How long to study for SC-900? 1–5 weeks, by background
Short answer, and these are our estimates, not official figures: if you work in IT but are new to Microsoft's security tools, plan on about 2–3 weeks of part-time study at roughly 5 hours a week. If you already administer Microsoft 365 or Azure security features, about 1–2 weeks may be enough. If you're new to IT, expect about 4–5 weeks. SC-900 is a Beginner-level exam, so the work is mostly learning what each service is for and telling the lookalikes apart.
Not sure where you stand? Take the free 10-question SC-900 check — no account, about 5 minutes, and it shows your weakest domain.
Take the free check →SC-900 is Microsoft's fundamentals exam for security, compliance and identity: four domains, 45 minutes, and short scenarios where you pick the service or concept that fits a need. Your timeline depends mostly on two things: whether security concepts like Zero Trust and authentication vs authorization are familiar, and whether you've used Microsoft Entra, Defender or Purview before. Here's the timeline by background, how to split your hours across the domains, and how to tell when you're ready.
Study time by background
| Your background | Our estimate |
|---|---|
| Microsoft 365 or Azure admin already using Entra, Defender or Purview | 1–2 weeks · ~5 h/week |
| IT or security pro on other vendors' tools | 2–3 weeks · ~5 h/week |
| Non-technical role near security (sales, project, compliance) | 3–4 weeks · ~5 h/week |
| New to IT | 4–5 weeks · ~5 h/week |
These are rough ranges based on what the outline covers, not guarantees, and not numbers Microsoft publishes. Here's what each background brings:
- Microsoft 365 or Azure admin. Entra ID, MFA and Conditional Access are familiar. Your time goes into the parts you don't touch at work: often Microsoft Sentinel, Defender for Cloud, Azure network security and the Purview compliance tools.
- IT or security pro on other vendors. The concepts are familiar; Microsoft's product names and which product does what are new. Budget extra time on the Microsoft security solutions domain, the biggest at 35–40%.
- Non-technical role. The concepts domain is your foundation; give it a full first week. Then focus on what each product is for rather than how it works.
- New to IT. Take it slower and consider AZ-900 for cloud basics first or alongside. Our is SC-900 worth it? post covers who the cert fits.
The exam at a glance
| What | Detail |
|---|---|
| Exam | SC-900: Microsoft Security, Compliance, and Identity Fundamentals |
| Earns | Microsoft Certified: Security, Compliance, and Identity Fundamentals |
| Level | Beginner |
| Time | 45 minutes |
| Questions | Not published (reports suggest about 40–60) |
| Passing score | 700 out of 1000 (scaled) |
| Features tested | Mostly GA; commonly used previews possible |
| Study guide | Skills measured as of Oct 21, 2026 |
| Cost (USD) | Not published by Microsoft; about $99 in the US (third-party) |
| Expiry | Doesn't expire |
What drives the time: the domain weights
Weight your time the way Microsoft weights the exam. The right-hand column is our arithmetic: the official weight ranges applied to a 10–20 hour plan, which is roughly what 2–4 weeks at about 5 hours a week works out to. On a shorter or longer track, keep the same proportions.
| Skill area | Weight | Of a 10–20 h plan |
|---|---|---|
| 1. Concepts of security, compliance, and identity | 10–15% | ~1–3 h |
| 2. Capabilities of Microsoft Entra | 25–30% | ~2.5–6 h |
| 3. Capabilities of Microsoft security solutions | 35–40% | ~3.5–8 h |
| 4. Capabilities of Microsoft compliance solutions | 20–25% | ~2–5 h |
- Concepts is the smallest domain but the foundation for the rest: shared responsibility, defense in depth, Zero Trust, encryption and hashing, governance, risk and compliance, data residency and sovereignty, authentication vs authorization, identity providers, directory services and federation.
- Microsoft Entra covers Entra ID and its identity types (users, workload identities, managed identities, devices, groups), External ID, hybrid identity (Cloud Sync, PHS, PTA, federation), authentication methods and MFA, SSPR and password protection, Conditional Access, Entra roles vs Azure RBAC, ID Governance, access reviews, PIM and ID Protection.
- Microsoft security solutions is the biggest and broadest: Azure DDoS Protection, Azure Firewall, WAF, VNets and NSGs, Azure Bastion, Key Vault, Defender for Cloud (CSPM, secure score, workload protection), Microsoft Sentinel, and Defender XDR with Defender for Office 365, Endpoint, Cloud Apps and Identity, Vulnerability Management and Microsoft Threat Intelligence.
- Microsoft compliance solutions covers the Service Trust Portal, Microsoft's privacy principles, the Microsoft Purview portal, Compliance Manager and compliance score, data classification, Content and Activity explorer, sensitivity labels, DLP, retention, records management, insider risk management, eDiscovery and Audit.
Two timeline profiles
Profile A — the 2-week track (admin or IT pro)
- Week 1 — concepts and Microsoft Entra: take a mixed practice set on day 1 to find your gaps, then a quick pass on the concepts domain, then Entra ID, hybrid identity, MFA and Conditional Access, governance, PIM and ID Protection.
- Week 2 — security, compliance and mocks: Azure network security and Defender for Cloud, Sentinel and Defender XDR, then Purview; finish with a full timed mock, drill what's under 80%, then book.
Profile B — the 4-week track (new to Microsoft security, or new to IT)
- Week 1 — concepts and identity basics. The whole concepts domain, then Entra ID, identity types and External ID.
