SC-900 prerequisites: what you need first
SC-900 has no formal prerequisites: anyone can book it, and you need no other certification, degree or work experience. Microsoft’s audience profile does say you should be familiar with Microsoft Azure and Microsoft 365, and that you want to understand how Microsoft security, compliance and identity solutions work across both. That familiarity is not checked at booking, but the questions assume it. This page lists what it means in practice before you start the study plan.
What Microsoft says
The official audience profile describes people who want to learn the fundamentals of security, compliance and identity across cloud-based and related Microsoft services. It names three groups: business stakeholders, new or existing IT professionals and students. Nothing mentions coding, scripting or earlier certifications.
Background that helps
Identity basics
Users, groups, passwords and permissions. If you have used single sign-on at work or approved a sign-in on your phone, you already have the intuition behind Microsoft Entra ID, MFA and Conditional Access.
Basic networking
You will meet firewalls, subnets, VPN-style access and public versus private addresses in the security solutions area. You do not configure them, but you should know:
- what an IP address is, and what separates a public one from a private one;
- what a firewall does: allows or blocks traffic by rules;
- what a subnet is: a smaller range inside a network;
- what encryption in transit means: scrambling data on its way across a network.
Microsoft 365 and Azure awareness
Know the names and purposes of the main Microsoft 365 apps (email, Teams, SharePoint, OneDrive) and what a cloud subscription is. Compliance questions are mostly about protecting data in those apps, and many security questions are about Azure resources.
Security vocabulary
Phishing, malware, ransomware, a vulnerability, an incident. A single evening with a glossary covers this, and the glossary here lists related terms.
What you do not need
| Not needed | Why |
|---|---|
| Programming | No objective requires reading or writing code |
| Command-line skills | Only conceptual descriptions of tools appear |
| A subscription or tenant | Helpful for exploring, not required to pass |
| Another certification | No fundamentals exam requires a prior one |
| Prior security job | The exam is explicitly aimed at beginners and business roles |
Self-check
You are ready to start preparation if you can answer these without looking anything up:
- What is the difference between signing in and being allowed to open a file?
- Why is a second sign-in step, such as a phone prompt, more secure than a password alone?
- What does a firewall do?
- Why would a company keep some documents for years and delete others quickly?
- What does it mean to say that a cloud provider and its customer share responsibility for security?
Stuck on two or more? Spend a few days on general IT and cloud basics first. If AZ-900 background feels missing, see SC-900 versus AZ-900.
If you come from a non-technical role
Many compliance, legal, HR and procurement people take SC-900 to talk with security teams. It is achievable without a technical background, but allow five or six weeks rather than four and spend the first on the background above. The concepts and compliance areas will feel closest to your daily work.
Where it leads
Passing SC-900 is not a prerequisite for anything else. Microsoft does not require a fundamentals certification before a role-based exam, though the vocabulary helps. The usual next steps are SC-300 for identity administration, SC-200 for security operations and SC-401 for information protection. See also is SC-900 worth it.