SC-900: Understanding Security, Identity and Compliance

SC-900 provides an introduction to security, compliance and identity across Microsoft cloud services. It is a fundamentals exam for people who need an accurate mental model before configuring specialist systems. Microsoft has announced an SC-900 objectives revision effective October 21, 2026. Candidates sitting earlier should use the preceding effective outline; those testing afterward should review the updated skills measured before completing their study plan. The central learning objective is to distinguish what a control protects, who is responsible for it and how the pieces work together.

A security product name is not a substitute for understanding a threat. Microsoft Entra focuses on identities and access, Defender products support security posture and threat protection, and Purview helps protect and govern information. The cloud identity concepts become useful when they are connected to situations that an organization actually faces.

Start with shared responsibility and defense in depth

Cloud providers manage parts of the underlying service, while customers still control accounts, configuration, sensitive information and many application decisions. The division changes across infrastructure, platform and software service models. An organization that uses managed email still needs to protect administrators, review external sharing and respond to incidents. Outsourcing infrastructure operations does not transfer every security or compliance duty to the service provider.

Defense in depth combines controls that address different failure modes: identity verification, network limits, data authorization, endpoint protection, monitoring and recovery. No layer is perfect. A stolen credential may bypass one control but be blocked by device requirements or unusual-activity detection. A backup protects recovery, not necessarily confidentiality. Fundamentals should teach why complementary controls reduce overall risk and why duplicating the same weak control three times is not a mature strategy.

Explain authentication and authorization separately

Authentication establishes an identity claim; authorization determines permitted actions. A correct password or strong MFA does not entitle every employee to read payroll. Microsoft Entra ID can help manage users, groups, application identities and access policies. Learn how identity providers, directory services, federation and single sign-on relate without confusing a convenient sign-in experience with unrestricted trust. Conditional Access evaluates contextual signals, while role-based permissions determine actions within resources.

Consider an employee signing into a benefits application from a newly purchased phone. The account may authenticate but fail a compliant-device requirement. Disabling MFA for everyone would not solve the real issue. A service desk should be able to explain the difference between access conditional on device health and access based on business role. More advanced SC-300 covers implementation detail, but SC-900 requires correct conceptual boundaries and common use cases.

Recognize the families of Microsoft security tools

Microsoft Defender products cover different surfaces: endpoints, identities, email, cloud applications and cloud workloads. Defender XDR can correlate signals from several protected areas, while Microsoft Sentinel provides broader SIEM and automation capabilities. Defender for Cloud helps manage security posture and workload protection. These tools complement, but do not replace, secure configuration and operational judgment. A vulnerability recommendation is not automatically evidence that an attacker has exploited a system.

Imagine an employee opens a suspicious message and later signs in from an unusual location. Email, endpoint and identity signals may be correlated in an investigation. An analyst needs evidence, not a claim that any one product automatically prevents every attack. The security and identity fundamentals should enable a business stakeholder to ask which signals are monitored, who responds and how actions are authorized. The specialist SC-200 works with those signals in depth.

Understand Zero Trust without reducing it to a slogan

Zero Trust emphasizes verifying access explicitly, using least privilege and assuming compromise is possible. It is a design approach applied to users, devices, applications and data. A company with remote and on-site workers should not assume that being connected to the office Wi-Fi is proof of authorization. The same user might require different access conditions when using a corporate laptop versus a personal device. Risk-based controls should support work while making unsafe access more difficult.

Least privilege extends to background applications. A service that needs to upload one file should not be granted administrator access to an entire tenant. Temporary privileges and access reviews help reduce unnecessary standing authority. At fundamentals level, be able to describe why permanent shared administrator passwords are risky, how access can be limited and what logs could support an investigation. The technical implementation is more involved, but the principle should already be clear.

Distinguish governance, compliance and privacy needs

Regulations and contractual obligations may require record retention, restrictions on data access, incident handling or evidence of controls. A compliance score can help identify work but is not a legal guarantee. Microsoft Purview offers capabilities such as sensitivity labels, data loss prevention, retention, eDiscovery and auditing. These protect different dimensions of information. Retention preserves records when required; DLP helps control inappropriate movement; sensitivity labels can signal and enforce handling requirements.

