Microsoft Certified: Security, Compliance, and Identity Fundamentals Study Guide

Preparing for SC-900? You are in the right place. This is the written companion to the practice exams: a complete walk through everything the Security, Compliance, and Identity Fundamentals exam covers, gathered in one place.

SC-900 is a fundamentals exam, and it rewards a particular kind of thinking. It cares far less about how you configure a service than about knowing what each one is for and which one you would reach for. Much of the difficulty is telling look-alikes apart. Microsoft Defender for Cloud checks whether your infrastructure is configured securely, while Defender XDR watches endpoints and mailboxes for an attack already under way. The Service Trust Portal is where you download Microsoft's own audit reports, while the Microsoft Purview portal is where you assess your own tenant's compliance. When two answers both look plausible, the exam turns on picking the tool built for that one job.

The guide follows the four official domains, weighted the way the real exam weights them: core concepts (10 to 15 percent), Microsoft Entra (25 to 30 percent), security solutions (35 to 40 percent), and compliance solutions (20 to 25 percent). Each chapter builds the mental model in plain language, separates the look-alike options with comparison tables and decision trees, and closes with a cheat sheet. Start at the top, or pick a domain from the list beside this page.