SC-900 exam format: questions, score and cost
SC-900 gives you 45 minutes, requires a scaled score of 700 out of 1000 to pass, and is priced per country at the booking step. Microsoft does not publish the number of questions. This page lists what Microsoft does publish and what it means for your preparation.
| Exam title | Microsoft Security, Compliance, and Identity Fundamentals |
| Certification | Microsoft Certified: Security, Compliance, and Identity Fundamentals |
| Level | Beginner (fundamentals) |
| Duration | 45 minutes |
| Passing score | 700 on a scale of 1–1000 |
| Number of questions | Not published by Microsoft |
| Languages | English, Japanese, Chinese (Simplified), Korean, French, Spanish, Portuguese (Brazil), Russian, Arabic (Saudi Arabia), Indonesian, German, Chinese (Traditional), Italian |
| Delivery | Pearson VUE, proctored (Certiport for students and educators) |
| Price | Set per country or region; shown at booking |
| Renewal | None; fundamentals certifications do not expire |
| Current outline | Skills measured as of October 21, 2026 |
The four skill areas
| Skill area | Weight |
|---|---|
| Describe the concepts of security, compliance, and identity | 10–15% |
| Describe the capabilities of Microsoft Entra | 25–30% |
| Describe the capabilities of Microsoft security solutions | 35–40% |
| Describe the capabilities of Microsoft compliance solutions | 20–25% |
Security solutions plus Entra make up well over half of the exam. Security solutions is also the area with the most product names to keep apart, so give it the most revision time. The concepts area is the smallest, but its vocabulary (Zero Trust, defense in depth, shared responsibility, authentication versus authorization) is used in the scenarios of the other three, so it pays off beyond its 10–15%.
The October 2026 update
Microsoft publishes an outline that applies from October 21, 2026. Its change log lists the Entra and security solutions skill areas as unchanged, and marks two sections as minor changes: the identity-types section of Entra (the new outline names workload identities) and the Defender XDR section. If you study after that date, use the new outline; if you sit the exam before it, expect the previous version, which differs only in those details. The English exam is always updated first, and localised versions follow roughly eight weeks later.
Free practice tools
SC-900 has a free official practice assessment on Microsoft Learn. Use it once early to find your weakest area, and once late as a readiness check. The official exam sandbox lets you try the interface and question types for a few minutes, and shows no real content.
Question types
Expect the usual Microsoft mix: single-answer and multiple-answer multiple choice, statement series where you mark each statement as true or false, matching or drag-and-drop items, and dropdown completion of a sentence. Microsoft notes that the exam may have interactive components. There is no coding and no command-line work.
The passing score is scaled
700 of 1000 is not 70% correct. Microsoft scales scores and does not publish the conversion. Aim for a consistent 80% or more on realistic practice material instead of calculating a margin.
Time management
45 minutes is enough for a conceptual exam if you do not stall. Answer what you know quickly, flag what you do not, and come back. Product-name questions are either known or not; thinking longer rarely helps.
Preview features and languages
Most questions cover generally available features, but Microsoft states that preview features may appear if they are commonly used. If the exam is not available in your language, you can request an additional 30 minutes; arrange that before booking.
Retakes
If you fail, you can retake after 24 hours; later attempts need 14 days between them, with at most five attempts in 12 months, under Microsoft’s retake policy. See the exam day guide for the day itself and certification costs for how pricing varies.