Microsoft SC-900: Security, Identity and Compliance

Microsoft SC-900 is a fundamentals certification about how identity, security and compliance concepts fit together across Microsoft cloud services. It is not a substitute for hands-on administration of every product in the portfolio. The SC-900 exam currently published skills outline includes security concepts, Microsoft Entra, Microsoft security solutions and Microsoft Purview. Microsoft has also announced an English-language exam update scheduled for October 21, 2026, so candidates should check the study guide that applies to their testing date rather than assume a single permanent feature list.

The most useful way to study this material is to trace a business scenario. A company wants staff to access documents securely from managed devices, detect threats, classify sensitive files and retain business records according to policy. No single service owns all those outcomes. Identity establishes who is requesting access, platform controls protect workloads, security operations investigate threats and compliance tools support information governance. SC-900 measures the vocabulary and relationships needed to understand that division of responsibility.

Start with security principles rather than brand names

Shared responsibility describes how cloud providers and customers divide operational and security duties, but the split changes with the service model. Customers usually retain control of their identities, data classifications and application decisions, even when the provider manages underlying infrastructure. Be able to explain why a provider's physical security does not prevent a customer from publishing a storage object accidentally. Technology choices may simplify duties, but they do not remove the need to understand ownership.

Defense in depth combines preventive, detective and recovery controls. A secure identity system cannot replace endpoint protection, and encryption does not eliminate the risk of an authorized user misusing data. Zero Trust emphasizes explicit verification, least privilege and the assumption that compromise is possible. It is a design principle, not a one-time product installation. Apply it by checking user and device context, restricting access to the minimum necessary and observing whether trust assumptions change during a session.

Authentication and authorization are different. Authentication establishes who an actor is or proves possession of a credential; authorization determines permitted actions. Hashing, encryption and certificates also solve different problems. Candidates should distinguish protecting data confidentiality from proving integrity or establishing trust in an endpoint. Misusing these terms can lead to the wrong control selection even when the organization owns strong tools.

Understand Microsoft Entra as the identity layer

Microsoft Entra ID provides cloud identity and access functions for users, applications and other identities. It is the successor branding for Azure Active Directory; the Microsoft Entra ID naming transition matters when older study materials use the previous name. Understand the role of a directory, identity provider, single sign-on and federation without confusing these with data-center Active Directory domain services. Hybrid identity connects on-premises and cloud scenarios but creates additional integration responsibilities.

MFA adds a factor beyond a password, while passwordless methods and risk-aware authentication seek to improve assurance and usability. Conditional Access evaluates signals such as identity, application, device and risk to enforce decisions appropriate to policy. The deeper treatment of Entra Conditional Access helps explain how conditions and grants work together. For SC-900, the goal is to know what such a policy can influence, not memorize every portal screen or obscure setting.

Role-based access control separates duties and limits privileges. Administrative roles should be granted according to responsibilities, not simply convenience. Microsoft Entra identity governance, access reviews, Privileged Identity Management and identity protection address related but distinct governance and risk concerns. A review checks whether access remains appropriate; privileged identity management supports controlled elevation; identity protection informs responses to suspicious sign-ins. Distinguish the purpose of each before matching a scenario to a service.

Recognize Azure infrastructure security functions

Azure virtual networks and network security groups provide connectivity and traffic filtering at different scopes. Azure Firewall, Web Application Firewall, DDoS Protection and Bastion address different infrastructure risks. A WAF helps inspect web application requests, while DDoS services mitigate certain availability attacks; one does not replace the other. Bastion provides a managed route for administrative access to virtual machines without requiring every VM to expose a public remote-management port. Understand the problem a service solves and where its control boundary ends.

Azure Key Vault helps manage secrets, keys and certificates under controlled access. Storing a secret centrally does not make excessive permissions safe. Defender for Cloud provides security posture and workload-protection capabilities; posture management identifies risky configuration and policy gaps, while workload protection helps detect and respond to threats in supported environments. For exam purposes, understand the distinction between improving baseline configuration and detecting malicious activity in running workloads.

