Security, Compliance and Identity Fundamentals (SC-900)
Microsoft
Complete guide to passing the Security, Compliance and Identity Fundamentals (SC-900) exam on your first attempt.
$99
Not published
Does not expire
Global
Microsoft
$60k-$125k
Are you ready for Security, Compliance and Identity Fundamentals (SC-900)?
Loading quiz...
Complete Overview
The Microsoft Security, Compliance, and Identity Fundamentals exam, exam code SC-900, is a 45-minute proctored exam that tests foundational knowledge of security, compliance, and identity concepts and the Microsoft cloud services that implement them. Microsoft lists the price at $99 USD, with the final price set by the country or region in which the exam is proctored, and passing it earns the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification. Microsoft aims the exam at three groups: business stakeholders, new or existing IT professionals, and students. There is no formal prerequisite, although Microsoft says candidates should be familiar with Microsoft Azure and Microsoft 365. The exam is scored on a scale of 1 to 1,000 and a scaled score of 700 or greater passes. Microsoft describes 700 as a scaled score that may not equal 70 percent of the available points, because the cut score reflects the difficulty of the specific question set a candidate receives. Microsoft does not publish a fixed question count for SC-900. The published guidance is that most Microsoft certification exams contain between 40 and 60 questions. Exam time is 45 minutes and seat time is 65 minutes, with the extra 20 minutes covering the candidate agreement, instructions, and post-exam comments. Five minutes of break time are built into the exam clock, and the clock keeps running through any break taken. The skills measured outline last changed on July 28, 2026, and it splits into four areas: security, compliance, and identity concepts at 10 to 15 percent; Microsoft Entra capabilities at 25 to 30 percent; Microsoft security solutions at 35 to 40 percent; and Microsoft compliance solutions at 20 to 25 percent. The July 2026 refresh added agent ID to the Entra identity types objective and made minor edits to the access management, Azure infrastructure security, Sentinel, and Service Trust Portal objectives. SC-900 is a knowledge exam rather than a configuration exam. Every objective begins with the verb describe, so questions ask what a service does and when to reach for it, not how to configure it through the portal or PowerShell. Candidates sit the exam through Pearson VUE, either at a test center or online through OnVUE, and students and educators can also schedule through Certiport. Microsoft offers the exam in 13 languages: English, Japanese, Chinese (Simplified), Korean, French, Spanish, Portuguese (Brazil), Russian, Arabic (Saudi Arabia), Indonesian (Indonesia), German, Chinese (Traditional), and Italian. The certification does not expire. Microsoft requires annual renewal assessments for role-based certifications such as SC-200 and AZ-104, but fundamentals certifications carry no renewal requirement and no expiry date. Microsoft does not publish a pass rate for SC-900 or for any other certification exam. Candidates who fail can retake the exam 24 hours later, then must wait 14 days between each subsequent attempt, with a limit of five attempts in any 12-month period counted from the first attempt. The exam pairs naturally with AZ-900 for Azure platform fundamentals and MS-900 for Microsoft 365 fundamentals, and it is the usual starting point before the role-based SC-200 security operations analyst and SC-300 identity and access administrator exams.
Why Get Security, Compliance and Identity Fundamentals (SC-900) Certified?
The $99 USD fee is the entire cost of the credential, with no application fee, no membership fee, and no annual maintenance fee.
The certification does not expire, so it never needs the annual renewal assessment that Microsoft requires for role-based certifications.
45 minutes of exam time and a 65-minute seat booking make SC-900 the shortest Microsoft security exam to sit.
Microsoft publishes free learning paths and a free practice assessment for SC-900, so preparation can cost nothing beyond the exam fee.
The exam is delivered in 13 languages, and candidates testing outside those languages can request an extra 30 minutes.
35 to 40 percent of the exam covers Microsoft security solutions, which is the same Defender and Sentinel tooling used daily in security operations centers.
Results appear within minutes of finishing for exams without labs, and the score is posted to the Microsoft Learn profile within 24 hours.
