SC-900 study plan

Your step-by-step plan

1. Read the blueprint and book a date

   Day 1

   Read the four domains and their weights, then book a provisional date now, because a fixed date turns open-ended study into a plan. Note where the marks are: Microsoft Security Solutions and Microsoft Entra Capabilities together are nearly two-thirds of the exam, so they earn the most attention.

2. Lock the concepts vocabulary

   Week 1

   Start with the concepts domain because every later question reuses its terms. Drill shared responsibility, Zero Trust, defence in depth, encryption at rest versus in transit, and authentication versus authorisation until each definition is automatic. Use this guide's recall prompts: cover the answer, name the concept from the description, then reveal.

3. Map the Microsoft Entra capabilities

   Week 1 to 2

   Sort Entra into its four jobs: identity types, authentication, access management, and protection and governance. Memorise which authentication methods are primary and which are phishing-resistant, and separate least privilege from just-in-time access. Practise reading a sign-in or access scenario and naming the single Entra feature that fits.

4. Go deep on Microsoft security solutions

   Week 2 to 3

   This is the largest domain, so give it the most time. Build a one-line job description for each Azure security service (Bastion, network security group, Firewall, Key Vault, DDoS, WAF) and for each Defender for Cloud plan, then place Sentinel as SIEM and SOAR and Defender XDR as cross-estate threat protection. Drill the near-neighbour pairs until the wording alone decides them.

5. Cover Microsoft compliance solutions

   Week 3

   Learn Purview as discrete solutions: classification (sensitive information types, trainable classifiers), information protection and labels, data lifecycle, and the investigation tools of insider risk, eDiscovery, and audit. Add Compliance Manager regulatory templates and the mandatory versus discretionary action distinction, and the privacy principles around subprocessors.

6. Drill weak domains and space the review

   Week 4

   Use your per-domain accuracy on practice questions to attack the two domains dragging you down, not to re-read what you already know. Then revisit each domain's recall prompts after a few days and again a week later, because spacing roughly doubles what sticks compared with cramming.

7. Sit a timed mock and calibrate

   Week 4 to 5

   Take at least one full timed practice run to rehearse pacing and the flag-and-return habit. Treat the score as a per-domain readiness signal rather than a single number, and review every missed question, naming the discriminator you misread, before you book or sit.

Frequently asked questions