The SC 900 syllabus groups every exam topic into four domains, weighted differently in your score: security, compliance, and identity concepts (12%), Microsoft Entra (28%), Microsoft security solutions (38%), and Microsoft compliance solutions (22%). Each domain has its own list of objective statements, taken directly from Microsoft's published study guide, that describe exactly what you need to know.
Understanding the SC 900 syllabus starts with Microsoft's own skills-measured outline, which groups every exam topic into four functional domains. Each domain carries a different share of your score, so the SC 900 syllabus is not four equally weighted sections — some domains matter far more than others when you decide where to spend study time. This page lists every domain and every objective statement from the official study guide, in the order Microsoft publishes them, along with the weight each domain carries.
SC-900 syllabus domain weights
| Domain | Weight |
|---|---|
| Describe the concepts of security, compliance, and identity | 12% |
| Describe the capabilities of Microsoft Entra | 28% |
| Describe the capabilities of Microsoft security solutions | 38% |
| Describe the capabilities of Microsoft compliance solutions | 22% |
The heaviest domain, Microsoft security solutions, covers Azure network and workload protection plus Microsoft Sentinel and Microsoft Defender XDR. The lightest, foundational security and identity concepts, still sets up vocabulary the rest of the exam assumes you already know, so do not skip it because of its smaller weight.
Domain 1: Describe the concepts of security, compliance, and identity
This domain introduces the shared vocabulary the rest of the SC-900 exam topics depend on.
- Describe security and compliance concepts - Describe the shared responsibility model
- Describe security and compliance concepts - Describe defense-in-depth
- Describe security and compliance concepts - Describe the Zero Trust model
- Describe security and compliance concepts - Describe encryption and hashing
- Describe security and compliance concepts - Describe Governance, Risk, and Compliance (GRC) concepts
- Define identity concepts - Define identity as the primary security perimeter
- Define identity concepts - Define authentication
- Define identity concepts - Define authorization
- Define identity concepts - Describe identity providers
- Define identity concepts - Describe the concept of directory services and Active Directory
- Define identity concepts - Describe the concept of federation
In practice, this means explaining why identity, not the network edge, is treated as the modern security boundary, and telling authentication (proving who you are) apart from authorization (what you are allowed to do) without hesitation.
Domain 2: Describe the capabilities of Microsoft Entra
- Describe function and identity types of Microsoft Entra ID - Describe Microsoft Entra ID
- Describe function and identity types of Microsoft Entra ID - Describe types of identities, including agent ID
- Describe function and identity types of Microsoft Entra ID - Describe hybrid identity
- Describe authentication capabilities of Microsoft Entra ID - Describe the authentication methods
- Describe authentication capabilities of Microsoft Entra ID - Describe multifactor authentication (MFA)
- Describe authentication capabilities of Microsoft Entra ID - Describe password protection and management capabilities
- Describe access management capabilities of Microsoft Entra ID - Describe Microsoft Entra Conditional Access
- Describe access management capabilities of Microsoft Entra ID - Describe Microsoft Entra roles and role-based access control (RBAC)
- Describe identity protection and governance capabilities of Microsoft Entra - Describe Microsoft Entra ID Governance
- Describe identity protection and governance capabilities of Microsoft Entra - Describe access reviews
- Describe identity protection and governance capabilities of Microsoft Entra - Describe the capabilities of Microsoft Entra Privileged Identity Management
- Describe identity protection and governance capabilities of Microsoft Entra - Describe Microsoft Entra ID Protection
At 28% of the score, this is the second-heaviest domain on the SC-900 exam objectives list. Expect to tell Conditional Access (policy enforced at sign-in) apart from Privileged Identity Management (time-limited, approved elevation of an already-assigned role), and to know what an access review recertifies versus what an access package grants.
Domain 3: Describe the capabilities of Microsoft security solutions
- Describe core infrastructure security services in Azure - Describe Azure DDoS Protection
- Describe core infrastructure security services in Azure - Describe Azure Firewall
- Describe core infrastructure security services in Azure - Describe Azure Web Application Firewall (WAF)
- Describe core infrastructure security services in Azure - Describe network segmentation with Azure virtual networks
- Describe core infrastructure security services in Azure - Describe network security groups (NSGs)
- Describe core infrastructure security services in Azure - Describe Azure Bastion
- Describe core infrastructure security services in Azure - Describe Azure Key Vault
- Describe security management capabilities of Azure - Describe Microsoft Defender for Cloud
- Describe security management capabilities of Azure - Describe Cloud Security Posture Management (CSPM)
- Describe security management capabilities of Azure - Describe how security policies, standards, and recommendations improve the cloud security posture
- Describe security management capabilities of Azure - Describe enhanced security features provided by cloud workload protection
- Describe capabilities of Microsoft Sentinel - Define the concepts of security information and event management (SIEM) and security orchestration automated response (SOAR)
- Describe capabilities of Microsoft Sentinel - Describe threat detection and mitigation capabilities in Microsoft Sentinel
- Describe threat protection with Microsoft Defender XDR - Describe Microsoft Defender XDR services
This is the largest domain on the SC-900 syllabus and spans Azure network controls, Microsoft Defender for Cloud posture management, and the SIEM and SOAR pairing of Microsoft Sentinel and Microsoft Defender XDR. You are not expected to configure these services, only to describe what each one does and when you would reach for it.
Domain 4: Describe the capabilities of Microsoft compliance solutions
- Describe Microsoft Service Trust Portal and privacy principles - Describe the Service Trust Portal offerings
- Describe Microsoft Service Trust Portal and privacy principles - Describe the privacy principles of Microsoft
- Describe compliance management capabilities of Microsoft Purview - Describe the Microsoft Purview portal
- Describe compliance management capabilities of Microsoft Purview - Describe Compliance Manager
- Describe compliance management capabilities of Microsoft Purview - Describe the uses and benefits of compliance score
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview - Describe the data classification capabilities
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview - Describe the benefits of Content explorer and Activity explorer
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview - Describe sensitivity labels and sensitivity label policies
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview - Describe data loss prevention (DLP)
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview - Describe records management
- Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview - Describe retention policies, retention labels, and retention label policies
- Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview - Describe insider risk management
- Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview - Describe eDiscovery solutions in Microsoft Purview
- Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview - Describe audit solutions in Microsoft Purview
Everything in this domain sits inside the Microsoft Purview portal: classification and sensitivity labels feed data loss prevention and retention, while insider risk management, eDiscovery, and audit sit on top as investigation tools.
Using the SC-900 syllabus to plan study time
A practical way to use this SC-900 syllabus is to match study time to weight: spend roughly proportionate effort on each domain rather than splitting time evenly across four. See our study plan for a week-by-week breakdown built on these exact weights, and check the exam format and scoring page for how these domains translate into your score. Once you have worked through the objectives above, the sample questions page shows how Microsoft phrases scenario-based questions against this same syllabus.
If you are only getting started, read the prerequisites page first to confirm the SC-900 syllabus matches where you are today, or go straight to the overview for the full picture of the certification.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.