SC-900 is Microsoft Security, Compliance, and Identity Fundamentals. It is a beginner-level exam that earns the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification. It costs $99 in the United States, has no prerequisite, and is not retired: its certification page carries no retirement notice.

Is SC-900 changing in July 2026?

Yes, but far less than prep sites imply. A new SC-900 objectives version takes effect on July 28, 2026. Microsoft's own change log marks every functional group as No change and every affected sub-skill as Minor. No domain was renamed, added or removed, and no weight moved. Your study plan does not need to change.

What are the SC-900 domain weights?

Four domains. Describe the capabilities of Microsoft security solutions is the largest at 35 to 40 percent. Describe the capabilities of Microsoft Entra is 25 to 30 percent. Describe the capabilities of Microsoft compliance solutions is 20 to 25 percent. Describe the concepts of security, compliance, and identity is the smallest at 10 to 15 percent.

How much does the SC-900 exam cost?

$99 USD in the United States, confirmed in Microsoft's own published exam pricing feed. That is the standard fundamentals price, the same as AZ-900 and DP-900. Price varies by the country or region in which the exam is proctored, and tax may be added at checkout.

How many questions are on the SC-900 exam and how long is it?

Microsoft publishes no question count for SC-900, and it does not print a duration on the SC-900 exam page at all. Its general guidance is that most exams contain 40 to 60 questions, and its exam-type table gives fundamentals exams 45 minutes of exam time within 65 minutes of seat time. Any site quoting an exact SC-900 question count invented it.

Does SC-900 cover Copilot?

No. The word Copilot appears zero times in SC-900's skills outline. The retired MS-900 outline mentioned Copilot five times. SC-900 does now examine agent identity: one bullet reads Describe types of identities, including agent ID, which is the exam's only agent reference.

It is the cheapest credible entry point into Microsoft security at $99, and unlike MS-900 it is still live. It is a describe-level exam, so it proves vocabulary rather than hands-on skill. Most people use it as a stepping stone to SC-200 or SC-300, both of which are associate-level and hands-on.

What score do you need to pass SC-900?

700 or greater on a scale of 1 to 1000. Microsoft notes that because this is a scaled score, it may not equal 70 percent of the points. Microsoft publishes no pass rate for SC-900 or for any other exam, so any pass-rate percentage you see quoted was invented.

SC-900 practice test

SC-900 Practice Test, Practice Questions and Exam Prep From Your Own Security Notes

Upload your Microsoft Security, Compliance and Identity notes or prep PDF, and the AI writes unlimited SC-900 practice questions with an answer key in seconds. Weighted to the four domains Microsoft actually publishes.

Your study files are processed securely and deleted automatically after your practice questions are built.

Upload your SC-900 notes or prep PDF and generate your first question set

Click to upload or drag and drop

PDF, DOCX, PPTX, TXT, JPG, JPEG, PNG, HEIC, ODP, ODT, BMP, or TIFF

up to 20MB

Please wait, your quiz is being created...

Uploading...

SC-900 is Microsoft's Security, Compliance, and Identity Fundamentals exam. It costs $99, it is not retired, and a new objectives version takes effect on July 28, 2026 that changes almost nothing. Four domains: security solutions is the biggest at 35 to 40 percent, Entra is 25 to 30 percent, compliance is 20 to 25 percent, and core concepts is 10 to 15 percent. Microsoft's own change log marks every functional group in the July update as "No change" and every affected sub-skill as "Minor." You need 700 out of 1000. Microsoft publishes no question count for SC-900 and, unusually, prints no duration on the exam page at all.

Last updated July 2026

The July 28, 2026 SC-900 update: what actually changed

Right now, SC-900's published study guide is stamped with a date that has not happened yet. Microsoft posts the new objectives ahead of the switchover, so until July 28, 2026 you are looking at a version of the exam that is not live. That is catnip for prep sites, and the "SC-900 is changing, buy the updated bundle" posts have already started.

We read the official change log. Here is every row of it. Microsoft's third column describes the extent of each change, and there is not a single "Major" in the table.