Exam Format & Structure
Duration
45 minutes of exam time, 65 minutes of seat time
Questions
Not published. Microsoft states that most of its certification exams contain 40 to 60 questions
Passing Score
700 on a scale of 1 to 1,000
Question Types
- Multiple choice
- Multiple response
- Drag and drop
- Build list and reorder
- Hot area
- Active screen
- Yes or no statement sets
Delivery Method
Proctored by Pearson VUE, either at a test center or online through OnVUE. Students and educators can also schedule through Certiport
- Microsoft does not identify the specific question formats used on any given exam before test day. The list above combines the formats demonstrated in the public exam sandbox with the problem and solution statement sets Microsoft describes in its break policy, so treat it as the range of formats you may meet rather than a confirmed set.
- Access to Microsoft Learn during the exam is offered on role-based and expert exams only. It is not available on fundamentals exams such as SC-900.
- Five minutes of break time are built into the 45-minute clock. The clock keeps running during a break, and questions seen before the break cannot be revisited afterwards.
- Some questions are unscored pilot items used to gather statistics, and candidates are not told which ones.
- Candidates whose preferred language is not among the 13 offered can request an additional 30 minutes.
How scoring works
Score scale
1 to 1,000 scaled score
Score needed to pass
700
Roughly what that means raw
Not published. Microsoft states that 700 is a scaled score and may not equal 70 percent of the points available
When results arrive
Score and pass or fail status appear within minutes of finishing, and the result is posted to the Microsoft Learn profile within 24 hours. Exams containing labs take about 30 minutes longer to score, but SC-900 has no labs.
How the scale is built
Microsoft converts raw points to a scaled score so results stay comparable across different question sets. Subject matter experts review question difficulty against expected skill, so an easier set requires more raw points to reach 700 and a harder set requires fewer. Most multi-part questions award one point per correctly answered component, giving partial credit, and no points are deducted for wrong answers.
- Some items are unscored pilot questions collected for statistical review, and candidates are not told which ones, so every question should be answered as though it counts.
- The score report shows one overall numeric score, pass or fail status, and a bar chart of performance by skill area, with no per-section numeric score.
- Microsoft warns that bar lengths across sections cannot be combined to work out the overall result, because each section contains a different number of questions.
- Scoring zero in one skill area is possible without failing, because the smaller areas carry only a few questions.
Pacing and time budget
Not published. Microsoft states most of its exams contain 40 to 60 questions questions in 45 minutes gives you About 45 to 65 seconds per question if the exam is served at the 40 to 60 question range Microsoft describes per question.
| At this point | You should have answered |
|---|---|
| 10 min | About 25 percent of the questions in the exam |
| 20 min | About 50 percent of the questions in the exam |
| 30 min | About 75 percent of the questions in the exam |
| 40 min | Every question, leaving 5 minutes for marked items |
- Check the question count on the introductory screen at the start and divide 40 minutes by that number to get your real per-question budget.
- Drag and drop, build list, and hot area questions take longer than plain multiple choice, so bank time on the recall questions early.
- The 5 minutes of break time built into the clock come out of the same 45 minutes, so treat a break as time spent on questions.
- Mark for review rather than lingering; the review screen at the end lists everything marked or unanswered in one place.
- There is no penalty for a wrong answer, so guess anything still open when the clock reaches 43 minutes.
