RussianMicrosoft lists thirteen exam editions; Simplified and Traditional Chinese count as one language, which makes twelve languages.
- Price
- 99 USD as of 8 September 2026
- Validity
- never expires
- Exam delivery
- Pearson VUE (test centre or online proctored); students through Certiport
Prerequisites: None required. Microsoft recommends familiarity with Microsoft Azure and Microsoft 365.
Source: exam page at Microsoft · Price: Priced by the country where the exam is proctored: 99 USD in the United States, 76 EUR in Germany and Austria (Microsoft Learn country selector, read 2026-09-08)
How to prepare
1. The vendor's free learning path
Microsoft publishes the exam objectives and a learning path free of charge: the authoritative source for scope and weighting. Open the learning path (opens in a new tab)
2. A practice test in the exam format
MeasureUp sells a practice test for SC-900 with questions in the exam format, an explanation for every answer and a timed mode; the price shows in your currency on the shop page. Affiliate link.
Practice test for SC-900 at MeasureUp (opens in a new tab)Book the exam
Delivered by Pearson VUE (test centre or online proctored); students through Certiport. Schedule with Microsoft (opens in a new tab)
No preparation course for the current version of this exam is listed yet. The vendor's learning path above is the reliable start.
Affiliate disclosure: the practice-test link above is an affiliate link; a purchase through it may earn Getting Digital a commission at no extra cost to the buyer. The vendor's learning path and booking links carry no commission.
Its best readers are not security people. Compliance officers, sales engineers, procurement staff and project managers all sit in conversations where Entra, Purview and Defender are mentioned as if everyone present knows the boundaries between them, and this exam draws those boundaries in an afternoon. For that audience it is efficient. For anyone whose job involves configuring these products, it describes ground you already stand on.
How to prepare
Preparation is Microsoft's own learning path, with a mock paper for the question style.
The zero-trust question is the one to understand properly
Most of the conceptual marks cluster around a small number of ideas: verify explicitly, assume breach, and least privilege. Candidates who can apply those three to a described situation, rather than recite them, tend to find the rest of the paper follows. It is also the part that survives outside Microsoft's product names.
What forty-five minutes contain
- Somewhere between 40 and 60 questions. Microsoft states no fixed count, so pace by the clock rather than by a number.
- A scaled 700 out of 1,000 passes, which makes a practice percentage a rough guide only.
- Twelve languages including German, with the two Chinese scripts counted as one here where the vendor counts them separately.
- Pearson VUE delivers it, and students and educators can sit it through Certiport instead.
- Priced by country, which is why the cost table below carries two figures with two currencies.
Against the exam it leads to
| Aspect | SC-900 (fundamentals) | SC-200 (analyst) |
|---|---|---|
| Time | 45 minutes | 100 minutes |
| Level | Foundational | Associate |
| Expiry | Never | Twelve months, renewed free online |
| Languages | Twelve | Nine |
| Who it is for | People who talk about the products | People who operate them |
The table is the argument against sitting this if you are technical. The analyst exam requires nothing first, costs more, and is the one a hiring manager takes as proof you can operate something; this one certifies that you can name the parts. That is a real service for a compliance lead and a thin one for an engineer. Microsoft recommends familiarity with Azure and Microsoft 365 and gates nothing, so the technical candidate's cheapest route is to skip straight past.
What survives after the pass is the vocabulary and the three zero-trust ideas, and both outlast the product names, which Microsoft renames on a schedule of its own. The certificate itself never expires, which sounds generous and has a cost: no reader of a CV can tell whether you passed it last month or four years ago, so put the year beside it and expect the conversation to move quickly to what you have built with the products.
What a question looks like
An original question in the exam's style, not one from any question bank.
An organisation wants staff to prove who they are in a way that resists a stolen password, without issuing hardware to everyone. Which capability addresses the requirement, and which product family provides it?
