Security, Compliance and Identity Fundamentals study guide

Learn it in this order

Concepts first, products second. The exam describes a need before it names a tool, so the order below builds the language you need to recognise the need at all.

• Days 1 to 3. The concepts: the shared responsibility model, defence in depth, Zero Trust, and the difference between authentication and authorisation. Short, and everything else leans on it.
• Days 3 to 8. Microsoft Entra. Identity types, authentication methods, multifactor authentication, Conditional Access at the level of what it is for, and what a role does. The second largest share.
• Days 8 to 14. The Microsoft security solutions. Defender XDR and what each Defender product watches, Microsoft Sentinel at the level of what a SIEM is for, and Defender for Cloud. The largest share.
• Days 14 to 18. Microsoft Purview. Sensitivity labels, data loss prevention, retention, insider risk and eDiscovery, again at the level of which one you would reach for.
• Days 18 onwards. Practice tests, then return to whichever area scored worst.

The whole exam is one question asked forty times

Strip the scenarios away and most of SC-900 is asking you to match a job to a product. The confusions below are the ones the exam is built out of, because they are the pairs where people guess.

• Entra ID Protection against Conditional Access. One scores the risk, the other decides what happens about it.
• Defender for Office 365 against Defender for Cloud Apps. Mail and collaboration, against the cloud apps people sign into.
• Defender for Identity against Entra ID Protection. On-premises Active Directory signals, against cloud identity risk.
• Sentinel against Defender XDR. One collects from everything including things Microsoft did not make, the other is the Microsoft estate correlated for you.
• Sensitivity labels against retention labels. What may be done with a document, against how long it lives.
• Data loss prevention against insider risk management. Stopping a specific action, against noticing a pattern of behaviour.

Where people lose marks

The failures on this exam are rarely about depth. They are about reading.

• Answering with the product you use at work rather than the one the question describes. The exam does not know your tenant.
• Choosing the most capable product instead of the correct one. Sentinel can technically see almost anything, and it is still the wrong answer when the question describes a mailbox problem.
• Treating a licence question as a capability question. SC-900 does occasionally care which plan a feature sits in, and guessing upward is a reliable way to be wrong.
• Overreading. A fundamentals question that looks like it has a trick in it usually does not.

What the exam weights, and what that means for your time

Published weightings, taken literally. Security solutions and Entra together are about two thirds of the paper, and the concepts section is the smallest thing on it despite being the part every other answer depends on.

Read the concepts properly anyway. They are 10 to 15% of the marks and close to 100% of your ability to parse the rest.

• Security, compliance and identity concepts, 10 to 15%. Shared responsibility, defence in depth, Zero Trust, encryption, and what identity means.
• Microsoft Entra capabilities, 25 to 30%. Identity types, authentication methods, Conditional Access, roles, governance and protection.
• Microsoft security solutions, 35 to 40%. Azure infrastructure security, Defender for Cloud, Sentinel, and the Defender XDR services.
• Microsoft compliance solutions, 20 to 25%. Service Trust Portal, Purview, information protection, data lifecycle and insider risk.

What to do instead of a lab

You do not need to build anything for SC-900, and a lab is a poor use of the two weeks. What helps is looking at the surfaces so the names stop being abstract.

• Open the Microsoft Entra admin centre and find where users, authentication methods and Conditional Access live. Change nothing.
• Open the Defender portal and look at the incident list. Notice that it is one queue across several products.
• Open the Purview portal and find the difference between the labels area and the data loss prevention area.
• If you have no tenant, a 30-day Microsoft 365 trial covers all three. Do not plan around the Microsoft 365 Developer Program: as of 1 October 2026 its eligibility runs through a paid Visual Studio subscription, partner programme membership or a support contract, so it is not an open sign-up any more.

How to use practice tests alongside this

Sit a test before you study anything. On a fundamentals exam that first score is unusually informative, because it separates the parts you genuinely do not know from the parts you know under a different name.

Then study, and retest by area rather than by whole paper. The breakdown is the useful output, not the percentage.