Where the marks are
| Topic | Weight | Why it scores |
|---|---|---|
| Microsoft Defender XDR product split and what each product protects | Part of the 35-40% Microsoft security solutions area | The Defender family has seven named products in the study guide and questions routinely present a scenario and ask which one applies. Learning the protected asset for each product converts a large block of questions into quick recall. |
| Microsoft Entra Conditional Access and access management | Part of the 25-30% Microsoft Entra area | Conditional Access is the mechanism behind most Zero Trust scenario questions. Knowing the signal, decision, and enforcement structure lets you answer both the Entra questions and the Zero Trust questions in the concepts area. |
| Microsoft Purview information protection and data lifecycle features | Part of the 20-25% Microsoft compliance solutions area | Sensitivity labels, DLP, retention, and records management appear in the same objective and are the features candidates most often confuse. A single comparison table covers a large share of the compliance questions. |
| Azure network security controls: NSG, Azure Firewall, WAF, DDoS Protection, Bastion | Part of the 35-40% Microsoft security solutions area | These five controls are listed individually in the study guide and are usually tested by scenario. Fixing the layer each one operates at removes the most common source of wrong answers in the largest skill area. |
| Entra identity protection and governance: PIM, access reviews, ID Protection | Part of the 25-30% Microsoft Entra area | One whole Entra objective covers governance, and the three features have distinct jobs: PIM elevates privilege temporarily, access reviews recertify existing access, and ID Protection scores risk. Questions reward telling them apart. |
| Zero Trust, shared responsibility, and defense in depth | Part of the 10-15% concepts area | These three models are vendor neutral, quick to learn, and reused as framing across the Entra and security questions. They are the highest return per hour of study on the exam. |
| SIEM and SOAR definitions and the Microsoft Sentinel workflow | Part of the 35-40% Microsoft security solutions area | Sentinel has its own objective and the exam tests the definitions directly. Learning the path from data connector to analytics rule to incident to playbook answers most Sentinel questions without any product experience. |
The numbers
$99 USD, priced by the country or region where the exam is proctored
Exam fee
Source: Microsoft Learn, Microsoft Certified: Security, Compliance, and Identity Fundamentals certification page
45 minutes of exam time, 65 minutes of seat time
Exam duration and seat time
Source: Microsoft Learn, Exam duration and exam experience
700 on a scale of 1 to 1,000
Passing score
Source: Microsoft Learn, Exam scoring and score reports
Not published for SC-900; Microsoft states most of its exams contain 40 to 60 questions
Question count
Source: Microsoft Learn, Exam duration and exam experience
July 28, 2026, adding agent ID to the Entra identity types objective
Skills measured last updated
Source: Microsoft Learn, Study guide for Exam SC-900 change log
Does not expire and requires no renewal assessment
Certification validity
Source: Microsoft Learn, Credential expiration policies
13 languages, with a 30-minute extension available if the exam is not offered in your language
Exam languages
Source: Microsoft Learn, SC-900 certification page and SC-900 study guide
If you fail
Wait before retaking
24 hours after the first failed attempt, then 14 days between every subsequent attempt
Attempt limit
Five attempts in any 12-month period, counted from the date of the first attempt. After five failures you become eligible again 12 months after that first attempt
Retake fee
Full price on each attempt, $99 USD in the United States, unless an Exam Replay voucher covers the retake
Microsoft waives the waiting period only where internet connectivity problems or equipment failure disrupted the exam and Pearson VUE opened a case; the waiver request must include the Pearson VUE case number. A passed exam cannot be retaken unless the certification has expired, which never applies to SC-900 because fundamentals certifications do not expire.
Exam Domains & Topics
The smallest area covers vendor-neutral theory that the other three areas build on. It tests the shared responsibility model, defense in depth, the Zero Trust model, encryption and hashing, and governance, risk, and compliance concepts. It then moves to identity fundamentals: identity as the primary security perimeter, the difference between authentication and authorization, identity providers, directory services, and federation.
Key Topics to Master:
- Shared responsibility model across IaaS, PaaS, and SaaS
- Defense in depth layers
- Zero Trust principles: verify explicitly, least privilege, assume breach
- Symmetric and asymmetric encryption, encryption at rest and in transit
- Hashing versus encryption and where each is used
- Governance, risk, and compliance (GRC) concepts
- Identity as the primary security perimeter
- Authentication versus authorization
- Identity providers, directory services, and Active Directory
- Federation and trust relationships
This area covers the Microsoft Entra identity platform. It tests the function of Microsoft Entra ID, the identity types it holds including agent ID, and hybrid identity. It then covers authentication methods and multifactor authentication, password protection, Conditional Access, Entra roles and role-based access control, and the governance features: Entra ID Governance, access reviews, Privileged Identity Management, and ID Protection.
