Microsoft Certified: Security, Compliance, and Identity Fundamentals
SC-900 establishes the vocabulary of Microsoft's security, compliance and identity products: what the concepts mean, which product does what, and how the pieces relate.
Three quarters of an hour, nothing gating entry, and no expiry at all.
Exam facts
- Exam code
- SC-900
- Level
- Foundational
- Field
- Cybersecurity
- Duration
- 45 minutes
- Questions
- about 40 to 60 (Microsoft does not publish a fixed number)
- Passing score
- 700 of 1,000 (scaled)
- Languages
- English, German, French, Spanish, Italian, Portuguese, Japanese, Korean, Chinese, Arabic, Indonesian, RussianThe badges group regional variants: Chinese (Simplified and Traditional) count as one language here, so the vendor lists thirteen exam editions where this page shows twelve.
- Price
- 99 USD (read 8 September 2026)
- Validity
- never expires
- Exam delivery
- Pearson VUE (test centre or online proctored); students through Certiport
Prerequisites: None required. Microsoft recommends familiarity with Microsoft Azure and Microsoft 365.
Source: exam page at Microsoft · Price: Priced by the country where the exam is proctored: 99 USD in the United States, 76 EUR in Germany and Austria (Microsoft Learn country selector, read 2026-09-08)
How to prepare
1. The vendor's free learning path
Microsoft publishes the exam objectives and a learning path free of charge — the authoritative source for scope and weighting. Open the learning path (opens in a new tab)
2. A practice test in the exam format
MeasureUp sells a practice test for SC-900 with questions in the exam format, an explanation for every answer and a timed mode; the price shows in your currency on the shop page. Affiliate link.
Practice test for SC-900 at MeasureUp (opens in a new tab)Book the exam
Delivered by Pearson VUE (test centre or online proctored); students through Certiport. Schedule with Microsoft (opens in a new tab)
Affiliate disclosure: the practice-test link above is affiliate links — buying through them may earn us a commission at no extra cost to you. The vendor's learning path and booking links carry no commission.
Its best readers are not security people. Compliance officers, sales engineers, procurement staff and project managers all sit in conversations where Entra, Purview and Defender are mentioned as if everyone present knows the boundaries between them, and this exam draws those boundaries in an afternoon. For that audience it is genuinely efficient. For anyone whose job involves configuring these products, it describes ground you already stand on.
No prep course in our catalogue matched this exam
When we last checked the English course pool we found nothing current for SC-900 specifically. That is unusual for a Microsoft fundamentals paper and it shapes preparation: the vendor's own free learning path is the realistic route, with a mock sitting to acclimatise to the question style. Saying so beats linking an approximation.
The zero-trust question is the one to understand properly
Most of the conceptual marks cluster around a small number of ideas: verify explicitly, assume breach, and least privilege. Candidates who can apply those three to a described situation, rather than recite them, tend to find the rest of the paper follows. It is also the part that survives outside Microsoft's product names.
What forty-five minutes contain
- Somewhere between 40 and 60 questions. Microsoft states no fixed count, so pace by the clock rather than by a number.
- A scaled 700 out of 1,000 passes, which makes a practice percentage a rough guide only.
- Twelve languages including German, with the two Chinese scripts counted as one here where the vendor counts them separately.
- Pearson VUE delivers it, and students and educators can sit it through Certiport instead.
- Priced by country, which is why the cost table below carries two figures with two currencies.
Against the exam it leads to
| Aspect | SC-900 (fundamentals) | SC-200 (analyst) |
|---|---|---|
| Time | 45 minutes | 100 minutes |
| Level | Foundational | Associate |
| Expiry | Never | Twelve months, renewed free online |
| Languages | Twelve | Nine |
| Who it is for | People who talk about the products | People who operate them |
The table is the argument against sitting this if you are technical. The analyst exam requires nothing first, costs more, and is the one a hiring manager takes as proof you can operate something; this one certifies that you can name the parts. That is a real service for a compliance lead and a thin one for an engineer. Microsoft recommends familiarity with Azure and Microsoft 365 and gates nothing, so the technical candidate's cheapest route is to skip straight past.
What survives after the pass is the vocabulary and the three zero-trust ideas, and both outlast the product names, which Microsoft renames on a schedule of its own. The certificate itself never expires, which sounds generous and has a cost: no reader of a CV can tell whether you passed it last month or four years ago, so put the year beside it and expect the conversation to move quickly to what you have actually done with the products.