A company may need to share an approved contract while preventing employee salary data from leaving the organization. One global rule that blocks all external sharing may undermine legitimate work. Policies should distinguish information types and approved uses. SC-401 information protection involves the details of configuring these capabilities, but fundamentals should teach why the same document may have access, classification and retention obligations simultaneously.

Recognize security operations and business consequences

Security operations include alert triage, incident escalation, threat hunting, investigation and response. The sequence matters: an alert is a signal that needs interpretation; an incident is an organized response to a credible problem. A high volume of alerts may indicate active threats, misconfigured detections or both. Businesses need people authorized to contain threats and recover affected services. Security is not finished when a portal generates a warning.

Consider an administrator account changing a critical policy unexpectedly. The organization should know who may review the event, what records help establish whether it was authorized and what immediate action would be safe. Disabling the account may be appropriate under some conditions but could interrupt essential operations. A fundamentals candidate should understand the need for defined ownership and response procedures, not memorize an unsupported claim that every suspicious event must trigger an identical action.

Fundamentals also include knowing what a security control cannot conclude. A device marked compliant may still have malicious software, and an encrypted connection may carry data to an unauthorized recipient. A high compliance score reflects the scope and assumptions of the measurement, not absolute safety. Learners should be able to identify the remaining risk after one control is applied, then explain why another layer of protection or monitoring might be needed. This reasoning is more durable than memorizing every service's marketing description.

A common governance mistake is treating all privileged roles as interchangeable. A person who can manage an application may not need to administer identities, security alerts or data retention. Separating duties reduces the impact of mistakes and compromised accounts. At fundamentals level, practice explaining why a tenant-wide administrator role should be exceptional and why service accounts or background processes deserve the same scrutiny as human users. A role's name matters less than the actions it actually permits.

Consider a small business that receives a ransomware warning on one laptop. The first questions concern whether the alert is credible, whether the endpoint is isolated, whether account sessions are at risk and whether recovery data is available. Backup alone may restore files but cannot remove stolen identity permissions. Equally, resetting a password may not recover corrupted documents. Map each concern to the relevant control and response owner. Doing so demonstrates a grasp of layered security without assuming that one Microsoft product solves the entire incident.

When comparing Cloud security models, remember that organizations may use multiple identity providers and services in one workflow. A contractor might sign into Microsoft 365 through federation and then reach a business application with its own authorization model. Authentication assurance, application roles and data classification remain distinct. The simplest case study is often the most revealing: list each trust decision from the first sign-in to the final data action, and identify which team maintains it.

A useful comparison is the difference between a security recommendation and a compliance obligation. Defender for Cloud may identify a publicly exposed workload that should be hardened, while a retention policy may need to preserve information for a prescribed business period. Both deserve attention but require different owners, evidence and remediation. Security posture describes exposure and control implementation; compliance involves meeting an applicable rule or commitment. Neither should be treated as a certificate that the organization cannot be breached.

In a hybrid organization, administrators must also distinguish tenant controls from device and application controls. A guest can be correctly authenticated to Microsoft Entra ID yet receive excessive access inside a particular application because its role assignments are too broad. Conversely, a well-managed application cannot compensate for a compromised privileged account that can change the tenant's security settings. Identifying where a trust boundary lies is essential to choosing the relevant product family and escalation path.

Study by matching scenarios to purposes

Create small cases: a lost employee laptop, an external file-sharing request, a suspicious sign-in, an expiring retention obligation and an overly broad application permission. For each, identify which conceptual control is relevant, what it does not solve and who should investigate. A lost device raises endpoint and access questions; it does not automatically mean that all cloud documents were exposed. A suspicious sign-in requires context; it does not prove that sensitive data left the tenant.

The official SC-900 outline includes definitions and product families, but the best preparation explains them in business language. Build familiarity with shared responsibility, identity, Zero Trust, threat protection and data governance before studying specialist configuration. Understanding boundaries makes the next technical certification easier and helps nontechnical decision-makers evaluate security claims accurately.