SC-900 · Domain 1 of 4

SC-900 Domain 1: Describe the concepts of security, compliance, and identity

The vocabulary domain of SC-900: who secures what in the cloud, layered defenses, Zero Trust principles, encryption versus hashing, governance, risk and compliance, and the identity ideas behind authentication, authorization, identity providers, directories and federation.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
3–5 hrs

About 11 min read Reviewed October 2026

Overview

Domain 1 is the conceptual base of SC-900, and Microsoft divides it into two functional groups. Security and compliance concepts cover the shared responsibility model, defense-in-depth, the Zero Trust model, encryption and hashing, and governance, risk and compliance (GRC). Identity concepts cover identity as the primary security perimeter, authentication, authorization, identity providers, directory services and Active Directory, and federation.

At 10–15% it is the smallest domain, but none of its terms are product names, so every later domain borrows them. Conditional Access applies Zero Trust, Key Vault stores encryption keys, and Purview turns GRC ideas into tooling. SC-900 remains an active Microsoft exam as of 31 October 2026, with skills measured updated on 21 October 2026 and no retirement or replacement announced, unlike AI-900 and MS-900.

How it's tested

Questions here are short and definitional. A statement or tiny scenario describes a principle, a responsibility split or an identity action, and you pick the concept it matches. Many items use a yes or no format across three statements, so one misunderstood word, such as reversible or least privilege, can cost several points at once.

  • Match the principle

    A described practice, such as checking every request or limiting standing access, is matched to a Zero Trust principle or to a defense-in-depth layer.

  • Who is responsible

    A service type is named, and you decide whether the customer or Microsoft owns a task such as patching, physical security or account protection.

  • Name the identity step

    An action like signing in, receiving a token or reading a file is matched to authentication, authorization, an identity provider or federation.

Reasoning it through

A statement says that a password stored as a hash can be converted back to the original password by the administrator. Hashing is a one-way function: it produces a fixed-length value that cannot be reversed, and the same input always yields the same hash. Encryption, in contrast, is reversible with the right key. The statement describes encryption, not hashing, so the correct response is No.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

1.1 Describe security and compliance conceptsShared responsibility, defense-in-depth, Zero Trust, encryption and hashing, and GRC.
What it means
This group covers the core ideas used to reason about protection in the cloud: how duties split between customer and provider, how layered controls slow an attacker, the Zero Trust model, the difference between encryption and hashing, and the meaning of governance, risk and compliance.
What to understand
In the shared responsibility model, on-premises means the customer owns everything; with IaaS, PaaS and SaaS more passes to Microsoft, but information, data, devices, accounts and identities always stay with the customer. Defense-in-depth stacks layers from physical security through identity, perimeter, network, compute and application to data. Zero Trust has three principles: verify explicitly, use least privilege access and assume breach, applied across identities, devices, applications, data, infrastructure and networks. Symmetric encryption uses one key, asymmetric uses a public and private key pair, and data is protected at rest and in transit. Hashing is one-way and often salted for passwords. GRC links governance rules, risk management and compliance with external obligations such as data residency, sovereignty and privacy.
How it shows up
Expect statements about responsibility splits, Zero Trust principles or whether a technique is reversible, often in a three-statement yes or no format.
Common confusion
Candidates often think the provider owns everything in SaaS; customers still own their data, devices, accounts and identities.
1.2 Define identity conceptsIdentity as perimeter, authentication, authorization, identity providers, directories and federation.
What it means
This group explains why identity has become the main control point, and defines the terms behind every sign-in: proving who you are, deciding what you can do, the service that issues tokens, the directory that stores accounts, and trust between separate organizations.
What to understand
With users working from any device and any network, the network edge no longer contains the organization, so identity becomes the primary perimeter. Its four pillars are administration, authentication, authorization and auditing. Authentication (AuthN) proves an identity, for example with a password plus a second factor. Authorization (AuthZ) decides the level of access an authenticated identity receives. A modern identity provider such as Microsoft Entra ID issues tokens using standards like OAuth 2.0, OpenID Connect and SAML, enabling single sign-on. A directory service such as Active Directory Domain Services stores users, groups and devices for on-premises networks. Federation creates trust between identity providers so users from one domain can reach resources in another without a separate account, and trust does not have to run in both directions.
How it shows up
You will be asked to pick authentication versus authorization, or to recognize federation and identity provider roles from a short scenario.
Common confusion
Authentication and authorization are often swapped; proving who you are always comes first, and access rights are granted afterward.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Shared responsibility model

    Division of security duties between Microsoft and the customer.

