Microsoft Security, Compliance, and Identity Fundamentals (SC-900): 5 Must-Know Concepts

The Microsoft Security, Compliance, and Identity Fundamentals exam (SC-900) validates foundational knowledge of security, compliance, and identity across Microsoft cloud services. These five concepts cover the SC-900 outline.

1. Security, Compliance, and Identity Concepts#

Understanding fundamental security concepts makes up 10-15% of the SC-900 exam — but these principles underpin everything else.

Zero Trust Model#

Zero Trust is the modern security paradigm that Microsoft recommends. The core principles are:

Shared Responsibility Model#

Security responsibilities are shared between Microsoft and the customer, varying by service type:

Defense in Depth#

Defense in depth uses multiple layers of security to slow down attacks and provide alerts:

Physical Security → Identity & Access → Perimeter → Network → Compute → Application → Data

• Physical — Datacenter security (Microsoft's responsibility)
• Identity & Access — Authentication, Conditional Access
• Perimeter — DDoS protection, firewalls
• Network — Network segmentation, NSGs
• Compute — Secure VMs, endpoint protection
• Application — Secure code, vulnerability scanning
• Data — Encryption at rest and in transit

Test Your Understanding#

2. Microsoft Entra Capabilities#

Microsoft Entra (formerly Azure AD) is the cloud-based identity and access management service. This domain covers 25-30% of the exam.

Microsoft Entra ID Editions#

Authentication Methods#

Microsoft Entra supports multiple authentication methods:

• Passwords — Traditional but least secure
• Windows Hello for Business — Biometric or PIN authentication
• FIDO2 Security Keys — Passwordless hardware tokens
• Microsoft Authenticator — Phone-based push notifications or TOTP codes
• SMS/Voice — Phone-based one-time codes (less secure)
• Certificate-based authentication — Smart cards and certificates

Conditional Access#

Conditional Access policies are the if-then engine for access decisions:

External Identities#

Microsoft Entra supports various external identity scenarios:

• B2B collaboration — Invite external users to access your apps using their own credentials
• B2B direct connect — Mutual trust for real-time collaboration (Teams Connect)
• B2C — Customer-facing identity for consumer applications

3. Microsoft Security Solutions#

Microsoft's security solutions protect identity, devices, cloud workloads, and data. This is the largest domain at 35-40% of the exam.

Microsoft Defender Suite#

Microsoft offers multiple Defender products for different protection areas:

Microsoft Sentinel#

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution.

Key capabilities:

• Collect — Ingest data from Azure, Microsoft 365, on-premises, and third-party sources
• Detect — Use built-in analytics rules and machine learning for threat detection
• Investigate — Interactive investigation graphs and hunting queries
• Respond — Automated playbooks using Azure Logic Apps

Microsoft Defender for Cloud#

Defender for Cloud provides two major capabilities:

1. Cloud Security Posture Management (CSPM)

   • Secure Score to measure security posture
   • Security recommendations for misconfigurations
   • Multi-cloud support (Azure, AWS, GCP)

2. Cloud Workload Protection (CWP)

   • Defender plans for VMs, containers, databases, storage, and more
   • Vulnerability assessment
   • Adaptive application controls

4. Microsoft Compliance Solutions#

Microsoft Purview (formerly Microsoft Compliance) provides data governance, risk management, and compliance capabilities. This covers 20-25% of the exam.

Microsoft Purview Overview#

Microsoft Purview is the unified data governance and compliance solution:

Data Loss Prevention (DLP)#

DLP policies help prevent unintentional sharing of sensitive information:

• Where to protect — Exchange, SharePoint, OneDrive, Teams, endpoints, Power BI
• What to protect — Sensitive information types (SSN, credit cards, custom patterns)
• How to protect — Block, require justification, encrypt, notify users

Compliance Manager#

Compliance Manager helps organizations:

• Assess compliance posture against 300+ regulations and standards
• Track improvement actions with scores
• Generate compliance reports for auditors

Key terms:

• Compliance Score — Overall compliance posture (higher is better)
• Assessments — Evaluations against specific regulations (GDPR, HIPAA, etc.)
• Improvement Actions — Recommended steps to improve compliance

5. Identity Governance and Protection#

Understanding how to govern access and protect identities is crucial for the SC-900 exam.

Microsoft Entra Identity Governance#

Identity governance capabilities help manage the identity lifecycle:

Microsoft Entra Permissions Management#

This is a Cloud Infrastructure Entitlement Management (CIEM) solution:

• Discover excessive permissions across Azure, AWS, and GCP
• Right-size permissions to enforce least privilege
• Monitor permission usage and anomalies

Microsoft Entra Verified ID#

Verified ID provides decentralized identity credentials:

• Issue verifiable credentials (like digital employee badges)
• Users store credentials in their Microsoft Authenticator
• Third parties can verify credentials without contacting the issuer

---

Know your range before test day#

SC-900 spans security, compliance, and identity. Sit a short diagnostic to see which pillar still needs drills before test day.

• Timed diagnostic with domain-level breakdown
• Clear signal on what to drill next
• Practice free; timed sittings and readiness range on Pro

Take the free SC-900 assessment →

---

Next step: Start practicing free on the SC-900 hub, or sit a short diagnostic first.