Key Topics to Master:
- Microsoft Entra ID function and editions
- Identity types: users, workload identities, devices, groups, agent ID
- Hybrid identity and directory synchronization
- Authentication methods including passwordless, FIDO2, and Windows Hello
- Multifactor authentication and self-service password reset
- Password protection and banned password lists
- Conditional Access signals, decisions, and enforcement
- Entra built-in roles and role-based access control
- Entra ID Governance, entitlement management, and access reviews
- Privileged Identity Management just-in-time elevation
- Entra ID Protection risk detections, risky users, and risky sign-ins
The largest area covers Azure infrastructure security services, Azure security management, Microsoft Sentinel, and Microsoft Defender XDR. It tests DDoS Protection, Azure Firewall, Web Application Firewall, virtual network segmentation, network security groups, Azure Bastion, and Key Vault, then Defender for Cloud and cloud security posture management, SIEM and SOAR concepts in Sentinel, and each Defender XDR workload.
Key Topics to Master:
- Azure DDoS Protection tiers
- Azure Firewall and Web Application Firewall placement
- Virtual network segmentation and network security groups
- Azure Bastion for portal-based RDP and SSH
- Azure Key Vault for keys, secrets, and certificates
- Microsoft Defender for Cloud and secure score
- Cloud security posture management and cloud workload protection
- SIEM and SOAR definitions and how Sentinel delivers both
- Sentinel data connectors, workbooks, analytics rules, and playbooks
- Defender for Endpoint, Office 365, Identity, and Cloud Apps
- Defender Vulnerability Management and Defender Threat Intelligence
- The Microsoft Defender portal and incident view
This area covers the Service Trust Portal, Microsoft privacy principles, and Microsoft Purview. It tests the Purview portal, Compliance Manager and compliance score, data classification, Content explorer and Activity explorer, sensitivity labels and policies, data loss prevention, records management, retention policies and labels, insider risk management, eDiscovery, and audit.
Key Topics to Master:
- Service Trust Portal offerings and audit reports
- Microsoft privacy principles
- Microsoft Purview portal navigation
- Compliance Manager, improvement actions, and compliance score
- Data classification, trainable classifiers, and sensitive information types
- Content explorer versus Activity explorer
- Sensitivity labels and sensitivity label policies
- Data loss prevention policies and locations
- Records management and disposition review
- Retention policies, retention labels, and retention label policies
- Insider risk management policy templates
- eDiscovery and audit solutions in Purview
Recommended Study Plan
- 1Read the SC-900 study guide skills outline and copy the four weights into a tracker
- 2Complete the Microsoft Learn module on security and compliance concepts
- 3Write your own one-line definition of shared responsibility, defense in depth, and Zero Trust
- 4Build a two-column table separating authentication from authorization with three examples each
- 5Draw the difference between symmetric encryption, asymmetric encryption, and hashing
- 6Take the free practice assessment once to get a cold baseline score
- 1Complete the Microsoft Learn module on identity concepts and identity providers
- 2Map federation, directory services, and Active Directory onto one diagram
- 3Sign up for a free Microsoft Entra ID trial tenant and create three test users
- 4List the Entra identity types including agent ID and workload identities
- 5Compare cloud-only identity with hybrid identity and note when each applies
- 1Complete the Learn module on Entra authentication capabilities
- 2List every authentication method and mark which ones are passwordless
- 3Create a Conditional Access policy in report-only mode in your trial tenant
- 4Write out the signal, decision, and enforcement structure of a Conditional Access policy
- 5Assign a built-in Entra role to a test user and note what it grants
- 1Complete the Learn module on Entra identity protection and governance
- 2Distinguish access reviews, entitlement management, and lifecycle workflows
- 3Explain Privileged Identity Management just-in-time elevation in two sentences
- 4List the risk detections in Entra ID Protection and separate user risk from sign-in risk
- 5Retake the practice assessment and record the Entra score only
