Microsoft SC-900
Foundational coverage of the Microsoft security, compliance and identity portfolio — useful as the shared vocabulary in mixed technical/business rooms.
Updated
- Security, compliance and identity concepts: shared responsibility, defence-in-depth, Zero Trust
- Entra ID capabilities: authentication, Conditional Access, identity governance, PIM
- Microsoft security solutions: Azure infrastructure security, Defender XDR, Sentinel
- Microsoft Purview compliance capabilities: information protection, DLP, eDiscovery, Compliance Manager
Current exam scope
The current weighting leans heavily toward the product surface: Microsoft security solutions is the largest block at 35-40%, followed by Entra at 25-30%, Purview compliance capabilities at 20-25%, and core concepts at 10-15%. It's a fundamentals-level exam — no case studies, straight multiple choice — but it's the right level for a room with both engineers and non-technical stakeholders, which is where I use it most.
Related
Microsoft AZ-500
AZ-500 Azure Security Engineer: identity, platform protection, data and application security, and security operations in Azure.
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.