IT, Cloud & Cybersecurity • Certification
Microsoft Certified: Security, Compliance and Identity Fundamentals
Security, compliance and identity fundamentals
Researched and maintained by TestPrepPilot Editorial BoardCloud, IT & cybersecurity certifications desk · Figures last verified August 2026
The short version
What is the Microsoft Certified: Security, Compliance and Identity Fundamentals and is it worth it?
SC-900 is an entry exam covering Microsoft Entra, Azure security and Microsoft 365 compliance basics.
- Beginner friendly
- No experience needed
- Renews yearly
What is it?
What exactly is the Microsoft Certified: Security, Compliance and Identity Fundamentals?
Security, compliance and identity fundamentals
Microsoft Certified: Security, Compliance and Identity Fundamentals (SC-900) validates foundational knowledge of Microsoft security, compliance and identity solutions.
Before you book
Who is eligible to sit the Microsoft Certified: Security, Compliance and Identity Fundamentals?
Who it is for: Students and security beginners
The test itself
What is the format of the Microsoft Certified: Security, Compliance and Identity Fundamentals?
The Microsoft Certified: Security, Compliance and Identity Fundamentals is administered by Pearson VUE / Certiport and runs 45–60 minutes, contains 40–60 questions and requires 700 of 1000 to pass.
| Administered by | Pearson VUE / Certiport |
|---|---|
| Questions | 40–60 |
| Time limit | 45–60 minutes |
| Pass mark | 700 of 1000 |
| Exam fee | $99 |
| Format | Multiple-choice |
Content outline
What topics are on the Microsoft Certified: Security, Compliance and Identity Fundamentals?
The Microsoft Certified: Security, Compliance and Identity Fundamentals is weighted across 3 domains; the largest are Security (35%), Identity (35%), Compliance (30%).
Weightings come from the official exam outline. Study time is best allocated in roughly these proportions rather than evenly across domains.
- Security 35%
- Compliance 30%
- Identity 35%
Money & time
How much does the Microsoft Certified: Security, Compliance and Identity Fundamentals cost?
For the Microsoft Certified: Security, Compliance and Identity Fundamentals, the exam fee is $99; the all-in cost is typically $99+; most candidates spend 2–4 weeks preparing.
Cost breakdown
| Exam fee | $99 |
|---|---|
| Typical total | $99+ |
Academic pricing lower.
Timeline
- Study 1–3 weeks
- Sit SC-900 test day
Typical prep: 2–4 weeks
The path
How do you register for the Microsoft Certified: Security, Compliance and Identity Fundamentals?
- 1
Prepare with Microsoft Learn1–10 weeks depending on exam and experience
Work through the free official self-paced learning paths and, optionally, instructor-led courses for your exam. Microsoft Learn is the primary, no-cost study source and maps directly to the exam skills outline.
- 2
Schedule through Pearson VUEabout 15 minutes
Sign in with a personal Microsoft account (MSA) and schedule the exam on the Pearson VUE portal. Choose an in-person test center or online proctoring (OnVUE). Students and educators can use Certiport for Fundamentals exams.
Microsoft recommends a personal MSA account; a work or school account can lose exam records if you leave the organization.
- 3
Take the exam45–120 minutes depending on the exam
Arrive at the test center or launch the online proctoring session. Exams are computer-based and may include multiple-choice, drag-and-drop, case studies, and performance-based lab tasks in a live environment.
- 4
Receive results and badgescore at end; badge within a few days
You see a pass/fail result on screen immediately. A detailed score report is emailed within about 24 hours and posted to your Microsoft certification profile. On passing, your digital badge is issued via Credly.
- 5
Renew annuallyabout 45 minutes, once a year
Most Microsoft role-based, specialty, and fundamentals certifications expire after 12 months. Renew for free by passing a shorter online renewal assessment on Microsoft Learn before the expiry date — no need to retake the full exam.
The fine print
What are the retake and renewal rules for the Microsoft Certified: Security, Compliance and Identity Fundamentals?