- 1Complete the Learn module on core Azure infrastructure security services
- 2Build a decision table for Azure Firewall, WAF, NSG, and DDoS Protection
- 3Deploy a network security group in a free Azure account and inspect the default rules
- 4Note why Azure Bastion removes the need for public IPs on virtual machines
- 5Compare Key Vault keys, secrets, and certificates and give one use case each
- 1Complete the Learn modules on Azure security management and Microsoft Sentinel
- 2Write definitions of SIEM and SOAR from memory and check them against the study guide
- 3Trace a Sentinel workflow from data connector to analytics rule to playbook
- 4Explain secure score and how recommendations raise it
- 5Separate cloud security posture management from cloud workload protection in one paragraph
- 1Complete the Learn module on threat protection with Microsoft Defender XDR
- 2Make a flashcard for each Defender product naming the asset it protects
- 3Note that Defender for Office 365 protects mail and collaboration, and Defender for Identity protects on-premises Active Directory
- 4Explore the Microsoft Defender portal incident queue in a trial tenant
- 5Separate Defender Vulnerability Management from Defender Threat Intelligence
- 1Complete the Learn modules on Purview compliance, information protection, and insider risk
- 2Build one table listing sensitivity labels, DLP, retention, records management, eDiscovery, and audit with a one-line job for each
- 3Open the Service Trust Portal and find one audit report for your region
- 4Retake the practice assessment until every skill area clears 85 percent
- 5Run the Microsoft exam sandbox to rehearse the interface and question navigation
- 6Book the exam and confirm the name on your certification profile matches your government ID exactly
Ready to pass Security, Compliance and Identity Fundamentals (SC-900)?
Get 500+ practice questions, video walkthroughs, and a pass guarantee.
Best Study Resources
Exam SC-900 study guide
Official documentMicrosoft's own skills measured outline with the four weighted areas, every sub-objective, and a change log comparing the current version against the version prior to July 28, 2026. Treat it as the definitive scope statement.
Free
SC-900 certification page on Microsoft Learn
Official pageLists the $99 USD price, the 45-minute exam duration, the 13 exam languages, the scheduling links for Pearson VUE and Certiport, and the accommodations request path.
Free
Microsoft Learn SC-900 learning paths
Self-paced trainingFour self-paced learning paths mapped to the four skill areas, with knowledge checks after each module. This is the training Microsoft itself points candidates to first, and it covers the full outline at no cost.
Free
SC-900 practice assessment
Practice testMicrosoft's own practice assessment, delivered through Microsoft Learn, showing the style, wording, and difficulty of exam questions. It reports per-objective results so weak areas are easy to find, and it can be retaken without limit.
Free
Microsoft exam sandbox
Interface demoA demonstration of the live exam interface with the same introductory screens, candidate agreement, question types, timer, and mark-for-review controls used in the real exam. Working through it removes interface surprises on test day.
Free
Microsoft Entra documentation
Product documentationReference documentation for Entra ID, Conditional Access, Privileged Identity Management, ID Protection, and ID Governance. Use it to settle any question the learning paths leave ambiguous about what a specific Entra feature does.
Free
Microsoft Purview documentation
Product documentationCovers sensitivity labels, data loss prevention, retention, records management, insider risk management, eDiscovery, and audit. The compliance area is 20 to 25 percent of SC-900 and Purview naming changes often, so read the current pages rather than older courses.
Free
Course SC-900T00-A: Microsoft Security, Compliance, and Identity Fundamentals
Instructor-led courseMicrosoft's official one-day instructor-led course delivered by Microsoft Learning Partners. Price is set by each partner rather than by Microsoft, and some employers cover it through existing training agreements.
Varies by training partner
Microsoft Learn free trial tenants
Hands-on labA Microsoft 365 developer or Azure free account gives access to the Entra admin center, the Defender portal, and the Purview portal. Seeing the blades in a live tenant makes the naming questions far easier to answer under time pressure.
