SC-900: Security, Compliance, and Identity Fundamentals

Before choosing a specialized cybersecurity role, it helps to understand the language that security architects, identity administrators, analysts, and compliance teams use every day. SC-900, Microsoft Security, Compliance, and Identity Fundamentals, introduces those concepts across Microsoft cloud services. It is an active fundamentals exam in October 2026, with Microsoft indicating that its English objectives will be updated later in the month. It should be treated as a broad conceptual credential rather than proof of advanced hands-on security engineering.

SC-900 is valuable because security controls are connected. An identity can authenticate successfully yet be over-privileged; encrypted data can still be inappropriately shared; an alert can signal suspicious behavior without proving a breach; and a compliant record-retention policy can still fail if its scope is wrong. The exam helps learners distinguish these situations and recognize the Microsoft service families used to address them. Understanding the underlying security purpose is more important than memorizing a current menu layout.

Core principles of security and shared responsibility

Confidentiality, integrity, and availability provide a useful starting model. Confidentiality concerns who may see information, integrity whether it remains accurate and protected from unauthorized modification, and availability whether authorized users can access the service when needed. Controls can support one objective while introducing trade-offs elsewhere. Strict access rules may improve confidentiality but interrupt operations if deployed without recovery paths. Reliable backup and disaster recovery may improve availability while creating additional copies of sensitive data that must be protected.

The shared-responsibility model describes how cloud providers and customers divide security obligations. Microsoft operates many underlying cloud services, but customers generally remain responsible for their identities, access decisions, information classification, and many aspects of tenant configuration. The exact split depends on the service model. Moving an application to the cloud does not mean the organization can stop reviewing permissions, securing endpoints, or responding to phishing attacks.

Defense in depth means designing multiple protective layers rather than depending on one mechanism. A secure application can combine multifactor authentication, least-privilege permissions, network restrictions, data protection, logging, and incident response. Zero Trust adds the expectation that access should be evaluated based on context and not granted merely because a request appears to originate from an internal network. These principles provide the rationale for the Microsoft security capabilities introduced throughout SC-900.

Microsoft Entra and identity security

Microsoft Entra ID supplies identity services used across many Microsoft cloud workloads. Users, groups, applications, and devices can all participate in access decisions. Authentication methods determine how a user proves identity, while authorization controls the actions permitted afterward. The distinction matters: a correctly authenticated employee should not automatically gain access to confidential financial records. Role-based access control limits administrative or resource permissions according to responsibility.

Multifactor authentication and passwordless methods can reduce reliance on passwords, but secure deployment requires enrollment and account recovery. Conditional Access supports context-aware decisions involving conditions such as device state or risk. The capabilities explained in Microsoft Entra Conditional Access help illustrate why an access request can be allowed, challenged, or blocked without changing the user's underlying identity. Fundamentals candidates should recognize these ideas without assuming they can administer every advanced policy correctly.

Identity governance addresses access over time. New employees need appropriate permissions; people changing jobs should lose obsolete entitlements; partners should not retain access indefinitely after a project ends. Administrative identities require particular care because broad permissions can increase the impact of compromise. Readers whose duties include implementing these controls can progress toward SC-300, where the depth of identity administration is substantially greater.

Threat protection and security operations

Microsoft Defender products cover different aspects of threat detection and protection across supported endpoints, identities, cloud resources, email, and applications. A fundamentals candidate should understand the difference between reducing exposure, detecting suspicious behavior, and responding to an incident. A vulnerability recommendation is not the same thing as an observed attack, and an alert is not automatically proof that data was stolen. Investigations depend on multiple sources of evidence and suitable business context.

Microsoft Sentinel is a security information and event management capability that can bring together security data, analytics, investigations, and response workflows. Organizations use these capabilities to detect suspicious patterns and coordinate action. A security operations center also needs processes for triage, escalation, incident documentation, and learning after an event. Without those practices, even a technically powerful platform can produce more noise than useful protection.

Cloud security posture management helps teams recognize risky configurations, but recommendations need prioritization. An exposed service containing highly sensitive data may be more urgent than several low-impact findings elsewhere. The security operations focus of SC-200 expands on detecting, investigating, and responding to threats. SC-900 introduces the purpose of such work and the major service categories involved, not every query language or incident-response procedure used by specialists.