- Proctoring & delivery
- Delivered by Pearson VUE. You can sit the exam at a Pearson VUE test center or take it online through OnVUE remote proctoring; the fee is the same for both. Online proctoring requires a quiet, private space, a working webcam, and a system check beforehand.
- Retake policy
- If you do not pass, you may retake the exam after 24 hours. A second failed attempt requires a 14-day waiting period, and any further attempts also require a 14-day wait between them, up to a maximum of five attempts in a 12-month period.
- Score reporting
- A pass/fail result is shown immediately after the exam. The official score report is emailed within about 24 hours and is also available in your Microsoft certification profile, with section-level feedback on how you performed.
- Recertification
- Microsoft role-based, specialty, and fundamentals certifications are valid for 12 months from the date earned. Renew at no cost by passing the shorter online renewal assessment on Microsoft Learn before the credential expires. Retired certifications cannot be renewed and must be re-earned through the active successor if one exists.
- Refunds & rescheduling
- Exam fees are generally non-refundable once a seat is purchased, but you can cancel or reschedule through Pearson VUE at no charge if you do so at least 24–48 hours before the appointment (exact window varies by region).
Context
Microsoft Azure / AI certifications compared
| Credential | Level | Focus | Exam fee | Validity | |
|---|---|---|---|---|---|
| AZ-900 Azure Fundamentals | Fundamentals | Cloud concepts | $99 | 1 year | |
| AI-900 Azure AI Fundamentals | Fundamentals | AI concepts | $99 | 1 year (retired Jun 30 2026) | |
| AI-901 Azure AI Fundamentals | Fundamentals | AI + Microsoft Foundry | $99 | 1 year | |
| AZ-104 Azure Administrator | Associate | Administer Azure | $165 | 1 year | |
| AZ-204 Azure Developer | Associate | Build cloud apps | $165 | 1 year (retired 2026) | |
| AZ-500 Azure Security Engineer | Associate | Security operations | $165 | 1 year (retires Aug 31 2026) | |
| AZ-700 Azure Network Engineer | Associate | Networking | $165 | 1 year | |
| AZ-140 Azure Virtual Desktop | Specialty | Virtual desktop (AVD) | $165 | 1 year | |
| AZ-305 Azure Solutions Architect | Expert | Solution design | $165 | 1 year |
What it pays
How much does this credential pay?
$124,910 median for information security analysts (BLS, May 2024)
There is no Bureau of Labor Statistics occupation called "SC-900" — the Microsoft Security, Compliance and Identity Fundamentals certification validates foundational security concepts on Microsoft's stack, and the wage question belongs to the role you perform with it. The closest official BLS occupation for the security careers the credential serves is Information Security Analysts, SOC 15-1212, which had a May 2024 median wage of $124,910, with the lowest 10 percent under $71,280 and the highest 10 percent above $173,780, with Computer Support Specialists (SOC 15-1231, $61,550) as the entry benchmark. The fit must be read with an honest caveat: SC-900 is an entry-level fundamentals credential, so the realistic benchmark for a new holder sits far below the analyst median — the credential typically appears on the resume of a student, a career-changer or an IT professional adding security literacy, and the analyst wage applies only after the experience the median describes. BLS counted 182,300 information security analyst jobs in 2024 and projects a striking 30 percent growth from 2024 to 2034, with about 17,500 openings a year. The limitation to state plainly: the BLS median covers the whole occupation at all levels, credentialed or not, and an entry certificate carries no wage premium in government data. Read the number as the market for the occupation the certificate is a step toward.
| Measure | Figure | Source / note |
|---|---|---|
| Median annual wage, information security analysts (destination market) | $124,910 | BLS OOH, SOC 15-1212, May 2024 |
| Lowest 10 percent | Under $71,280 | BLS OOH, SOC 15-1212, May 2024 |
| Highest 10 percent | Above $173,780 | BLS OOH, SOC 15-1212, May 2024 |
| Median, computer support specialists (entry benchmark) | $61,550 | BLS OOH, SOC 15-1231, May 2024 |
Job growth.BLS projects 30 percent growth for information security analysts from 2024 to 2034, about 17,500 openings per year.