Free
Common Mistakes to Avoid
Studying SC-900 as a configuration exam and memorising portal click paths and PowerShell cmdlets.
Every SC-900 objective starts with the verb describe. Learn what each service does and when to choose it. Save the configuration detail for SC-200 or SC-300.
Confusing the Microsoft Defender products, especially Defender for Identity with Microsoft Entra ID Protection.
Defender for Identity monitors on-premises Active Directory signals. Entra ID Protection scores risk on cloud identities and sign-ins. Write one flashcard per Defender product naming the asset it protects.
Treating Azure Firewall, network security groups, and Web Application Firewall as interchangeable network controls.
Network security groups filter traffic at the subnet and network interface level, Azure Firewall is a stateful managed firewall for the virtual network perimeter, and WAF protects web applications from OWASP-style attacks at layer 7.
Using a course recorded before the July 28, 2026 skills update and missing the agent ID identity type.
Check the change log at the bottom of the SC-900 study guide before trusting any third-party course, and read the current Entra documentation for identity types.
Assuming a scaled score of 700 means answering 70 percent of the questions correctly.
Microsoft states that 700 is a scaled score that may not equal 70 percent of the points, because the cut score adjusts for the difficulty of the specific question set. Aim well above 70 percent on practice assessments.
Mixing up the Purview features, particularly retention policies against records management and DLP against sensitivity labels.
Build one table: sensitivity labels classify and protect, DLP blocks risky sharing, retention keeps or deletes on a schedule, records management declares immutable records, eDiscovery finds content for legal matters, and audit logs who did what.
Registering with a work or school account and losing the exam records after leaving the employer.
Microsoft explicitly recommends registering with a personal Microsoft account. Records tied to an organisational account are unrecoverable once the account is removed.
Planning to look things up on Microsoft Learn during the exam.
Learn access inside the exam is available on role-based and expert exams only. Fundamentals exams including SC-900 do not have it, so every answer has to come from memory.
Taking a break mid-exam without answering the questions already on screen.
Once a break starts, questions seen before it cannot be revisited even if unanswered, and the exam clock keeps running. Answer and clear everything on screen before selecting the break icon.
Booking online proctoring on a locked-down work laptop and failing the system check on exam day.
Run Pearson VUE's system test on the exact machine and network you will use, ideally a personal computer with local administrative rights, several days before the appointment.
Exam Day Tips
- 1
Check in from 30 minutes before the appointment time; Pearson VUE allows check-in up to 15 minutes after it, and the launch process itself takes around 15 minutes.
- 2
Present a current government-issued photo ID whose name matches the name on your Microsoft certification profile exactly, because legal name-change and ID renewal forms are not accepted for online exams.
- 3
Clear the desk completely: books, notepads, sticky notes, printed papers, pens, and whiteboards must all be out of arm's reach for the room scan.
- 4
Unplug secondary monitors and turn off other computers in the room before the greeter reviews your workspace photos.
- 5
Keep a drink in a transparent spill-proof container if you want one, since a beverage needs no accommodation request but food and chewing gum are prohibited.
- 6
Spend the first two minutes reading the introductory screens rather than skipping them; they confirm the question count and time for the version you have been served.
- 7
Answer every question, because Microsoft applies no penalty for a wrong answer and unanswered items score zero.
- 8
Use mark for review on anything that takes more than 60 seconds and come back through the review screen at the end.
- 9
Read drag and drop and build list questions twice, since these carry a point per correctly placed component and partial credit is available.
- 10
Expect the score and pass or fail status within minutes of finishing, and expect the result in your Microsoft Learn profile within 24 hours.
Career Paths & Salary Ranges
IT support specialist moving into security tasks
Handles helpdesk tickets that increasingly involve MFA resets, Conditional Access lockouts, and phishing reports. SC-900 gives the vocabulary to escalate these correctly and is a common first certification for support staff moving toward security.