Skill area	Microsoft's stated extent of change
Audience profile	No change
Describe the capabilities of Microsoft Entra	No change
Describe function and identity types of Microsoft Entra ID	Minor
Describe access management capabilities of Microsoft Entra ID	Minor
Describe the capabilities of Microsoft security solutions	No change
Describe core infrastructure security services in Azure	Minor
Describe capabilities of Microsoft Sentinel	Minor
Describe the capabilities of Microsoft compliance solutions	No change
Describe Microsoft Service Trust Portal and privacy principles	Minor

Read that table carefully and the honest conclusion is boring, which is exactly why nobody selling a course will tell you: no domain was renamed, added or removed, and no weight moved. Four functional groups before, four after, same names, same percentages. The four "Minor" rows are sub-skill refreshes inside groups whose parent row says "No change."

So if you are studying for SC-900 today and you sit it in August, you do not need to start over. What you should do is make sure your practice questions reflect the current bullet list rather than a bank someone scraped in 2024, which is the whole point of building a question bank from your own current security notes instead of buying a static one.

Exam fee (US): $99
Passing score: 700 / 1000
Domains: 4
Practice questions: Unlimited

SC-900 skills measured, straight from Microsoft's study guide

Four domains. The product tour is the exam: two thirds of the paper is Entra plus the security stack.

Domain	What is actually in it	Weight
Describe the capabilities of Microsoft security solutions	Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation with virtual networks, network security groups, Azure Bastion, Azure Key Vault. Then Defender for Cloud and Cloud Security Posture Management, SIEM and SOAR as concepts, threat detection in Microsoft Sentinel, and the whole Defender XDR family: Office 365, Endpoint, Cloud Apps, Identity, Vulnerability Management, Threat Intelligence, and the Defender portal. The biggest domain.	35 to 40%
Describe the capabilities of Microsoft Entra	Entra ID, types of identities including agent ID, hybrid identity, authentication methods, MFA, password protection, Conditional Access, Entra roles and RBAC, ID Governance, access reviews, Privileged Identity Management, ID Protection.	25 to 30%
Describe the capabilities of Microsoft compliance solutions	Service Trust Portal, Microsoft's privacy principles, the Microsoft Purview portal, Compliance Manager and compliance score, data classification, Content and Activity explorer, sensitivity labels, data loss prevention, records management, retention policies and labels, insider risk management, eDiscovery, audit.	20 to 25%
Describe the concepts of security, compliance, and identity	The shared responsibility model, defense-in-depth, the Zero Trust model, encryption and hashing, Governance Risk and Compliance, identity as the primary security perimeter, authentication versus authorization, identity providers, directory services and Active Directory, federation. The smallest domain, and the only vendor-neutral one.	10 to 15%

Notice the shape of this exam. Only 10 to 15 percent of it is concepts you could learn from any security textbook. The other 85 to 90 percent is Microsoft product names, and there are a lot of them: we counted "Defender" eleven times and "Purview" six times in roughly 500 words of skills text. SC-900 is, in practice, a vocabulary exam about a product catalog.

Weights and bullets are current as of the study-guide version effective July 28, 2026. Microsoft does not publish a question count for SC-900, and its exam page does not print a duration. General guidance is that most exams contain 40 to 60 questions, and Microsoft's exam-type table allots fundamentals exams 45 minutes of exam time inside 65 minutes of seat time.

Agent identity is now on a beginner security exam. Copilot is not.

SC-900's Entra domain contains a bullet that did not used to exist anywhere near an entry-level exam: "Describe types of identities, including agent ID." AI agents now get identities in Entra, and Microsoft has decided that a beginner should be able to describe that before they are allowed to call themselves security-literate.

What is genuinely surprising is what is not there. Given how hard Microsoft is pushing Security Copilot, you would expect it on the fundamentals paper. It is not. Here is the count, taken from the skills sections of each official outline.

Term in the official skills outline	SC-900 (live)	SC-200 (associate)	MS-900 (retired)
Copilot	0	1	5
Agent	1	1	0
Defender	11	20	6
Purview	6	3	2
Sentinel	2	16	0

Microsoft put Copilot into MS-900 five times, then retired MS-900 in March 2026. It left Copilot out of SC-900 entirely. If a practice bank is drilling you on Security Copilot for SC-900, it is testing you on content that is not in the blueprint, and it is stealing hours you should be spending on the Defender family, which is eleven mentions and the largest domain.