- Week 2 — the rest of Microsoft Entra. Hybrid identity, authentication methods, Conditional Access, roles, ID Governance, PIM and ID Protection.
- Week 3 — Microsoft security solutions. Azure infrastructure security, Defender for Cloud and Sentinel first, then Defender XDR and its services.
- Week 4 — compliance, review and mocks: Purview, then re-drill everything under 80%, take full timed mocks, then sit the exam.
Want both tracks written out day by day, with four cheat sheets for the lookalikes? That's our SC-900 study plan.
How to use your practice-question scores
- Track accuracy per domain, not overall. 82% overall with Microsoft security solutions at 65% isn't ready; that domain is 35–40% of the exam.
- Only count fresh questions. A second pass over questions you've already seen measures memory. Readiness is consistently 80% or higher on questions you haven't seen.
- Read the explanation for every miss, including why each wrong answer is wrong. On SC-900 the wrong answers are usually real services that would be right for a slightly different need.
- Use Microsoft's free Practice Assessment as a checkpoint. Take it early and again near the end.
- Finish with a full timed mock at 80%+. CrushCert's mock is 50 questions on a 45-minute timer with a 70% pass line; treat 70% as the floor, not the target.
What makes it take longer (or shorter)
- Mixing up the lookalikes. Conditional Access vs security defaults vs PIM, access reviews vs entitlement management vs lifecycle workflows, PHS vs PTA vs federation, Defender for Identity vs Entra ID Protection, Defender for Cloud vs Sentinel vs Defender XDR, Content explorer vs Activity explorer, retention label vs retention policy. Drill them side by side.
- Studying from outdated material. Old tutorials teach Azure AD, Azure AD Connect, Azure Security Center, Microsoft 365 Defender and the old compliance portal. Use current Microsoft Learn pages and a bank written for the October 21, 2026 outline.
- Going too deep. SC-900 doesn't test KQL, PowerShell or configuration steps. If you find yourself memorizing click paths, step back to "what is it for?"
- Already working with Microsoft 365 security? Take a full practice set on day one and spend your time on the parts you don't use at work. That's how the 1-week end of the range happens.
How to study efficiently
- Pair free training with a question bank. Microsoft Learn's free self-paced SC-900 training covers the material; practice questions show you where you're actually weak.
- Use adaptive quizzes so your reps go to the topics you miss rather than the ones you already know.
- Match, don't just memorize. CrushCert's four drag-and-drop labs give you six real requirements per domain and have you match each to the right concept, Entra feature, security tool or Purview capability.
- Pick your question sources deliberately. Our best SC-900 practice tests post compares the free and paid options.
Practice SC-900 the smart way
200 original questions at the official weights, each with an explanation of why the right answer is right and why each wrong one is wrong; four drag-and-drop labs on the lookalikes; flashcards with spaced repetition; and a 50-question, 45-minute timed mock. $10/month for SC-900 alone, $19/month for all 10 Associate exams, or $24/month for all 23 exams. 7-day free trial, no card required.
Start the SC-900 prep →Is it worth the time?
For people starting out with Microsoft security, compliance and identity, usually yes: it's a Beginner-level Microsoft credential that doesn't expire, for a few weeks of part-time study. Experienced analysts on Microsoft's tools can skip ahead to SC-200. The full take is in is SC-900 worth it?, and the SC-900 practice test page shows exactly what's in the prep.
Keep reading
SC-900 practice test
200 original questions at the official weights, four drag-and-drop labs and a 45-minute timed mock. 7 days free.
RESOURCESBest SC-900 practice tests in 2026
Microsoft's free training and Practice Assessment, MeasureUp, Udemy courses and CrushCert, compared honestly.
CAREER GUIDEIs SC-900 worth it in 2026?
Who the Security, Compliance, and Identity Fundamentals cert fits, who should skip it, and how it compares with AZ-900, Security+ and SC-200.
STUDY PLANSC-900 study plan: 2-week & 4-week schedules
Week-by-week tracks across the four domains, four cheat sheets for the lookalikes, and a timed mock before you book.
Frequently asked questions
How long does it take to study for SC-900?
Our estimate, at roughly 5 hours a week: about 1 to 2 weeks if you already administer Microsoft 365 or Azure security features, about 2 to 3 weeks if you're an IT or security pro on other vendors' tools, about 3 to 4 weeks if you're in a non-technical role near security, and about 4 to 5 weeks if you're new to IT. These are estimates, not guarantees; let your practice scores decide when you book.
Can I pass SC-900 in a week?
If you already use Microsoft Entra, Defender or Purview at work, about a week of focused study is realistic. If Microsoft's security tools are new to you, a week is tight, mostly because there are many products to tell apart across the four domains.
How should I split my SC-900 study time across the domains?
In proportion to the official weights: concepts 10 to 15%, Microsoft Entra 25 to 30%, Microsoft security solutions 35 to 40%, and Microsoft compliance solutions 20 to 25%. On a 10 to 20 hour plan that is roughly 1 to 3 hours, 2.5 to 6 hours, 3.5 to 8 hours, and 2 to 5 hours.
What practice-test score means I'm ready for SC-900?
Consistently 80% or higher on questions you have not seen before, in all four domains, plus a full timed mock at that level. The real exam is scored 700 out of 1000 on a scaled score and Microsoft does not publish the question count, so a 70% mock pass line is the floor, not the target.