SC-900 study guide · 2026

The 4 SC-900 domains, explained

4 domains and 14 official functional groups. Describe the capabilities of Microsoft security solutions carries the most weight at 35–40%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
Not published
Time
45 minutes
Passing score
700 / 1000
Outline
SC-900 study guide, skills measured as of October 21, 2026 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 10–15%
  2. 2 25–30%
  3. 3 35–40%
  4. 4 20–25%
  1. 1 Describe the concepts of security, compliance, and identity
  2. 2 Describe the capabilities of Microsoft Entra
  3. 3 Describe the capabilities of Microsoft security solutions
  4. 4 Describe the capabilities of Microsoft compliance solutions

All 4 domains

14 official functional groups 22–34 hrs suggested study

  1. Domain 01 10–15%

    Describe the concepts of security, compliance, and identity

    The vocabulary domain of SC-900: who secures what in the cloud, layered defenses, Zero Trust principles, encryption versus hashing, governance, risk and compliance, and the identity ideas behind authentication, authorization, identity providers, directories and federation.

    Inside this domain

    • Describe security and compliance concepts
    • Define identity concepts

    Watch for SaaS means no customer duty

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    3–5 hrs
  2. Domain 02 25–30%

    Describe the capabilities of Microsoft Entra

    The identity domain of SC-900: what Microsoft Entra ID is and the identity types it holds, hybrid identity, authentication methods and MFA, password protection, Conditional Access, Entra roles and RBAC, and the governance and protection features built on top.

    Inside this domain

    • Describe function and identity types of Microsoft Entra ID
    • Describe authentication capabilities of Microsoft Entra ID
    • Describe access management capabilities of Microsoft Entra ID
    • Describe identity protection and governance capabilities of Microsoft Entra

    Watch for Reviews grant access

    Functional groups
    4
    Questions est.
    ~14
    Study time est.
    6–9 hrs
  3. Domain 03 35–40%

    Describe the capabilities of Microsoft security solutions

    The largest SC-900 domain: Azure infrastructure security services, Microsoft Defender for Cloud and posture management, Microsoft Sentinel as SIEM and SOAR, and the Microsoft Defender XDR family that protects email, endpoints, cloud apps and identities.

    Inside this domain

    • Describe core infrastructure security services in Azure
    • Describe security management capabilities of Azure
    • Describe capabilities of Microsoft Sentinel
    • Describe threat protection with Microsoft Defender XDR

    Watch for Cloud versus Cloud Apps

    Functional groups
    4
    Questions est.
    ~19
    Study time est.
    8–12 hrs
  4. Domain 04 20–25%

    Describe the capabilities of Microsoft compliance solutions

    The compliance domain of SC-900: the Service Trust Portal and Microsoft's privacy principles, the Microsoft Purview portal and Compliance Manager, data classification, sensitivity labels, DLP, retention and records management, insider risk, eDiscovery and audit.

    Inside this domain

    • Describe Microsoft Service Trust Portal and privacy principles
    • Describe compliance management capabilities of Microsoft Purview
    • Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview
    • Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview

    Watch for Labels for retention

    Functional groups
    4
    Questions est.
    ~11
    Study time est.
    5–8 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 22–34 hrs of study.

  1. 3 Describe the capabilities of Microsoft security solutions 35–40% · 8–12 hrs
  2. 2 Describe the capabilities of Microsoft Entra 25–30% · 6–9 hrs
  3. 4 Describe the capabilities of Microsoft compliance solutions 20–25% · 5–8 hrs
  4. 1 Describe the concepts of security, compliance, and identity 10–15% · 3–5 hrs

Try one

Practice questionDomain 3: Describe the capabilities of Microsoft security solutions

A security team needs to collect logs from Microsoft 365, Azure resources and a third-party firewall, correlate them to detect attacks, and automatically disable a user account when a specific incident is created. Which Microsoft service best meets these requirements?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    SaaS means no customer duty

    Clue The statement mentions accounts, identities or data.

  • Domain 2

    Reviews grant access

    Clue Words such as activate, approve or for two hours.

  • Domain 3

    Cloud versus Cloud Apps

    Clue Unsanctioned apps, SaaS usage or session control.

  • Domain 4

    Labels for retention

    Clue A time period such as years or months.

Other Cybersecurity certifications

Study guides for exams that overlap with SC-900.

Practise what you read

SC-900 domains: common questions

How many domains are in the SC-900 exam?

SC-900 has 4 domains with 14 official functional groups between them: Describe the concepts of security, compliance, and identity, Describe the capabilities of Microsoft Entra, Describe the capabilities of Microsoft security solutions and Describe the capabilities of Microsoft compliance solutions.

Which SC-900 domain carries the most weight?

Describe the capabilities of Microsoft security solutions is the heaviest at 35–40%, followed by Describe the capabilities of Microsoft Entra (25–30%). The lightest is Describe the concepts of security, compliance, and identity (10–15%). Weights come from Microsoft's official outline.

What is the SC-900 exam format?

Questions: Not published. Time allowed: 45 minutes. Passing score: 700 / 1000.

How long should I study for SC-900?

Our planning estimate is 22–34 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Describe the capabilities of Microsoft security solutions, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows SC-900 study guide, skills measured as of October 21, 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (SC-900 study guide, skills measured as of October 21, 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.