SC-900 study plan: 2-week & 4-week schedules

Here's a concrete, week-by-week plan for Microsoft SC-900 (Microsoft Security, Compliance, and Identity Fundamentals), in two tracks: 2 weeks if you're an admin or IT pro who already knows some of Microsoft's tools, and 4 weeks if you're new to Microsoft security or new to IT. Both run on the same daily routine of about 45–60 minutes, five days a week (roughly 5 hours a week), both follow the official domain weights, and both finish with timed mocks. Book the exam when you're consistently scoring 80%+ on fresh questions.

SC-900 is a "describe and choose" exam. Most questions give a short need ("only when needed, with approval," "the label must stay with the document," "without exposing RDP to the internet") and ask which concept, service or feature fits. The wrong answers are real Microsoft services that fit a slightly different need. So this plan pairs Microsoft's free training with practice questions from day one, and ends with four cheat sheets for the lookalikes that cost people the most points.

The exam you're planning for

Microsoft security solutions is the biggest domain at 35–40%, so both tracks spend the most time there. Because the 700/1000 score is scaled and Microsoft doesn't publish the question count, aim higher than the mock pass line: 80%+ on fresh questions in every domain, not 70%.

Which track are you on?

Those line up with our estimates in how long to study for SC-900, which also has the per-domain hour split.

The daily routine (every study day)

• 20–25 minutes — learn: the matching module in Microsoft Learn's free self-paced SC-900 training. Read for when you'd choose this over the alternative, not just what the feature does.
• 15–20 minutes — practice questions on that day's topic on CrushCert, plus a few mixed questions from earlier days so nothing goes cold.
• 10–15 minutes — review misses and flashcards: read the explanation for every wrong answer and say what each wrong choice would be right for; then run flashcards on the lists that blur together (Entra features, Defender products, Purview labels and policies).

Track 1: the 2-week plan (admin or IT pro)

• Days 1–2 — concepts (domain 1): start with a 30-question mixed set to find your gaps. Then shared responsibility, defense in depth, Zero Trust, encryption vs hashing, governance vs risk vs compliance, authentication vs authorization, identity providers and federation. Run Match the Security Concept.
• Days 3–5 — Microsoft Entra (domain 2): Entra ID and identity types, managed identities, External ID; hybrid identity (cheat sheet 2); authentication methods, MFA, SSPR and password protection; Conditional Access, Entra roles vs Azure RBAC, ID Governance, access reviews, PIM and ID Protection (cheat sheet 1). Run Pick the Microsoft Entra Feature.
• Days 6–7 — Microsoft security solutions (domain 3): Azure infrastructure security (cheat sheet 3), Defender for Cloud and secure score, Microsoft Sentinel, then Defender XDR and its services, Microsoft Threat Intelligence and the Defender portal. Run Which Microsoft Security Tool?
• Day 8 — Microsoft compliance solutions (domain 4): Service Trust Portal, privacy principles, the Purview portal, Compliance Manager, classification and the explorers, sensitivity labels, DLP, retention and records, insider risk, eDiscovery and Audit (cheat sheet 4). Run Pick the Microsoft Purview Tool.
• Days 9–10 — mocks and the exam: Microsoft's free SC-900 Practice Assessment, then a full 50-question CrushCert mock on the 45-minute timer. Drill the weakest domain with fresh questions, take a second mock, and book once you're at 80%+.

Track 2: the 4-week plan (new to Microsoft security)

About 45–60 minutes a day, five days a week. Use the other days to catch up or rest.

Week 1 — concepts and identity basics

• Days 1–3 — concepts (domain 1): take Microsoft's free Practice Assessment or a short mixed set as a baseline. Then shared responsibility, defense in depth and the CIA triad, Zero Trust, encryption and hashing, governance, risk and compliance, data residency vs sovereignty, authentication vs authorization, identity providers, directory services and federation. Run Match the Security Concept.
• Days 4–5 — Entra basics: what Microsoft Entra ID is, the Entra family, identity types (users, workload identities, managed identities, devices, groups) and External ID.

