Is SC-900 worth it in 2026? (an honest take)

Short answer: yes, if you're new to Microsoft security and want a low-cost, low-stakes way to learn the landscape and prove it. SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is Microsoft's Beginner-level exam on what Microsoft Entra, Microsoft Defender, Microsoft Sentinel and Microsoft Purview are for and when to use each. It's 45 minutes, and fundamentals certifications don't expire. What it isn't is proof that you can do a security job; it's a vocabulary-and-landscape cert, and it's priced like one.

We sell SC-900 prep, so discount our enthusiasm. We'd rather you take it for the right reasons (or skip straight to a better-fitting exam) than spend the exam fee and a few weeks on a cert that doesn't match the job you want.

What SC-900 is

SC-900 earns Microsoft Certified: Security, Compliance, and Identity Fundamentals. It's a describe exam: describe Zero Trust and the shared responsibility model, describe what Microsoft Entra ID, Conditional Access and Privileged Identity Management do, describe Defender XDR, Defender for Cloud and Microsoft Sentinel, and describe Microsoft Purview's labels, DLP, insider risk, eDiscovery and Audit. Questions are short scenarios that ask which service fits a need. There's no KQL, no PowerShell and no click paths.

The exam at a glance

What it proves (and what it doesn't)

SC-900 is a fundamentals certification: it maps to knowledge, not to a job. Here's what passing it says about you:

• You know Microsoft's security map. You can say which family a tool belongs to (Entra for identity, Defender for threat protection, Purview for compliance) and what each main service is for.
• You know the current names. Microsoft Entra ID rather than Azure AD, Defender XDR rather than Microsoft 365 Defender, the Microsoft Purview portal rather than the old compliance portal.
• You have the core concepts. Zero Trust, defense in depth, shared responsibility, authentication vs authorization, encryption vs hashing, governance vs risk vs compliance.
• It stays on your record. Fundamentals certifications don't expire, so there's no renewal to keep up.

What it won't do: show that you can configure, investigate or respond. Employers hiring for hands-on security roles look for associate-level certs and real experience. SC-900 is a strong first step and a good conversation starter, not the finish line.

About salary numbers and demand

You'll see blogs attach salary figures to certifications. We're not going to quote any for SC-900, because we haven't found salary or job-posting data for this specific certification from a named source we can verify, and a fundamentals cert rarely decides a salary on its own. The honest version: SC-900 shows you understand Microsoft's security, compliance and identity landscape; what you build on top of it is what moves your career.

Who it's worth it for

• People starting a security career on Microsoft's stack. It gives you the vocabulary and the map before you tackle an associate exam such as SC-200.
• Microsoft 365 and Azure admins. You already touch Entra ID and the admin centers; SC-900 fills in Defender, Sentinel and Purview so you can see how the pieces fit.
• Students and career changers. A Beginner-level exam with no expiry is a low-risk way to get a first Microsoft credential.
• Non-technical roles near security. Sales, pre-sales, project managers, auditors and compliance staff who need to talk accurately about Microsoft's security and compliance tools.

Who should skip it

• Experienced analysts on Microsoft's stack. If you already work in Defender XDR and Microsoft Sentinel, go straight to the associate-level SC-200. Microsoft doesn't require SC-900 first.
• People who want a vendor-neutral security foundation. If your goal is security concepts in depth rather than Microsoft's tools, CompTIA Security+ covers far more ground.
• People who need Azure basics first. If cloud and Azure themselves are new, AZ-900 is the more general starting point; SC-900 can come right after.

What it costs

Microsoft doesn't publish one global price; it depends on the country where you take the exam, and third-party sources put it at about $99 in the US. You can prepare entirely for free with Microsoft Learn's self-paced SC-900 training and Microsoft's free SC-900 Practice Assessment, now on AI Skills Navigator. Paid practice tests add more questions and timed mocks; our rundown of the best SC-900 practice tests compares the options.

SC-900 vs the alternatives

• AZ-900. Microsoft's general Azure fundamentals exam: cloud concepts and core Azure services. SC-900 is the security-specific companion. Many people take both.
• CompTIA Security+. A vendor-neutral foundation that goes much deeper into security concepts, attacks and operations. SC-900 is lighter and Microsoft-specific. They complement each other.
• SC-200. Microsoft's associate-level Security Operations Analyst exam: investigating incidents in Defender XDR, Microsoft Sentinel detections and threat hunting with KQL. It's the natural next step after SC-900 if security operations is where you're headed.

Still not sure? Our free which certification should I take quiz suggests a starting point based on your background and goals.

The names keep changing — does that matter?

The current study guide is "skills measured as of October 21, 2026," and Microsoft's change log lists two minor changes: to Microsoft Entra ID identity types and to threat protection with Defender XDR. The products underneath change faster than the outline. Azure AD is now Microsoft Entra ID; Azure AD B2C is no longer available to new customers, replaced by Microsoft Entra External ID; Microsoft Sentinel is in the Microsoft Defender portal, and Microsoft says it's no longer supported in the Azure portal after March 31, 2027; the standalone Defender Threat Intelligence portal was retired on August 1, 2026; and the Microsoft Purview portal replaced the old compliance portal. On SC-900, old names show up as wrong answers, so study from current Microsoft Learn pages, not old tutorials. We'll update the CrushCert bank when Microsoft changes the outline.

How hard is it, and how long does it take?

It's a Beginner-level exam, but don't wing it: the four domains cover a lot of products, and many wrong answers are real services that fit a slightly different need. Our estimates for part-time study at roughly 5 hours a week: about 1–2 weeks if you already administer Microsoft 365 or Azure security features, about 2–3 weeks if you're in IT but new to Microsoft security, and about 4–5 weeks if you're new to IT. We break that down by background and domain in how long to study for SC-900, and there's a week-by-week SC-900 study plan with 2-week and 4-week tracks.

How to pass it on the first try

• Start with Microsoft's free material. Microsoft Learn's SC-900 training covers every outline area, and the free Practice Assessment shows you where you stand.
• Learn the current names. Many wrong answers are old names or retired products. If an answer says Azure AD, Azure Security Center or Microsoft 365 Defender, be suspicious.
• Drill the lookalikes. Conditional Access vs PIM, access reviews vs entitlement management, PHS vs PTA vs federation, Defender for Identity vs Entra ID Protection, NSG vs Azure Firewall vs WAF, secure score vs compliance score, sensitivity vs retention label, DLP vs insider risk management.
• Weight your time. Microsoft security solutions is the biggest domain at 35–40%.
• Take a timed mock. 45 minutes is short; practice keeping a steady pace.

So — is it worth it?

Yes, if you're starting out with Microsoft security, compliance or identity, or you need to talk about them credibly. For a modest exam fee, no renewal and a few weeks of part-time study, you get a lasting Microsoft credential and a clear map of Microsoft Entra, Defender, Sentinel and Purview. If you already do security operations on Microsoft's tools, skip ahead to SC-200.

Keep reading

Frequently asked questions