SC-900 study scenarios: three profiles
SC-900 is a 45-minute, describe-level exam with a passing score of 700, and its biggest area is Microsoft security solutions at 35 to 40 percent, ahead of Entra at 25 to 30 percent. Your background decides which of the four skill areas you can skim and which one needs most of the hours. The three profiles below show how that plays out for an IT practitioner, a business-side reader and a complete newcomer.
Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.
The help desk or sysadmin who already uses Entra and Defender daily
Starting point. This candidate resets passwords, assigns licences and has seen MFA prompts, firewalls and endpoint alerts. The concepts area (10 to 15 percent) and much of Entra ID (25 to 30 percent) is recognition, not learning.
Where the time goes. Into the product map of the security solutions area (35 to 40 percent): which Defender product protects what, how Sentinel as SIEM and SOAR differs from Defender XDR and Defender for Cloud, and the Azure network services. Then into compliance solutions (20 to 25 percent), which a support or admin role rarely touches: Compliance Manager, sensitivity labels, retention, insider risk, eDiscovery and audit.
The trap. Answering from daily habit rather than from Microsoft’s product names. A practitioner knows what a tool does but may not know which Purview feature or Defender product carries that name, and the exam asks for the name.
Suggested order. Security solutions, compliance solutions, a quick pass on Entra governance items such as PIM and access reviews, then concepts vocabulary last.
Planning assumption. The study plan says to compress weeks 1 and 2 for IT workers. A reasonable planning assumption is three weeks at four to six hours, 12 to 18 hours, of which about 5 to 7 go to security solutions and 3 to 4 to compliance.
The business stakeholder from compliance, procurement or project work
Starting point. This candidate talks about risk, regulation and governance often, so the governance, risk and compliance wording in the concepts area is familiar. The product names, networks and identity mechanics are not.
Where the time goes. Mostly into Entra (25 to 30 percent) and security solutions (35 to 40 percent), because these require technical mental models: Conditional Access, hybrid identity, workload identities, DDoS Protection, Azure Firewall, network security groups and the Defender family. Compliance solutions (20 to 25 percent) is the home turf area, so the work there is attaching official feature names to concepts already known.
The trap. Over-investing in the compliance area because it feels comfortable, while the two largest areas together carry 60 to 70 percent of the exam. The prerequisites page notes that questions assume basic networking and identity intuition, so even one evening on public versus private addresses and subnets repays itself.
Suggested order. Concepts vocabulary, Entra, security solutions, then compliance and review.
Planning assumption. The standard four weeks at four to six hours, 16 to 24 hours, with roughly 6 to 9 hours on security solutions and 4 to 7 on Entra. The fourth week can be lighter because compliance is largely familiar.
The student or career changer with no IT background
Starting point. This candidate has not administered a tenant, may not know what a subnet or a directory is, and has never opened a Defender or Purview portal. Certiport is the booking route for students and educators, per the exam format page.
Where the time goes. First into the vocabulary of the concepts area, because Zero Trust, defense in depth, shared responsibility, authentication versus authorization and federation are used in the scenarios of every other area. Then evenly through Entra and security solutions, with a free trial tenant if available, because seeing a portal makes product names stick.
The trap. Memorising product names without the problem each one solves. A name list falls apart under a scenario question, so each of ten or so core terms should get a one-line “this solves…” note, as in the study plan’s first exercise.
Suggested order. Concepts, Entra, security solutions, compliance, then two practice passes.
Planning assumption. The study plan is built for four weeks even without a security background. For this profile a reasonable planning assumption is five weeks at four to six hours, 20 to 30 hours, with the extra week spent on prerequisites and on repeating security solutions.
SC-900 profiles side by side
| Profile | Front-loaded domains | Main risk |
|---|---|---|
| Help desk or sysadmin | Security solutions, compliance solutions | Answering from habit, not product names |
| Business stakeholder | Entra, security solutions | Spending time where it already feels safe |
| Student or career changer | Concepts, then Entra | Product names without the problem they solve |
How to check which SC-900 profile fits before booking
Take Microsoft’s free practice assessment and the free sample questions cold and sort the misses by skill area. Misses in compliance and Defender names suggest the first profile, misses in network and identity mechanics the second, and misses spread evenly the third. Then follow the four-week study plan, use the practice test as a readiness check, and read the exam format for the October 21, 2026 outline update. If you are unsure whether this or the Azure fundamentals exam comes first, the SC-900 versus AZ-900 page covers it, and SC-300 is the natural next step for identity-leaning candidates.
These hour counts are planning assumptions, not guidance from Microsoft, and they do not guarantee a pass.