Source: BLS Occupational Outlook Handbook - Information Security Analysts
Your odds
What are the pass rates?
Microsoft publishes no pass rate — it publishes the passing score: 700 of 1000, with a 40-60 question, 45-minute exam
Microsoft does not publish cohort pass rates for its certification exams, and third-party surveys are not official data, so we do not treat them as authoritative. What Microsoft does publish is the format and the passing standard: the SC-900 exam has 40-60 questions with a 45-minute time limit, and a passing score of 700 on the 100-1000 scale. The exam is delivered at Pearson VUE centres or through online proctoring, and Fundamentals certifications do not expire. The exam content follows the published study guide: the concepts of security, compliance and identity; the capabilities of Microsoft Entra ID (identity and access); the Microsoft security solutions (Microsoft Defender products and Microsoft Sentinel); and the compliance management and governance tools (the Purview portal and compliance capabilities). The absence of a published pass rate is not an absence of standards: the 700 line is a moderate bar for an entry-level fundamentals exam, and the exam rewards familiarity with the Microsoft security product family rather than deep configuration. The practical reading: target 80 percent-plus on practice, use Microsoft's free learning paths, and treat the credential as the entry rung toward the role-based security certifications (SC-200, SC-300, SC-100) that benchmark the analyst wages.
Read this before quoting the number.Microsoft publishes the passing score and format but no pass rate; any percentage circulating online is a third-party estimate.
Source: Microsoft Learn - SC-900: Security, Compliance and Identity Fundamentals
Your schedule
How long should I study for it?
20-40 hours over 2-3 weeks of focused study
The SC-900 exam is a 40-60 question, 45-minute exam with a 700/1000 passing score, built on the published study guide: security, compliance and identity concepts; the Microsoft Entra ID identity capabilities; the Microsoft security solutions; and the compliance and governance tools. The exam is an entry-level fundamentals test that rewards a working familiarity with the Microsoft security product family. A defensible plan runs 20 to 40 hours over 2 to 3 weeks. Week one: the concepts — the shared-responsibility model, the defence-in-depth layers, and the identity concepts — using Microsoft's free learning path. Week two: the product capabilities — Entra ID (identity and access), the Defender products and Sentinel (security operations), and the Purview compliance portal — learning what each solution is for. Week three: practice-question drilling and a timed practice exam at the real format. The plan is coverage-based because the exam rewards breadth across the product family; a candidate with basic security exposure moves quickly through the modules.
- Week 110
Security, compliance, identity concepts
- Shared responsibility and defence in depth
- Identity and access concepts
- Compliance and governance basics
- Week 214
Microsoft solutions
- Microsoft Entra ID capabilities
- Defender products and Sentinel
- Purview and compliance tools
- Week 310
Drill and simulate
- Practice-question drilling in volume
- One timed practice exam
- Review weak areas
Adjusting the pace
Working in IT.Compress the concepts week; the Microsoft product names and purposes are the new content.
New to security.Add a week of general security concepts before the product modules.
How to study
How do I prepare most effectively?
The SC-900 exam rewards breadth across the Microsoft security product family, so the dominant strategy is systematic coverage with a product-purpose focus: learn what each solution is for — Entra ID for identity, the Defender products for protection, Sentinel for detection and response, Purview for compliance — because the exam asks purpose-level questions. Second, use Microsoft's free learning path and the official study guide as the primary resources; they are the authoritative scope and are free. Third, master the concept layer: the shared-responsibility model and the defence-in-depth layers are tested directly, and candidates who skip them miss the conceptual items. Fourth, drill the compliance and governance material, a distinct block that candidates focused on the security tools often miss. Finally, take at least one timed practice exam at the real 45-minute format; the short window rewards efficient reading, and the practice assessments mirror the item style.
Learn products by purpose
Entra ID, Defender, Sentinel and Purview — what each is for.
Use the free official resources
Microsoft Learn and the study guide are free and authoritative.
Master the concept layer
Shared responsibility and defence in depth are tested directly.
Drill compliance and governance
A distinct block; security-tool-only study misses it.