    Remember
    Data, devices, accounts and identities are always the customer's job.
    Tested as
    Appears in responsibility statement questions.
    Trap
    Assuming SaaS moves all responsibility to Microsoft.

  • Defense-in-depth

    Several layers of controls so one failure does not expose data.

    Remember
    Layers run from physical security to data.
    Tested as
    Layer-matching questions.
    Trap
    Treating it as a single product.

  • Zero Trust principles

    Verify explicitly, use least privilege access, assume breach.

    Remember
    Learn all three by name.
    Tested as
    Principle-matching statements.
    Trap
    Thinking Zero Trust means trusting the internal network.

  • Encryption

    Reversible transformation of data using keys.

    Remember
    Symmetric uses one key; asymmetric uses a key pair.
    Tested as
    At rest versus in transit statements.
    Trap
    Calling encryption one-way.

  • Hashing

    One-way function producing a fixed-length value.

    Remember
    Cannot be reversed; salting adds random data first.
    Tested as
    Password storage questions.
    Trap
    Believing a hash can be decrypted.

  • GRC

    Governance, risk and compliance as a combined discipline.

    Remember
    Compliance covers data residency, sovereignty and privacy.
    Tested as
    Definition questions.
    Trap
    Mixing up data residency with data sovereignty.

  • Authentication (AuthN)

    Proving that an identity is who it claims to be.

    Remember
    Happens before authorization.
    Tested as
    AuthN versus AuthZ items.
    Trap
    Calling permission checks authentication.

  • Authorization (AuthZ)

    Granting the right level of access to an authenticated identity.

    Remember
    Decides what you can do, not who you are.
    Tested as
    Access-level scenarios.
    Trap
    Thinking it verifies credentials.

  • Identity provider

    A service that authenticates users and issues tokens.

    Remember
    Microsoft Entra ID is a modern identity provider.
    Tested as
    Single sign-on and token questions.
    Trap
    Confusing it with a directory only.

  • Federation

    Trust between identity providers across organizations.

    Remember
    Trust can be one-way.
    Tested as
    Cross-organization access scenarios.
    Trap
    Assuming federation copies user accounts.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Encryption vs. hashing

ConceptMeaningKey differenceCommon trap
Symmetric encryption One shared key encrypts and decrypts Fast, but key sharing is the challenge Calling it a key pair method
Asymmetric encryption Public key and private key pair Public key encrypts, private key decrypts Thinking the public key must be secret
Hashing One-way fixed-length output Cannot be reversed to the input Treating it as decryptable

Authentication vs. authorization vs. federation

ConceptMeaningKey differenceCommon trap
Authentication Proves identity Answers who you are Confusing it with granting access
Authorization Grants access level Answers what you can do Placing it before sign-in
Federation Trust across identity providers Lets outside users reach resources Expecting duplicate accounts

Data residency vs. sovereignty vs. privacy

ConceptMeaningKey differenceCommon trap
Data residency Rules about where data physically lives Location focus Mixing it up with legal control
Data sovereignty Data is subject to the laws of the country where it is stored Legal jurisdiction focus Thinking it is only about storage location
Data privacy Transparency and consent over personal data use Rights of individuals Equating it with encryption

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. SaaS means no customer duty

    What candidates pick
    Mark a statement that Microsoft secures customer accounts in SaaS as Yes.
    Why it looks right
    SaaS moves most responsibilities to the provider.
    Why it's wrong
    Information, data, devices, accounts and identities stay with the customer in every cloud service type.

    Clue to watch for The statement mentions accounts, identities or data.

  2. Hash can be decrypted

    What candidates pick
    Agree that a stored hash can be turned back into the password.
    Why it looks right
    Both encryption and hashing scramble data.
    Why it's wrong
    Hashing is one-way; only encryption has a key that reverses the process.

