SC-900 Exam Guide: What It Covers, Cost, Format, and How to Pass

Microsoft's SC-900 exam — its full title is Security, Compliance, and Identity Fundamentals — is a beginner-level certification that proves you grasp core security, compliance, and identity ideas and the Microsoft tools behind them. You get 45 minutes and need a scaled score of 700 out of 1,000 to pass. There are no prerequisites, and the credential never expires. Here is the full picture, checked against Microsoft's own pages.

What SC-900 covers

Microsoft splits the exam into four skill areas. Each one carries a weight range that hints at how many questions come from it (study guide):

• Security, compliance, and identity concepts (10–15%) — the base ideas: the shared responsibility model, defense-in-depth, Zero Trust, encryption and hashing, and what authentication and authorization actually mean.
• Microsoft Entra capabilities (25–30%) — Microsoft's identity platform. Expect identity types, authentication methods, multifactor authentication, Conditional Access, and role-based access control.
• Microsoft security solutions (35–40%) — the biggest slice by far. This covers Azure network security, Microsoft Defender for Cloud, Microsoft Sentinel, and Microsoft Defender XDR.
• Microsoft compliance solutions (20–25%) — mostly Microsoft Purview: data classification, sensitivity labels, data loss prevention, retention, and eDiscovery.

Notice that every domain begins with the verb describe. SC-900 checks whether you can explain these services in plain terms — not configure them. There is no hands-on lab, which sets it apart from the associate exams.

Microsoft refreshes the English exam on July 28, 2026, but the update is minor. The four domains and their weightings hold, so this guide stays accurate through the change.

Exam format: what's official, and where guides overreach

Here is only what Microsoft states.

You get 45 minutes for the exam. That figure is official.

The number of questions is not. Microsoft does not publish a fixed count for SC-900, and Fundamentals exams can vary. You will find sites that confidently list "40 to 60 questions" or one exact figure — none of that comes from Microsoft. A rough expectation of 40 to 60 items is reasonable, but treat any precise number as an estimate. We would rather flag it as unpublished than repeat a guess.

The pass mark is 700 on a 1,000-point scale. One thing to know: 700 is not the same as getting 70% of questions right. Scores are scaled: a harder set of questions needs fewer points, an easier set needs more. Some items are also unscored trial questions that Microsoft uses to shape future exams. Aim well clear of the line rather than counting questions.

Cost and renewal

Microsoft prices SC-900 by country or region, so there is no single global figure. The exact amount shows when you book through Pearson VUE (or through Certiport, for students and educators). Because pricing shifts by location, we point you at the registration page instead of quoting a US number that may not match yours.

Now the good news on upkeep: Fundamentals certifications do not expire. Associate- and expert-level credentials need a free renewal assessment every year to stay valid. SC-900 does not. You earn it once and keep it — no renewal, no clock.

Who it's for and what you need first

SC-900 has no prerequisites — you can book it without passing anything else first. Microsoft aims it at a wide audience: business stakeholders, IT professionals both new and experienced, and students. Some grounding in Azure and Microsoft 365 helps you follow the examples, but it is not required.

If security is brand new to you, SC-900 is a sensible first step. If you already work in IT, you can go straight for it. Wondering how tough it really is? We give a sourced, honest read in is SC-900 hard.

How to prepare

Start with Microsoft's free material: the four official learning paths and the free practice assessment linked from the exam page. Work through the skills outline so nothing on the blueprint catches you off guard.

Then test yourself under exam-like conditions. Practice questions are the clearest signal of whether the material has stuck. That is why we built our SC-900 practice exams straight from the official skills list. Every question traces to the Microsoft page behind it, and none come from dumps. Practice tests do not replace study; they show you where you are not ready yet.

For a week-by-week route through the four domains, see our SC-900 study plan. For a closer look at the question styles and how to practise them, see our guide to SC-900 questions.

Is it worth it

For a first security credential, yes. SC-900 gives you a shared vocabulary — Zero Trust, Conditional Access, DLP, SIEM — that maps directly onto real Microsoft tools you will meet on the job. It is a common on-ramp to role-based security certifications like SC-200 and SC-300, and because it never expires, it stays on your record for good. For anyone starting in security, compliance, or identity work, it is a low-risk, high-signal place to begin.