Reviewing the SC-900 outline

Ama's job at Harrow & Finch is to triage the alerts that arrive in the security team's queue each morning: suspicious sign-ins, a laptop that has started talking to an unusual address, a message flagged as phishing. SC-900 asks her to step back from the queue and describe the whole landscape: the concepts behind security, compliance and identity, and the Microsoft products that put them into practice. "You know the alerts," Sunil Rao tells her. "The exam wants you to know where each one comes from and why the company has that tool at all." This lesson reviews the SC-900 outline dated October 21, 2026, assuming you have studied MSAZ-130 and MSAZ-131.

The outline's change log marks two minor changes from the previous version: in the objective on Microsoft Entra function and identity types, and in the objective on threat protection with Microsoft Defender XDR. If your course was recorded before October 2026, check those two objectives against current Microsoft Learn content.

Area 1: Describe the concepts of security, compliance, and identity (10 to 15)

The security and compliance concepts objective covers the shared responsibility model, defense in depth, the Zero Trust model, encryption and hashing, and governance, risk and compliance. Zero Trust has three guiding principles that Microsoft describes as verify explicitly, use least privilege access and assume breach. Defense in depth layers protections, from physical security and identity through networks, compute and applications to data, so that a failure in one layer does not expose everything. Encryption makes data unreadable without a key and can protect data at rest and in transit; hashing produces a fixed-length value from data that cannot be reversed and is used to check integrity and store passwords safely.

The identity concepts objective covers the difference between authentication, proving who you are, and authorization, deciding what you may do; identity as the primary security perimeter; identity providers; directory services such as Active Directory Domain Services; and federation, which lets one organization trust identities issued by another. Ama's favorite way to remember the first pair: authentication answers "who are you?" and authorization answers "what may you do?"

Area 2: Describe the capabilities of Microsoft Entra (25 to 30)

Microsoft Entra ID is Microsoft's cloud identity and access service. The identity types objective covers users, groups, devices, workload identities such as service principals and managed identities, external identities for partners and customers, and hybrid identity, in which on-premises Active Directory accounts are synchronized to Entra ID. The authentication objective covers passwords, multifactor authentication, passwordless methods such as Windows Hello for Business, FIDO2 security keys and the Microsoft Authenticator app, self-service password reset and password protection, which blocks known weak passwords. The access management objective covers Conditional Access policies, which use signals such as user, location, device and risk to decide whether to allow access, require multifactor authentication or block, and Microsoft Entra roles and role-based access control.

The identity protection and governance objective covers Microsoft Entra ID Protection, which detects risky sign-ins and users; Privileged Identity Management, which provides just-in-time, time-limited elevation to administrative roles; access reviews, which regularly confirm that people still need their access; and entitlement management, which packages access for request and approval. At Harrow & Finch, Conditional Access requires multifactor authentication for all staff signing in from outside the stores, and Renata's own administrative role is now activated through Privileged Identity Management for a few hours at a time rather than held permanently.

Area 3: Describe the capabilities of Microsoft security solutions (35 to 40)

This is the largest area. The core infrastructure security objective covers Azure services that protect networks and workloads: Azure DDoS Protection against floods of traffic, Azure Firewall, Web Application Firewall for web applications, network segmentation with virtual networks and network security groups, Azure Bastion for secure remote access to virtual machines without exposing them to the internet, and Azure Key Vault for secrets, keys and certificates. The security management objective covers Microsoft Defender for Cloud, which assesses security posture, shows a secure score, recommends improvements and protects workloads across Azure, other clouds and on-premises servers, and the role of security benchmarks.

The Microsoft Sentinel objective covers Sentinel as a cloud-native security information and event management and security orchestration, automation and response service: it collects data from many sources, detects threats with analytics rules, supports investigation and hunting, and automates responses with playbooks. The Defender XDR objective covers Microsoft's extended detection and response suite, which correlates signals across endpoints, email and collaboration tools, identities and cloud apps into incidents, through Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps, along with threat intelligence. The alerts in Ama's queue come from Defender XDR; the team's longer-term plan to collect firewall and point-of-sale logs centrally is a Sentinel project.