Microsoft Purview and information governance

Compliance and data security overlap but ask different questions. Security seeks to protect information against inappropriate access and alteration; compliance addresses obligations such as retention, records handling, regulatory controls, and defensible processes. Microsoft Purview provides capabilities related to information protection, data loss prevention, audit, retention, and associated governance functions. The specific feature and license required depend on the organization's environment and needs.

Sensitivity labels communicate how information should be handled and can apply technical protections where supported. Data loss prevention policies can help detect or restrict risky movement of sensitive content. Retention controls preserve or delete information according to defined rules. These functions should operate from a documented classification and policy scheme rather than arbitrary assumptions about what must be protected. Microsoft Purview data governance and information protection provides a deeper conceptual relationship for understanding how classification becomes an enforceable process.

Insider risk, eDiscovery, audit, and related activities also have governance and privacy implications. An organization needs appropriate authorization for investigation and rules about who can inspect sensitive records. A tool that enables investigation does not automatically justify unlimited collection or access. SC-900 candidates should appreciate the role of policy owners, legal stakeholders, and compliance teams in setting the purpose and boundaries of these controls.

Modern risks across cloud and AI services

As organizations introduce AI assistants and automated agents, the same security foundations become more important. An assistant that can retrieve documents must respect access boundaries; one that can perform actions needs suitable authorization and logging. Data classification and oversharing cannot be solved solely by applying an AI-specific filter after the fact. This is a useful example of how identity, information protection, and application security converge even though their operational specialists may belong to different teams.

SC-900 does not require the implementation depth of the active SC-500 cloud and AI security engineering examination or the strategic design breadth of SC-100. Its strength is helping candidates make distinctions. Is the scenario about who signs in, what they can do, how information is classified, whether suspicious behavior is detected, or what evidence must be preserved? That classification often reveals the relevant service family and the next question to investigate.

A useful way to compare security tools is to ask what each control can and cannot establish. Multifactor authentication increases confidence that the person signing in possesses additional proof, but it does not guarantee that the device is healthy or that the requested data access is appropriate. Conditional Access can use context such as device state, user risk, and application sensitivity, but an administrator still has to define exceptions and recovery paths. Encryption can make stored information harder to read without permission, yet an authorized user may still disclose it accidentally. These are separate risk-reduction mechanisms, and the exam expects candidates to recognize their functions without treating one feature as universal protection.

The same distinction applies to cloud security responsibilities. A software-as-a-service provider manages portions of the infrastructure and service operation, while the customer remains responsible for decisions about identities, information classification, granted permissions, and many configuration choices. That division can vary across SaaS, platform services, and infrastructure services. A good scenario question might describe an employee sharing a confidential document too broadly. The relevant response begins with the organization's sharing and information-protection configuration, not an assumption that the cloud provider will automatically prevent every misuse of an authorized feature.

Identity lifecycle offers another practical example. Creating a guest account may make collaboration possible quickly, but long-term control requires an assigned sponsor, periodic review, and eventual removal when access is no longer justified. Similarly, privileged roles should be limited and monitored; granting permanent administrator privileges to simplify a single task exposes more of the tenant than necessary. The connection between identity administration, auditing, and information protection is a recurring theme across Microsoft security services.

For conceptual practice, build a small matrix of events rather than memorize product slogans: a risky sign-in, a malicious email, an unpatched endpoint, a confidential file sent externally, a suspicious cloud workload, and a retention dispute. Identify what kind of evidence would help, which product family addresses the risk, and what decision still belongs to a responsible human. The purpose is to see how identity, threat protection, compliance, and cloud controls complement each other.

Practicing fundamentals through scenarios

A useful preparation exercise starts with a small organization that has remote employees, Microsoft 365 collaboration, an Azure application, and sensitive customer records. Identify its key information, the identities that need access, likely threats, and basic control choices. Explain where multifactor authentication belongs, why administrator roles should be restricted, what information protection may be necessary, and which logs could help investigate a suspicious event. The exercise should show causal understanding, not just the ability to recall product names.

Candidates should confirm official SC-900 objectives for the date of their examination because Microsoft has announced an October 2026 update. Older practice materials may remain conceptually useful while containing outdated branding or specific feature claims. The strongest foundation is an ability to explain why a control exists, the risk it addresses, and the difference between closely related security, identity, and compliance concepts.