What a question looks like
Written by us in the exam's style. It is not a real question from any question bank, and we do not publish those.
An organisation wants staff to prove who they are in a way that resists a stolen password, without issuing hardware to everyone. Which capability addresses the requirement, and which product family provides it?
Two answers are technically capable and only one fits the constraint about hardware. The paper repeatedly pairs a concept with a product name and asks for both, which is harder than it looks for candidates who learned the concepts elsewhere and have never had to attach Microsoft's branding to them.
What it costs to get and to keep
| Item | Amount | Note |
|---|---|---|
| Exam fee | 99 USD | priced by the country where the exam is proctored, so this is the United States figure (read 12 September 2026) |
| Exam fee, Germany and Austria | 76 EUR | from the Microsoft Learn country selector (read 8 September 2026) |
| Renewal | not published | none. Fundamentals certificates do not expire, so there is no cycle and no fee after the sitting (read 12 September 2026) |
How much preparation, from where you are
- You work in compliance, procurement or sales
- The intended reader. The material is definitional and responds to reading; the effort goes into keeping three product families distinct rather than into anything technical.
- You already work in security elsewhere
- You will know the concepts and not the branding, which makes this a naming exercise. That is a poor use of a fee unless an employer wants the certificate specifically.
What passing this does not prove
- Any ability to configure identity, compliance or security tooling.
- Whether you could investigate an incident, which is the operations exam's territory.
- Whether a policy you described would satisfy a regulator.
- Security outside Microsoft's catalogue, beyond the handful of principles it borrows.
Against the alternatives
- SY0-701 — CompTIA Security+
- Vendor-neutral, deeper and considerably more respected as an entry security credential. If you want a security certificate rather than a Microsoft one, that is the better first purchase by a distance.
- SC-200 — Microsoft Certified: Security Operations Analyst Associate
- The operations exam this one introduces. It certifies that you can hunt and respond rather than define, and it is the sensible next step for anyone technical.
- AZ-900 — Microsoft Certified: Azure Fundamentals
- The same tier for the platform rather than its security products. Where the budget stretches to a single foundational sitting, the platform paper reaches further.
SC-900 — quick answers
Is it worth it for someone in security already?
Rarely on merit. You would be paying to attach Microsoft's product names to concepts you hold, which is a short exercise and a thin signal. The exception is an employer or partner programme that counts this specific certificate.
What should I prepare with?
Microsoft's own free learning path, which covers the syllabus, supplemented by a rehearsal paper so the question style stops being new. Nothing current in our catalogue covers this paper, and pretending otherwise would help nobody.
Is 45 minutes and a fundamentals label worth putting on a CV?
As one line among several, yes, particularly for a career changer who needs evidence of a direction. On its own it reads as an afternoon rather than a competence, and because the certificate never expires nobody can tell from the entry whether you passed it last month or four years ago. Put the year next to it.
Does it lead anywhere?
To the security operations and identity administration exams, neither of which requires it. It is an on-ramp rather than a gate, and technical candidates commonly skip straight to the associate papers.
Why does the price differ by country?
Microsoft sets exam fees per country where the exam is proctored rather than quoting one global figure, so the cost table on this page shows the United States and the German-Austrian figures with their read dates. Check your own country in Microsoft's selector before budgeting; the difference is not trivial.
What comes next
- Microsoft · AZ-900Microsoft Certified: Azure Fundamentals
- Microsoft · SC-200Microsoft Certified: Security Operations Analyst Associate
- Microsoft · SC-300Microsoft Certified: Identity and Access Administrator Associate
- Microsoft · MS-102Microsoft 365 Certified: Administrator Expert
- CompTIA · SY0-701CompTIA Security+
Concepts this exam draws on
Glossary entries with the reason each one matters for SC-900.
- SSL/TLS
Encryption and secure communication at fundamentals level.
- Zero Trust
The three principles are the conceptual core of the fundamentals paper.
- IAM
Identity concepts and the vendor's directory at vocabulary depth.
- MFA
Authentication methods at the level of naming them and knowing why.
- Encryption
Security concepts include encryption and hashing as vocabulary.
Last reviewed 12 September 2026 · Getting Digital