    Clue to watch for The words reversed, decrypted or original value.

  3. Inside means trusted

    What candidates pick
    Pick a statement that Zero Trust allows trusted internal traffic.
    Why it looks right
    Classic perimeter security worked that way.
    Why it's wrong
    Zero Trust verifies every request explicitly regardless of where it originates.

    Clue to watch for Network location presented as proof of trust.

  4. AuthZ before AuthN

    What candidates pick
    Choose authorization for the step that checks a password.
    Why it looks right
    Both terms start with auth.
    Why it's wrong
    Checking credentials proves identity, which is authentication; permissions are evaluated afterward.

    Clue to watch for A password, fingerprint or code is being checked.

  5. Federation copies accounts

    What candidates pick
    Assume federation creates duplicate user accounts in the partner directory.
    Why it looks right
    Guest access sometimes involves objects in the resource tenant.
    Why it's wrong
    Federation relies on trust between identity providers so the home provider keeps authenticating the user.

    Clue to watch for Users sign in with their own organization's credentials.

Answer framework

Use these steps for any Domain 1 concept statement to land on the definition SC-900 expects.

  1. Identify the category first: responsibility, layered defense, Zero Trust, cryptography, GRC or identity, because each category has its own small vocabulary.
  2. For responsibility statements, remember the fixed rule that data, devices, accounts and identities always stay with the customer, whether the service is IaaS, PaaS or SaaS.
  3. For Zero Trust, test the statement against verify explicitly, least privilege access and assume breach; anything that trusts location fails.
  4. For cryptography, ask whether the process can be reversed with a key; reversible means encryption, one-way means hashing.
  5. For identity actions, order the steps: the identity provider authenticates, authorization grants access, and federation extends trust across organizations.

Practice question

A retailer moves its email to a software as a service offering from Microsoft. The security lead asks which responsibility the retailer still keeps under the shared responsibility model. Which responsibility remains with the retailer?

Want more like this? The SC-900 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Plan three to five hours for this domain and build a one-page glossary as you go. Write each term from the two functional groups with a single-sentence definition and one example, then test yourself by covering the definitions. Spend extra time on the pairs that sound alike: encryption and hashing, authentication and authorization, data residency and data sovereignty.

Draw the shared responsibility chart from memory until you can place every row for on-premises, IaaS, PaaS and SaaS. Then sketch the defense-in-depth layers as concentric rings and label a sample control in each one. For Zero Trust, memorize the three principles and practice classifying short statements against them.

The free Microsoft Learn path for SC-900 covers these ideas in its first module, and it is enough depth for this domain. Finish with yes or no style practice questions, because that format punishes half-learned definitions. Once these terms feel automatic, move to Domain 2, where Microsoft Entra turns the identity concepts into real features.

FAQ

How much of SC-900 is Domain 1, Describe the concepts of security, compliance, and identity?

Domain 1 carries 10–15% of the exam, the smallest share, with two functional groups: security and compliance concepts, and identity concepts.

Do I need to know encryption algorithms in detail?

No. SC-900 expects you to distinguish symmetric from asymmetric encryption, know data can be encrypted at rest and in transit, and recognize that hashing is one-way. Algorithm internals are out of scope.

What are the three Zero Trust principles?

Verify explicitly, use least privilege access and assume breach. Microsoft applies them across identities, devices, applications, data, infrastructure and networks.

Is SC-900 being retired like AI-900 or MS-900?

Not as of 31 October 2026. Microsoft updated the SC-900 skills measured on 21 October 2026 with only minor changes, and the exam is not on the retirement list.

What is the difference between a directory service and an identity provider?

A directory service, such as Active Directory Domain Services, stores and organizes identity objects. An identity provider authenticates users and issues tokens for applications. Microsoft Entra ID does both for cloud resources.

Does federation require a two-way trust?

No. Trust can be one-way, so one organization can accept identities from another without the reverse being true.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered shared responsibility, defense-in-depth, Zero Trust, cryptography, GRC and core identity terms. Check that you can classify short statements correctly before moving on.

Take the SC-900 practice test Check your SC-900 readiness

Keep going