SC-900 study plan: pass in 4 weeks

Four weeks is realistic for SC-900 at 4–6 hours a week, even if you start without a security background. Cover the four skill areas in an order that builds on itself: concepts and Microsoft Entra first because every later product assumes them, then the largest area (security solutions), then compliance and review. Weights decide where the hours go: security solutions is 35–40%, so it gets the most.

Before you start

Read the official skills outline once. It is short and lists every objective.
Take the free Microsoft practice assessment cold. The score does not matter; the per-area breakdown does.
Use a free Microsoft 365 or Azure trial tenant if you can. Looking at the Entra admin center, the Defender portal and the Purview portal makes product names stick. It is optional.

Week 1: concepts and Microsoft Entra (concepts 10–15%, Entra 25–30%)

Goal: speak the vocabulary and understand how identity is protected.

Concepts: shared responsibility model, defense in depth, Zero Trust principles, encryption versus hashing, governance, risk and compliance; authentication versus authorization, identity providers, directory services, federation.
Entra ID: identity types including workload identities, hybrid identity, authentication methods, MFA, passwordless, password protection and self-service password reset.
Access management: Conditional Access, Entra roles and RBAC.
Protection and governance: ID Protection, Privileged Identity Management, access reviews, ID Governance.

Exercise: write one line for each of ten terms (for example, PIM, Conditional Access, federation) saying what problem each solves.

Week 2: Azure and Microsoft security solutions part one (35–40%)

Goal: know which infrastructure security service answers which requirement.

Network and infrastructure security: DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation, network security groups, Bastion and Key Vault.
Defender for Cloud: cloud security posture management, secure score, recommendations and workload protection.

Exercise: draw a small network with a web tier, a database tier and an admin path, and label which service protects each link.

Week 3: security solutions part two (35–40%)

Goal: tell the Defender products apart.

Microsoft Sentinel: SIEM versus SOAR, threat detection, hunting, automation.
Defender XDR: Defender for Office 365, Endpoint, Cloud Apps, Identity, Vulnerability Management, Threat Intelligence and the Defender portal.

Exercise: make a table with one row per Defender product: what it protects and one example alert.

Week 4: compliance and review (20–25%)

Goal: know what Purview offers and what each feature does.

Trust and privacy: Service Trust Portal and Microsoft’s privacy principles.
Compliance management: Compliance Manager and compliance score.
Data protection: classification, sensitivity labels, DLP, retention labels and policies, records management.
Risk and investigation: insider risk management, eDiscovery and audit.

Review: take the free 20-question practice test, repeat the official practice assessment, then drill the lowest-scoring area with its guide in this section.

If you already work in IT

Compress weeks 1 and 2. You probably know MFA, firewalls and NSGs, so spend the saved time on the product map: which Defender product protects what, and which Purview feature does what. Those names, not the concepts, cost most candidates their points.

How to know you are ready

You can name, for a given requirement, the product or feature that fits (for example, hold documents for a legal case versus stop a file from leaving the company).
You can explain the difference between Sentinel, Defender XDR and Defender for Cloud in one sentence each.
You score 80% or more on realistic practice questions twice in a row, on different question sets.

Then book it. The exam format covers the mechanics, the cheat sheet helps on the last evening, and the exam day guide covers the day itself.