$60,340 median (BLS, computer user support specialists, May 2024)
Network support specialist
Maintains network infrastructure and increasingly touches Azure network security groups, Azure Firewall rules, and DDoS Protection. The Azure infrastructure security objectives in SC-900 map directly onto this work.
$73,340 median (BLS, computer network support specialists, May 2024)
Systems administrator with identity responsibility
Runs directory synchronisation, group management, and license assignment in Microsoft Entra ID. SC-900 covers the governance features these administrators are usually asked to turn on next: access reviews, PIM, and entitlement management.
$96,800 median (BLS, network and computer systems administrators, May 2024)
Compliance or governance analyst in an IT function
Owns data classification, retention schedules, and audit evidence inside Microsoft Purview. The compliance area of SC-900 is 20 to 25 percent of the exam and is the closest fit for anyone whose work is driven by regulation rather than incidents.
$103,790 median (BLS, computer systems analysts, May 2024)
Information security analyst
Investigates alerts in the Microsoft Defender portal and hunts in Microsoft Sentinel. SC-900 is the foundation layer here rather than the qualifying credential; the usual next step is the role-based SC-200 security operations analyst exam.
$124,910 median (BLS, information security analysts, May 2024)
Computer and information systems manager
Sets security and compliance direction and approves tooling spend. SC-900 is popular with managers and business stakeholders because it explains what each Microsoft security service buys without requiring hands-on configuration skill.
$171,200 median (BLS, computer and information systems managers, May 2024)
Prerequisites & Requirements
- No formal prerequisite. Microsoft sets no required exam, degree, or work experience for SC-900.
- Microsoft recommends familiarity with Microsoft Azure and Microsoft 365 before sitting the exam.
- General understanding of networking and cloud computing concepts helps with the Azure infrastructure security objectives.
- A Microsoft certification profile linked to a personal Microsoft account, with the profile name matching your government-issued photo ID exactly.
- For online proctoring, a computer that passes the Pearson VUE OnVUE system test, local administrative rights on that computer, and a walled room with a closed door.
- Candidates aged under 18 must review Microsoft's minimum age policy and the parental consent requirements before scheduling.
Frequently Asked Questions
How much does the SC-900 exam cost?
Microsoft lists SC-900 at $99 USD. The final price depends on the country or region in which the exam is proctored, and local taxes may be added at checkout by Pearson VUE. There is no separate application fee and no membership requirement.
How long is the SC-900 exam and how many questions does it have?
Exam time is 45 minutes and seat time is 65 minutes. Microsoft does not publish a question count for SC-900; the published guidance is that most Microsoft certification exams contain 40 to 60 questions and that the number varies by exam and can change as the exam is updated.
What score do I need to pass SC-900?
A scaled score of 700 or greater on a scale of 1 to 1,000 passes. Microsoft states that 700 is a scaled score and may not equal 70 percent of the available points, because the cut score reflects the difficulty of the question set served.
What happens if I fail SC-900?
You can retake the exam 24 hours after the first attempt. A 14-day waiting period applies between all subsequent attempts, and you may not take the exam more than five times in a 12-month period counted from the first attempt. Each attempt is paid separately.
Is there a retake fee?
Yes. Microsoft states that you must pay to retake the exam where a fee applies, so a second attempt costs the same $99 USD as the first unless you hold an Exam Replay voucher, which bundles an exam and one retake.
Can I get the waiting period waived after a failed attempt?
Only for a technical failure. Microsoft grants waiting-period waivers where a candidate had internet connectivity problems or equipment failure during the exam and a Pearson VUE case number was created. The case number must accompany the waiver request, and no other reason qualifies.
Does the SC-900 certification expire?
No. Microsoft fundamentals certifications do not expire and do not require a renewal assessment. This differs from Microsoft role-based certifications such as SC-200, SC-300, and AZ-104, which expire one year after they are earned and must be renewed through a free online assessment on Microsoft Learn.
Does the exam fee differ by region?
Yes. Microsoft states that the price is based on the country or region in which the exam is proctored, so the $99 USD figure applies to the United States and other regions are priced in local currency. The price shown on the Microsoft Learn certification page updates when you set your country.