Run one timed practice exam
45 minutes rewards efficient reading; practise the pace.
What to buy
Which study resources are worth paying for?
SC-900 prep is inexpensive because Microsoft provides the core resources free. The Microsoft Learn learning path and the official study guide cover the scope at no cost, and Microsoft's practice assessments are free. Third-party providers sell SC-900 courses and practice exams at roughly $30-$200; the free official stack is sufficient for a disciplined candidate. The exam fee is about $99. A realistic total budget is $100 to $300 including the exam fee. Prices below are list prices as of mid-2026 and change frequently; we rank nothing by commission.
| Resource | Price | Format | Best for |
|---|---|---|---|
| Microsoft Learn learning path | Free | Official online modules | The authoritative scope; the primary resource |
| Official study guide | Free | Official PDF | The exam-scope reference |
| Microsoft practice assessment | Free | Official online practice | The closest official item style |
| Third-party video courses | $30-$150 | Video courses and quizzes | Structured walkthrough of the scope |
| Practice-exam products | $20-$80 | Online simulated exams | Extra drilling volume |
List prices as of mid-2026, subject to change; the SC-900 exam fee is about $99; no commission or affiliate ranking is implied.
Avoid these
What mistakes do candidates most often make?
The most common SC-900 mistake is studying one product deeply and skipping the breadth: candidates who learn Microsoft Defender but cannot place Sentinel, Purview or Entra ID miss the purpose-level items, which dominate the exam. The fix is balanced product coverage. The second mistake is studying configuration instead of concepts — the SC-900 tests what the solutions are for and the shared-responsibility model, not how to configure them. Third, candidates skip the compliance and governance block, a distinct tested area. Fourth, some candidates never take a timed practice exam and misjudge the 45-minute window. Finally, treating SC-900 as the destination misses the point: it is the entry rung of the Microsoft security track, and the role-based certifications (SC-200, SC-300, SC-100) are what employers hire on.
✕Studying one product deeply
✓Cover the whole product family; the exam tests purpose-level breadth.
✕Studying configuration depth
✓The SC-900 tests concepts and product purposes, not configuration.
✕Skipping compliance and governance
✓A distinct tested block; cover it.
✕Never timing a practice exam
✓45 minutes rewards efficient reading; run one timed practice.
✕Treating SC-900 as the finish
✓Plan the role-based track (SC-200, SC-300, SC-100).
What you'll face
What question types will I see?
The SC-900 exam is a 40-60 question multiple-choice exam in 45 minutes. The items test the published study guide: security, compliance and identity concepts; the Microsoft Entra ID capabilities; the security solutions; and the compliance and governance tools — with many items asking what a solution is for, which solution fits a described need, or which concept applies. Samples below are editor-written illustrations of the published study guide, not live exam items; they show the concept-and-purpose style of the real items.
Shared responsibility, defence in depth, identity concepts.
Which Microsoft security solution fits a described need.
Purview capabilities and compliance concepts.
Try these
Q1A security team needs a cloud-native SIEM to analyse security data across the organisation. The most appropriate Microsoft solution is:
Answer:A
Sentinel is the cloud-native SIEM and SOAR for security-data analysis. Entra ID manages identity, Purview handles compliance and data governance, and Defender for Cloud Apps secures cloud apps — none is the SIEM.
Q2Under the shared-responsibility model for an IaaS workload, the customer is generally responsible for:
Answer:A
For IaaS, the customer secures what they configure — the operating system, applications and data — while the provider secures the physical infrastructure and hypervisor. The other options are provider responsibilities.
Q3Which Microsoft Entra ID capability provides multi-factor authentication for user sign-ins?
Answer:A
Multi-factor authentication is an identity capability of Microsoft Entra ID. Sentinel is the SIEM, Purview is compliance, and Defender for Endpoint protects devices — none provides identity MFA.
Samples are editor-written illustrations of the published study guide, not live exam items.
The big day
What should I expect on exam day?
