SC-900: security, identity, and operational decisions

Objectives and progression

Six lessons, 32 questions, and four fictional cases connect security concepts to project and support decisions. Questions across the four domains: 4/9/12/7. Internal assessment of 22 decisions in 40 minutes. The objectives applicable since 2026-07-28 were fully compared using indexed text of the official guide. The live page already presents future objectives for 2026-10-21. This path distinguishes the dates, includes agent identities and threat-intelligence context, and provides initial guided coverage without promising a complete exam simulator.

Audience: IT professionals, application support, project managers, and learners starting Microsoft security.

Prerequisites: Basic cloud, account, networking, and application concepts; introductory familiarity with Azure and Microsoft 365. No prior credential is required to follow this path.

230 estimated study minutes

• Distinguish responsibilities, authentication, and authorization.
• Choose Entra controls for access and privileges.
• Connect network protection, posture, detection, and response.
• Interpret classification, DLP, retention, and compliance evidence.

Modules

1. Responsibilities, identity, and risk
2. Entra: access and privileges
3. Infrastructure protection
4. Posture, detection, and response
5. Classification, DLP, and retention
6. Evidence, investigation, and compliance

Continue learning

Microsoft Azure

• AZ-900 — Azure Fundamentals
• CompTIA Security+
• Production Support L3

References and version

SC-900 objectives 2026-07-28; October 2026 update announced

• SC-900 certification and delivery · 2026-09-30
• SC-900 study guide · 2026-09-30
• Microsoft exam scoring · 2026-09-30
• Cloud shared responsibility · 2026-09-30
• Zero Trust foundation · 2026-09-30
• Cryptographic services · 2026-09-30
• Identity and access concepts · 2026-09-30
• Conditional Access · 2026-09-30
• Privileged Identity Management · 2026-09-30
• Azure and Entra role boundaries · 2026-09-30
• Access reviews · 2026-09-30
• Identity Protection · 2026-09-30
• Managed identities · 2026-09-30
• Azure WAF · 2026-09-30
• Azure Bastion · 2026-09-30
• Network security groups · 2026-09-30
• Azure Firewall · 2026-09-30
• Azure DDoS Protection · 2026-09-30
• Azure Key Vault · 2026-09-30
• Defender for Cloud · 2026-09-30
• Microsoft Sentinel · 2026-09-30
• Microsoft Defender XDR · 2026-09-30
• Sensitivity labels · 2026-09-30
• Data loss prevention · 2026-09-30
• Retention policies and labels · 2026-09-30
• Compliance Manager · 2026-09-30
• Compliance Manager scoring · 2026-09-30
• Service Trust Portal · 2026-09-30
• Microsoft Purview eDiscovery · 2026-09-30
• Purview Audit · 2026-09-30
• Insider Risk Management · 2026-09-30
• Managing Microsoft Entra agent identities · 2026-10-01
• Agent identity blueprints · 2026-10-01
• Threat intelligence in Microsoft Defender · 2026-10-01
• Defender Vulnerability Management · 2026-10-01