What ID do I need on exam day?
A current government-issued photo ID. The name on the ID must exactly match the name on your Microsoft certification profile. Pearson VUE does not accept legal name-change forms or ID renewal forms for online proctored exams, so update the profile name before booking if they differ.
How does online proctoring work for SC-900?
Pearson VUE delivers the exam through the OnVUE platform. You run a system test in advance, check in from 30 minutes before the appointment, photograph your ID and workspace with a mobile phone, and a greeter verifies your identity and room scan before placing you in the proctor queue. A proctor then monitors you by webcam and microphone for the whole session.
What materials am I allowed during the exam?
None. Books, notepads, sticky notes, typed notes, pens, markers, and whiteboards must all be out of arm's reach, and hand-held devices, watches, bags, and head coverings are prohibited. A beverage in a transparent spill-proof container is permitted without an accommodation request.
Can I use Microsoft Learn during the exam?
No. Microsoft provides in-exam access to learn.microsoft.com on role-based and expert exams only. Fundamentals exams and GitHub exams do not include the Learn resource, so SC-900 is entirely closed book.
How do I request accommodations?
Request accommodations through Microsoft's accommodations page before scheduling the exam, not after. Microsoft supports assistive devices, extra time, and modifications to the exam experience, and assistive devices need prior approval because the secure browser blocks third-party applications during the exam.
Can I take a break during the exam?
Yes. Five minutes of break time are built into the exam clock and unscheduled breaks need no advance request. The exam clock keeps running throughout the break, and any question you have already seen cannot be revisited once the break starts, so answer everything on screen first.
When do I get my SC-900 result?
Within minutes of finishing. Microsoft reports results immediately for exams without labs, and SC-900 has none. The score also appears in your Microsoft Learn profile within 24 hours, together with a report showing the numeric score, pass or fail status, and a bar chart of performance by skill area.
Does the score report tell me which questions I got wrong?
No. Microsoft does not share which specific questions were answered incorrectly. The report gives one overall numeric score plus a bar chart of relative strength per skill area, and Microsoft warns that the bar lengths cannot be used to calculate how many questions you answered correctly.
What is the SC-900 pass rate?
Microsoft does not publish pass rates for SC-900 or for any other certification exam. Any pass rate figure quoted by a training provider is an estimate from its own students rather than a Microsoft statistic.
How does SC-900 compare with AZ-900 and SC-200?
AZ-900 covers Azure platform fundamentals including compute, storage, and pricing, while SC-900 covers security, compliance, and identity across both Azure and Microsoft 365. Both are 45-minute fundamentals exams priced at $99 USD that do not expire. SC-200 is the role-based next step: it tests hands-on threat mitigation with Defender XDR and Sentinel, runs 100 minutes, costs $165 USD, and expires after one year unless renewed.
Do I need to take SC-900 before SC-200 or SC-300?
No. Microsoft sets no prerequisite chain, so you can sit SC-200 or SC-300 without holding SC-900. Most candidates take SC-900 first because it introduces the Entra, Defender, Sentinel, and Purview vocabulary that the role-based exams assume you already know.
Are there discounted or free SC-900 vouchers?
Microsoft runs discount programmes including Exam Replay, which bundles an exam with one retake, and offers student pricing through Certiport for candidates scheduling as students or educators. Microsoft also periodically issues vouchers through Cloud Skills Challenge events and Microsoft Virtual Training Days.
Pass Security, Compliance and Identity Fundamentals (SC-900) — Guaranteed
94% pass rate on first attempt
One-time • Lifetime access
One-time payment
Security, Compliance and Identity Fundamentals (SC-900) Pass Rate
How hard is it? (Not published)
Failed Security, Compliance and Identity Fundamentals (SC-900)?
Recovery plan & retake policy
Study Timeline
Week-by-week study plan
Requirements
Prerequisites & registration
Compare Certifications
Side-by-side comparisons