Two answers are technically capable and only one fits the constraint about hardware. The paper repeatedly pairs a concept with a product name and asks for both, which is harder than it looks for candidates who learned the concepts elsewhere and have never had to attach Microsoft's branding to them.
What it costs to get and to keep
| Item | Amount | Note |
|---|---|---|
| Exam fee | 99 USD | priced by the country where the exam is proctored, so this is the United States figure (as of 12 September 2026) |
| Exam fee, Germany and Austria | 76 EUR | from the Microsoft Learn country selector (as of 8 September 2026) |
| Renewal | not published | none. Fundamentals certificates do not expire, so there is no cycle and no fee after the sitting (as of 12 September 2026) |
How much preparation, from where you are
- You work in compliance, procurement or sales
- The intended reader. The material is definitional and responds to reading; the effort goes into keeping three product families distinct rather than into anything technical.
- You already work in security elsewhere
- You will know the concepts and not the branding, which makes this a naming exercise. That is a poor use of a fee unless an employer wants the certificate specifically.
What passing this does not prove
- Any ability to configure identity, compliance or security tooling.
- Whether you could investigate an incident, which is the operations exam's territory.
- Whether a policy you described would satisfy a regulator.
- Security outside Microsoft's catalogue, beyond the handful of principles it borrows.
Against the alternatives
- CompTIA Security+ (SY0-701)
- Vendor-neutral, deeper and considerably more respected as an entry security credential. If you want a security certificate rather than a Microsoft one, that is the better first purchase by a distance.
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- The operations exam this one introduces. It certifies that you can hunt and respond rather than define, and it is the sensible next step for anyone technical.
- Microsoft Certified: Azure Fundamentals (AZ-900)
- The same tier for the platform rather than its security products. Where the budget stretches to a single foundational sitting, the platform paper reaches further.
SC-900: quick answers
Is it worth it for someone in security already?
Rarely on merit. You would be paying to attach Microsoft's product names to concepts you hold, which is a short exercise and a thin signal. The exception is an employer or partner programme that counts this specific certificate.
What should I prepare with?
Microsoft's own free learning path, which covers the syllabus, supplemented by a rehearsal paper so the question style stops being new. Microsoft's learning path plus a mock paper cover it.
Is 45 minutes and a fundamentals label worth putting on a CV?
As one line among several, yes, particularly for a career changer who needs evidence of a direction. On its own it reads as an afternoon rather than a competence, and because the certificate never expires nobody can tell from the entry whether you passed it last month or four years ago. Put the year next to it.
Does it lead anywhere?
To the security operations and identity administration exams, neither of which requires it. It is an on-ramp rather than a gate, and technical candidates commonly skip straight to the associate papers.
Why does the price differ by country?
Microsoft sets exam fees per country where the exam is proctored rather than quoting one global figure, so the cost table shows the United States and the German-Austrian figures with their read dates. Check your own country in Microsoft's selector before budgeting; the difference is not trivial.
Where this exam sits in the field
What comes next
- Microsoft · AZ-900Microsoft Certified: Azure Fundamentals
- Microsoft · SC-200Microsoft Certified: Security Operations Analyst Associate
- Microsoft · SC-300Microsoft Certified: Identity and Access Administrator Associate
- Microsoft · MS-102Microsoft 365 Certified: Administrator Expert
- CompTIA · SY0-701CompTIA Security+
- Microsoft · Lab-based assessmentMicrosoft Applied Skills: Defend against cyberthreats with Microsoft Defender XDR
- Microsoft · AB-900Microsoft 365 Certified: Copilot and Agent Administration Fundamentals
Concepts this exam draws on
Glossary entries with the reason each one matters for SC-900.
- SSL/TLS
Encryption and secure communication at fundamentals level.
- Zero Trust
The three principles are the conceptual core of the fundamentals paper.
- IAM
Identity concepts and the vendor's directory at vocabulary depth.
- MFA
Authentication methods at the level of naming them and knowing why.
- Encryption
Security concepts include encryption and hashing as vocabulary.
Last reviewed 3 October 2026 · Getting Digital