There are no formal SC 900 prerequisites. Microsoft lists this as a fundamentals-level exam with no required certification, exam, or role to hold beforehand. What Microsoft does recommend is familiarity with Microsoft Azure and Microsoft 365, plus a general understanding of how Microsoft's security, compliance, and identity solutions work across both.
The short answer to the SC-900 prerequisites question is that there are none, formally. Microsoft classifies this as a fundamentals-level exam, and fundamentals-level exams in the Microsoft certification system are built specifically so nobody is blocked from attempting them by a missing certification or role requirement.
Formal SC-900 prerequisites
Microsoft's own documentation states plainly: none. There is no earlier exam you must pass, no associate-level role you must already hold, and no mandatory training course you must complete before you can book SC-900. Anyone can register and sit the exam.
Recommended background for SC-900 eligibility
Although nothing is formally required, Microsoft does recommend that candidates come in with familiarity with Microsoft Azure and Microsoft 365, along with a general understanding of how Microsoft's security, compliance, and identity solutions work across both. That recommendation matters more than it might sound: several exam objectives assume you already recognize product names like Microsoft Entra, Microsoft Purview, and Microsoft Defender, even though the exam does not test hands-on configuration of any of them.
Who should take the SC-900 exam
This exam suits people who need a working, describe-level vocabulary for Microsoft's security, compliance, and identity story, including:
- People new to security, compliance, or identity roles who want a structured introduction before moving to a role-based Microsoft certification.
- IT professionals whose job touches Microsoft Entra, Microsoft Purview, or Microsoft Defender indirectly, and who need to speak the same language as the specialists who manage them day to day.
- Sales, support, and pre-sales staff who need to explain Microsoft's security and compliance capabilities to customers without configuring the products themselves.
- Students and career-changers using SC-900 as a first, low-barrier step into the Microsoft security certification track.
Who should start somewhere else
If you are already comfortable describing Zero Trust, identity federation, Conditional Access, and data loss prevention at a working level, SC-900 may feel too introductory, and you might be better served jumping straight to a role-based Microsoft security exam instead. Conversely, if terms like Azure, tenant, and resource group are unfamiliar to you, spend time with general Azure fundamentals material first — SC-900 assumes you already know what Azure and Microsoft 365 are, even though it does not test them directly.
Why fundamentals-level exams work this way
Microsoft designs its fundamentals-level exams, including SC-900, to sit below the associate and expert tiers on purpose. Associate and expert exams often expect hands-on configuration experience and sometimes recommend or require an earlier certification. Fundamentals exams like SC-900 exist specifically to remove that barrier, so a manager, a student, or someone switching careers into security can prove baseline knowledge without first spending months in a hands-on role. That design choice is also why the exam tests description-level knowledge ("what does this do") rather than task-level knowledge ("how do you configure this").
How to close any gaps before you book
Since the real barrier to SC-900 is knowledge rather than eligibility, the most useful next step is checking how your current background lines up against the actual exam objectives, then building a study plan around whatever domains feel unfamiliar. Once you have studied, the sample questions page shows the scenario style Microsoft uses, and the exam format and scoring page tells you exactly what you need to clear to pass.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.