Week 2 — the rest of Microsoft Entra

• Days 1–2 — hybrid identity and sign-in: Cloud Sync vs Connect, PHS vs PTA vs federation (cheat sheet 2), authentication methods, MFA and security defaults, SSPR, password protection and smart lockout.
• Days 3–5 — access control and governance: Conditional Access, Entra roles vs Azure RBAC, entitlement management, lifecycle workflows, access reviews, PIM and ID Protection (cheat sheet 1). Run Pick the Microsoft Entra Feature.

Week 3 — Microsoft security solutions

• Days 1–2 — Azure infrastructure security: DDoS Protection, Azure Firewall, WAF, VNets and NSGs, Azure Bastion and Key Vault (cheat sheet 3).
• Day 3 — posture and SIEM: Defender for Cloud (Foundational vs Defender CSPM, secure score, workload protection plans) and Microsoft Sentinel (SIEM vs SOAR, data connectors, workbooks, analytics rules, playbooks, hunting).
• Days 4–5 — Defender XDR: Defender for Office 365, Endpoint, Cloud Apps and Identity, Vulnerability Management, Microsoft Threat Intelligence and the Defender portal. Run Which Microsoft Security Tool? Finish with a 50-question mixed quiz and record your score per domain.

Week 4 — compliance, review and mocks

• Days 1–2 — Microsoft compliance solutions: Service Trust Portal, privacy principles, the Purview portal, Compliance Manager, data classification, Content and Activity explorer, sensitivity labels, DLP, retention and records, insider risk, eDiscovery and Audit (cheat sheet 4). Run Pick the Microsoft Purview Tool.
• Days 3–5 — review, mocks and the exam: your weakest domain with fresh questions; Microsoft's free Practice Assessment again; a full CrushCert mock on the 45-minute timer; drill what it exposed; a second mock. Two in a row at 80%+ and you're ready to book.

Cheat sheet 1: which Microsoft Entra feature?

Conditional Access needs Microsoft Entra ID P1; ID Protection and risk-based Conditional Access need P2. Entra roles manage the directory (users, groups, licenses); Azure RBAC roles such as Owner, Contributor and Reader manage Azure resources.

Cheat sheet 2: which hybrid sign-in method?

PHS is required for leaked-credential detection in ID Protection, and Microsoft recommends it as a backup to any method. For the sync itself, Microsoft Entra Cloud Sync is the lightweight, cloud-managed agent Microsoft recommends; Microsoft Entra Connect is the on-premises server option.

Cheat sheet 3: which Azure security service?

And one level up: Defender for Cloud assesses posture (secure score, recommendations) and protects workloads; Microsoft Sentinel is the cloud-native SIEM and SOAR; Defender XDR coordinates protection across endpoints, identities, email and applications.

Cheat sheet 4: which Purview tool?

Two classic traps: the Service Trust Portal holds Microsoft's audit reports and certifications, while Compliance Manager tracks your organization's progress; and Content explorer is a snapshot of what labeled content exists and where, while Activity explorer is a history of what users did with it.

The last day before the exam

• No new topics, no full mocks. A 20-question mixed quiz, the flashcard deck and the four cheat sheets above.
• On exam day: you have 45 minutes. Read every scenario for the words that decide it ("only when needed," "with approval," "stays with the file," "without a public IP," "Microsoft's own report," "over time," "least administrative effort"), and keep a steady pace so you aren't rushing the last questions.

More on SC-900

Not sure what to practice with? See our honest look at the best SC-900 practice tests, free and paid. Still deciding whether to sit it at all? Read is SC-900 worth it? and how long it takes by background. Everything in the prep is laid out on the SC-900 practice test page. New to Azure itself? Start with the AZ-900 practice test; want vendor-neutral depth, see the Security+ practice test. Done with SC-900 and heading into security operations? The SC-200 practice test is the next step, with hands-on KQL labs.

Keep reading

Frequently asked questions