SC-900 vs AZ-900: which exam first?
Take AZ-900 first if you want a general cloud foundation or plan to work with Azure infrastructure; take SC-900 first if your job or next step is security, identity or compliance. Neither is a prerequisite for the other, and Microsoft requires no fundamentals exam before any role-based exam. The choice is about what you want to learn first and where you are heading.
The two exams side by side
| SC-900 | AZ-900 | |
|---|---|---|
| Subject | Security, compliance and identity concepts and Microsoft products | Cloud concepts, Azure services, governance and cost |
| Duration | 45 minutes | 45 minutes |
| Passing score | 700 / 1000 | 700 / 1000 |
| Level | Fundamentals | Fundamentals |
| Biggest area | Security solutions, 35–40% | Architecture and services, 35–40% |
| Renewal | Does not expire | Does not expire |
Both are conceptual, both last 45 minutes, and neither needs a subscription or any code. See the AZ-900 hub for the other side.
What overlaps
Identity and security appear in both. AZ-900 touches Microsoft Entra ID, multifactor authentication, Conditional Access, role-based access control, Zero Trust, defense in depth and Microsoft Defender for Cloud at a high level. SC-900 treats those same topics as its main content and goes much deeper. If you take AZ-900 first, a good part of the SC-900 concepts and Entra areas will already feel familiar.
What differs
AZ-900 is about the cloud platform: regions, compute, networking, storage, pricing and management tools. SC-900 is about protecting and governing it: how identities are verified, how threats are detected and how data is classified and retained, with products such as Microsoft Sentinel, the Defender family and Microsoft Purview that AZ-900 hardly mentions. SC-900 also covers Microsoft 365 workloads, not just Azure.
Which first
| If you are… | Start with |
|---|---|
| New to IT and cloud | AZ-900, then SC-900 |
| In a security, risk, privacy or audit role | SC-900 |
| An IT admin heading towards Azure administration | AZ-900 |
| A business stakeholder who buys or oversees security | SC-900 |
| Aiming at identity administration | SC-900, then SC-300 |
Doing both is common and cheap in time: each is a few weeks of part-time study, and the overlap shortens the second one.
Where each leads
SC-900 sits in front of the Microsoft security role-based exams: SC-200 for security operations analysts, SC-300 for identity and access administrators, and SC-401 for information protection and compliance work. AZ-900 leads to the Azure role-based exams such as AZ-104. Fundamentals are optional for all of them, but the vocabulary carries over.
If you are unsure, read the SC-900 exam format and the prerequisites, and compare the outlines page by page. A look at what the certification is worth also helps decide.