Area 4: Describe the capabilities of Microsoft compliance solutions (20 to 25)

The first compliance objective covers the Service Trust Portal, where Microsoft publishes audit reports, certifications and compliance documents, and Microsoft's privacy principles. Sunil downloaded SOC 2 and ISO 27001 reports from the portal for the audit committee in November, as MSAZ-102 described. The other objectives cover Microsoft Purview: Compliance Manager and its compliance score, which track progress against regulations and standards; information protection with sensitivity labels and data loss prevention policies; data lifecycle management and records management with retention policies and labels; data governance; insider risk management; eDiscovery for finding and holding content for legal matters; and Audit, which records user and administrator activity. In Canada, Harrow & Finch's privacy obligations under PIPEDA shape how it labels and retains customer data; in the United States, the equivalent drivers are state privacy laws and payment card rules.

Two compliance ideas deserve a closer look because they are easy to blur. Compliance Manager is a workspace for tracking how well an organization meets the requirements of a regulation or standard. It breaks each regulation into improvement actions, some managed by Microsoft and some by the customer, and calculates a compliance score that rises as actions are completed. The score is a measure of progress on those actions, not a certificate of compliance; only an auditor can certify that. Retention, meanwhile, works in two directions. A retention policy or label can keep content for a set period so that it cannot be deleted too early, and it can also delete content after a period so that it is not kept longer than necessary. Privacy law often cares about both, which is why Harrow & Finch's retention plan sets a keep period and a delete period for customer records.

Keep the products in their families. Microsoft Entra handles identity and access. Microsoft Defender products detect and respond to threats, and Defender for Cloud manages cloud security posture. Microsoft Sentinel collects and correlates security data across everything. Microsoft Purview protects, governs and helps you prove compliance for data. Many SC-900 distractors are real products from the wrong family.

Authentication methods compared

The authentication objective is one of the most heavily tested parts of the Entra area, and it rewards knowing why methods differ, not just their names. A password alone is something you know, and it can be guessed, reused or stolen by phishing. Multifactor authentication adds a second factor of a different kind: something you have, such as a phone with the Authenticator app or a security key, or something you are, such as a fingerprint or face. Passwordless methods remove the password entirely. Windows Hello for Business ties sign-in to a specific device with a PIN or biometric; FIDO2 security keys are small hardware devices; the Authenticator app can approve sign-ins with a number match. Passwordless and phishing-resistant methods are generally preferred because a fake website cannot capture a factor that never leaves the device.

Self-service password reset lets users reset forgotten passwords after proving their identity with registered methods, which reduces help desk calls; Grace Oduya's store staff use it more than anyone else. Password protection blocks known weak passwords and terms you add yourself, such as the company name. In a statement series about authentication, read each statement for the factor type it describes and whether that factor could be phished.

Thinking in incidents rather than products

A helpful review exercise is to take one realistic incident and walk it from start to finish through the products, as the worked example below does. Doing this for three or four different incidents, such as a phishing email, a lost laptop, a former employee whose account is still active and an accidental share of a confidential spreadsheet, makes the boundaries between Entra, Defender, Sentinel and Purview concrete. It also shows where governance features such as access reviews and entitlement management prevent incidents before they start, which is the part of the outline many technical candidates neglect.

Original practice items

(1) Which Zero Trust principle says to give users only the access they need for the task? Use least privilege access. (2) A company wants administrators to activate their role only when needed, for a limited time, with approval. Which feature? Privileged Identity Management. (3) True or false: hashing can be reversed with the right key. False; hashing is one-way, while encryption is reversible with a key. (4) Which product shows a secure score and recommendations for Azure resources? Microsoft Defender for Cloud. (5) Which feature prevents an email containing payment card numbers from being sent outside the company? A data loss prevention policy in Microsoft Purview.

(6) Where would an auditor download Microsoft's ISO 27001 report? The Service Trust Portal. (7) A policy requires multifactor authentication when users sign in from outside the corporate network. Which feature enforces this? Conditional Access. (8) A legal team must find and preserve all messages related to a supplier dispute. Which Purview capability? eDiscovery.

Ama's last mistakes log entry before her exam is a single line: "If it is about data, Purview. If it is about threats, Defender. If it is about who you are, Entra. If it is about seeing everything, Sentinel."