The other honest read: SC-900 has two Sentinel mentions and SC-200 has sixteen. That gap is the difference between describing a SIEM and running one, and it is the real distance between fundamentals and associate.

How to build SC-900 practice questions that match the real blueprint

SC-900 is a naming exam. The fastest way to pass it is to drill the product catalog until the names stop blurring together.

1 Upload current material: The SC-900 study guide, Microsoft Learn modules, or your own notes. Recent material, not a 2024 bank.
2 Weight security solutions: It is 35 to 40 percent. The seven Defender products are where most people lose points by confusing them.
3 Drill the distinctions: Defender for Identity versus ID Protection. Sensitivity labels versus retention labels. NSG versus Firewall versus WAF.
4 Skip Copilot: Zero mentions in the outline. Spend that hour on Purview instead, which has six.

SC-900 questions, answered

What is Exam SC-900?: SC-900 is Microsoft Security, Compliance, and Identity Fundamentals. It is a beginner-level exam that earns the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification. It costs $99 in the United States, has no prerequisite, and is not retired: its certification page carries no retirement notice.
Is SC-900 changing in July 2026?: Yes, but far less than prep sites imply. A new SC-900 objectives version takes effect on July 28, 2026. Microsoft's own change log marks every functional group as "No change" and every affected sub-skill as "Minor." No domain was renamed, added or removed, and no weight moved. Your study plan does not need to change.
What are the SC-900 domain weights?: Four domains. Describe the capabilities of Microsoft security solutions is the largest at 35 to 40 percent. Describe the capabilities of Microsoft Entra is 25 to 30 percent. Describe the capabilities of Microsoft compliance solutions is 20 to 25 percent. Describe the concepts of security, compliance, and identity is the smallest at 10 to 15 percent.
How much does the SC-900 exam cost?: $99 USD in the United States, confirmed in Microsoft's own published exam pricing feed. That is the standard fundamentals price, the same as AZ-900 and DP-900. Price varies by the country or region in which the exam is proctored, and tax may be added at checkout.
How many questions are on the SC-900 exam and how long is it?: Microsoft publishes no question count for SC-900, and it does not print a duration on the SC-900 exam page at all. Its general guidance is that most exams contain 40 to 60 questions, and its exam-type table gives fundamentals exams 45 minutes of exam time within 65 minutes of seat time. Any site quoting an exact SC-900 question count invented it.
Does SC-900 cover Copilot?: No. The word Copilot appears zero times in SC-900's skills outline. The retired MS-900 outline mentioned Copilot five times. SC-900 does now examine agent identity: one bullet reads "Describe types of identities, including agent ID," which is the exam's only agent reference.
Is SC-900 worth it?: It is the cheapest credible entry point into Microsoft security at $99, and unlike MS-900 it is still live. It is a describe-level exam, so it proves vocabulary rather than hands-on skill. Most people use it as a stepping stone to SC-200 or SC-300, both of which are associate-level and hands-on.
What score do you need to pass SC-900?: 700 or greater on a scale of 1 to 1000. Microsoft notes that because this is a scaled score, it may not equal 70 percent of the points. Microsoft publishes no pass rate for SC-900 or for any other exam, so any pass-rate percentage you see quoted was invented.

PDFQuiz is not affiliated with, endorsed by, or sponsored by Microsoft. Microsoft, Azure, Entra, Defender, Sentinel and Purview are trademarks of the Microsoft group of companies. This generator builds practice questions from material you upload and is a study aid, not a substitute for Microsoft's official learning paths. Always confirm exam details on Microsoft's own pages before you book.

Related study tools

The usual step up from SC-900 is SC-200, the security operations analyst exam that turns those two Sentinel mentions into sixteen. The other $99 fundamentals exams are AZ-900 and DP-900. If you are heading for cloud security engineering, SC-500 is replacing AZ-500, which retires on August 31, 2026. For a vendor-neutral security foundation, compare the Security+ practice test generator. For any source document at all, use the certification exam generator.

Build your first SC-900 practice set

Upload your security and compliance notes and generate exam-style questions with an answer key in under a minute.

Start Creating Practice Questions

Z tej samej rodziny narzędzi