The SC-900 exam is a 40-60 question, 45-minute computer-based exam at a Pearson VUE centre or through online proctoring. Bring a valid government-issued photo ID matching your registration name and your appointment confirmation; personal items go in the locker. Arrive 30 minutes early; late arrivals forfeit the appointment and the fee. Pace at under a minute per item, flag uncertain items for review, and finish with time to spare. You receive your score on screen immediately, with the official result following; Microsoft reports your scaled score against the 700 line. If you fail, you may retake after a waiting period. On a pass, the Fundamentals certification does not expire. The afterwards matters: add the credential to your Microsoft Learn profile, and plan the next rung of the Microsoft security track — typically the SC-200 security operations analyst — while the concepts are fresh.
Bring
- Valid government-issued photo ID matching your registration name
- Appointment confirmation
Leave at home
- Phone, smartwatch and all electronics
- Notes and study materials
- Personal bags beyond what the centre allows
How the day runs
Rules in the room
- No personal electronics in the testing room
- 45 minutes for 40-60 questions; the clock does not pause
- Fundamentals certifications do not expire
Afterwards.On a pass, your SC-900 is permanent. On a fail, retake after additional study. Plan the role-based track (typically SC-200) as the next step.
Reference
What are the key facts about the Microsoft Certified: Security, Compliance and Identity Fundamentals?
Microsoft Certified: Security, Compliance and Identity Fundamentals is a certification credential; awarded by Microsoft; the exam fee is $99; typical preparation is 2–4 weeks; holders typically earn $65,000 – $100,000.
| Credential | Microsoft Certified: Security, Compliance and Identity Fundamentals |
|---|---|
| Abbreviation | SC-900 |
| Type | Certification |
| Profession | IT, Cloud & Cybersecurity |
| Specialty | Microsoft |
| Awarded by | Microsoft |
| Difficulty | Easy |
| Typical prep time | 2–4 weeks |
| All-in cost | $99+ |
| Typical salary range | $65,000 – $100,000 |
| Exam code | SC-900 |
| Renewal | Annual (free assessment) |
| Scope | National / Multi-state |
| Also known as | SC-900 |
Real questions
Frequently asked questions about the Microsoft Certified: Security, Compliance and Identity Fundamentals
Is SC-900 a good start for security?
Yes, it is the conceptual on-ramp to SC-200, SC-300 and SC-100.
Does it expire?
Yes, after 12 months; renew with a free online assessment.
How do I register for microsoft-sc-900?
You register and schedule microsoft-sc-900 through Pearson VUE / Certiport. Pick a test-centre appointment or online proctoring, then sit the exam on your booked date.
What is the microsoft-sc-900 exam format?
The exam is delivered as Multiple-choice, with about 40–60 items, in 45–60 minutes. The published pass mark is 700 of 1000.
How long is the microsoft-sc-900 certification valid?
Most Microsoft role-based certifications expire after 12 months but are renewed with a free online assessment; retired certs must be re-earned.
How much does microsoft-sc-900 cost?
The exam fee is $99. Optional study materials and retakes are priced separately.
Can I take a Microsoft exam online from home?
Yes. Exams are delivered by Pearson VUE with two options: an in-person test center or OnVUE online proctoring from a private space with a webcam. The fee is identical for both.
Do Microsoft certifications expire?
Most role-based, specialty, and fundamentals certifications are valid for 12 months. You renew for free by passing a shorter online assessment on Microsoft Learn before the expiry date.
What happens if my certification is retired?
You keep the credential until its current expiry date, but you can no longer earn or renew it. Microsoft typically points candidates to the active successor exam or certification.
In short
Is the Microsoft Certified: Security, Compliance and Identity Fundamentals worth it?
- SC-900 is the security/compliance entry cert.
- It covers Microsoft security basics.
- It renews yearly.
Same awarding body
What other credentials does Microsoft award?
Worth comparing
How does the Microsoft Certified: Security, Compliance and Identity Fundamentals compare with similar credentials?
Trust
Where does this information come from?
Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.
- Microsoft Awarding body
- Official Microsoft Certified: Security, Compliance and Identity Fundamentals exam page Exam page
- Microsoft certification programme Programme rules
Research confidence: high · Last reviewed 2026-08