Security monitoring depends on reliable telemetry and defined response. Enabling a platform feature without appropriate access, alert routing and investigation ownership may create little benefit. SC-900 requires conceptual recognition of these functions, but the business logic remains the same as in advanced engineering: monitoring must lead to decisions, not merely accumulate events.

Distinguish Sentinel from Defender XDR

Microsoft Sentinel is a cloud-based security information and event management and security orchestration offering. It can gather and analyze security data, correlate detections and support investigative and response workflows. SIEM concentrates on visibility and correlation across sources; SOAR supports automated or semi-automated response processes. Understand why organizations centralize diverse signals and how response playbooks must still respect privileges and approvals.

Microsoft Defender XDR brings together detection and response signals from Microsoft security products across domains such as endpoints, identity, email and cloud applications. Individual services, including Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps, protect different surfaces. A malicious email and its resulting endpoint activity may be related even though they were observed by distinct controls. The value of cross-domain detection is the ability to understand that relationship and coordinate containment.

Do not confuse the presence of a product with complete protection. Coverage depends on enrollment, configuration, licensing, data retention and staff capable of investigating alerts. A monitoring solution may fail to see devices excluded from management. At the fundamentals level, recognize the services and their intended roles, while resisting the idea that one dashboard is a complete security strategy.

Understand information protection through Microsoft Purview

Compliance management is about obligations, classification, retention, investigation and responsible information handling. Microsoft Purview provides capabilities including information protection, data loss prevention, retention, records management, eDiscovery, audit and insider-risk solutions. These features address different stages of the information lifecycle. A sensitivity label communicates or enforces handling expectations for an item; a retention policy governs how information is kept or disposed of; DLP can restrict movement through monitored channels according to policy.

Compliance Manager supports tracking improvement actions and assessments against selected requirements. A compliance score can support prioritization, but it is not a universal declaration of legal compliance. The relevant legal and contractual obligations must be understood in context. Likewise, the Microsoft Service Trust Portal provides documentation about Microsoft's compliance posture and service assurances; such documentation does not prove that a customer's own tenant configuration meets every applicable obligation.

Insider-risk and eDiscovery tools require care because they may process sensitive employee or legal information. Authorized use, privacy obligations and access restrictions matter. Audit solutions help preserve activity evidence for investigation; recording an event is different from deciding whether it indicates misconduct. SC-900 candidates should know what category of problem each solution addresses, avoiding the assumption that every governance need is a data loss prevention problem.

Connect identity and compliance in one realistic case

Suppose an employee downloads a sensitive spreadsheet onto an unmanaged device and later shares it externally. Identity logs can establish authentication context; Conditional Access may govern whether the device was permitted to reach the service; data labels and DLP policy may influence handling; Defender signals may indicate suspicious endpoint behavior; and audit or investigation capabilities can help reconstruct the event. Each component provides a different part of the protection and response story. A strong answer identifies the right service role without claiming one feature provides all evidence.

The response also illustrates why governance and security must be coordinated. If the file has no classification, a DLP policy may not recognize the sensitivity; if access policy allows unmanaged devices, device context becomes important; and if audit retention is inadequate, investigators may lack evidence. These are configuration and ownership questions, not merely product-selection questions. Controls must be tied to a stated information-handling requirement and tested against realistic behavior.

Another way to separate the concepts is to ask which question a control answers. Retention policy asks how long a record should exist; a SIEM alert asks whether activity appears suspicious; and an access review asks whether privileges remain justified. A file sensitivity label and an MFA challenge may influence the same user workflow, but neither replaces the other. These differences explain why a business needs coordinated services rather than one all-purpose security checkbox.

Candidates should also distinguish a product family from a specific feature. Microsoft security and compliance services evolve quickly, and an older course might use a retired product label while describing a still-useful concept. Anchor preparation in the official skills outline relevant to the examination date, then use product examples to understand the concept rather than treating brand names as permanent truth.

For SC-900 preparation, use small scenarios and ask which service category addresses the problem, which identity or data condition matters and which team owns the resulting action. Recheck the applicable Microsoft study guide before the exam because objectives and product terminology evolve, including the scheduled October 2026 update. The lasting skill is a clear conceptual map of security, identity and compliance, not a memorized list of ever-changing menu labels.