SC-900 · CHEAT SHEET

Microsoft Certified: Security, Compliance, and Identity Fundamentals

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Describe the concepts of security, compliance, and identity

10–15%

Describe security and compliance concepts

On-premises, the organization manages the whole stack; with IaaS, PaaS and SaaS the provider takes on more layers (hosts and network, then operating system and runtime, and in SaaS the whole application). Whatever the model, the customer always keeps its data, its identities and access, its devices and its configuration. With AI, the customer remains responsible for usage, access and policies.
Defense in depth uses several overlapping layers of controls so that if one fails the next still protects the data: physical security, identity and access, perimeter, network, compute, application and data. They all serve the CIA triad: confidentiality (only authorized people see data), integrity (data is not altered without authorization) and availability (access when needed).
Zero Trust is a strategy, not a product, based on trusting no one and verifying everything, wherever the request comes from. Its three principles are verify explicitly, use least privileged access and assume breach. It is applied across seven pillars: identities, devices, applications, data, infrastructure, networks, and visibility, automation and orchestration.
Encryption makes data unreadable without the key: symmetric uses the same key to encrypt and decrypt and is fast; asymmetric uses a public and private key pair and enables digital signatures. Data is protected at rest, in transit and in use. Hashing is one-way, uses no keys and acts as a fingerprint; salting protects passwords better. Keys should be stored separately and rotated.
GRC integrates three areas: governance (rules and processes to direct and control activity), risk (identify, assess, respond to and monitor threats; accept, mitigate, transfer or avoid) and compliance (adhering to applicable laws and standards, which sets minimums and is not the same as security). Key concepts: data residency, data sovereignty and data privacy.

Define identity concepts

With cloud apps, remote work, personal devices and partner access, the network perimeter is no longer a reliable boundary, and the question becomes who or what is making each request. That is why identity is the new perimeter. Identities can be human, device, workload or agent, and an identity infrastructure rests on four pillars: administration, authentication, authorization and auditing.
Authentication is the process of proving you are who you say you are, answering the question of who you are. It rests on factors: something you know, something you have and something you are. A single factor, such as a password, is vulnerable; multifactor authentication requires two or more factors from different categories and greatly reduces the risk of account takeover. It confirms identity only, not permissions.
Authorization determines what an already authenticated identity is allowed to do, answering the question of what you are allowed to do. It is based on roles, permissions and attributes, and is always evaluated after successful authentication. The principle of least privilege grants only the minimum access needed, reducing the damage from a compromised account and the risk of accidental data loss.
An identity provider creates and manages identity information and offers authentication, authorization and auditing to applications, which delegate sign-in to it. After verifying credentials it issues security tokens: the ID token proves sign-in and the access token grants permission to a resource. It enables single sign-on, and communicates using OpenID Connect, OAuth 2.0 and SAML.
A directory service stores information about network objects (users, devices, groups, policies, applications) and makes it available to users and applications. Active Directory Domain Services (AD DS) is Microsoft's on-premises directory service; the server that runs it is a domain controller. It was designed for on-premises networks and does not natively support SaaS or OAuth 2.0 and OpenID Connect; Microsoft Entra ID is its cloud evolution.

2. Describe the capabilities of Microsoft Entra

25–30%

Describe function and identity types of Microsoft Entra ID

Microsoft Entra ID is Microsoft's cloud-based identity and access management service and the foundation of the Microsoft Entra family. Every Microsoft 365, Azure or Dynamics subscription already includes a Microsoft Entra tenant, which holds a directory of users, groups, devices and app registrations and acts as a security and administrative boundary. It can be synchronized with on-premises AD or used standalone.
Microsoft Entra ID supports user identities (people, as members or guests), device identities (registered, joined or hybrid joined) and workload identities (applications, service principals and managed identities). Managed identities, system-assigned or user-assigned, remove the need to manage credentials. Device and workload identities together form machine identities, distinct from human ones.
Hybrid identity is a common identity for authentication and authorization to all resources, on premises or in the cloud. It is achieved through provisioning and synchronization between Active Directory and Microsoft Entra ID; Microsoft Entra Cloud Sync uses a lightweight agent for this. Sign-in can be handled with password hash synchronization, pass-through authentication or federation with AD FS.

Describe authentication capabilities of Microsoft Entra ID

Microsoft Entra ID offers passwords, phone methods (SMS and voice call), OATH tokens, Temporary Access Pass, QR codes for frontline workers and passwordless methods such as Windows Hello for Business, passkeys (FIDO2), Microsoft Authenticator and certificate-based authentication. Some serve as a primary factor and others only as a secondary one; passkeys and certificates are phishing resistant.
Multifactor authentication requires two or more factors: something you know, something you have and something you are. Even if the password is weak or exposed, the extra factor is hard to obtain or duplicate. Microsoft Entra requests MFA during sign-in without changing applications. Security defaults give a simple baseline and Conditional Access requires MFA based on conditions.
Microsoft Entra password protection blocks weak passwords and their variants: the global banned password list is applied automatically to all users and the custom list adds organization-specific terms such as brand names. It can be extended to on-premises AD DS with a proxy service and an agent on domain controllers. Self-service password reset avoids help desk calls and account recovery covers the loss of every method.

Describe access management capabilities of Microsoft Entra ID

Conditional Access is the Zero Trust policy engine of Microsoft Entra: it combines signals (user, location, device, application, risk) to decide whether to block access or grant it, possibly requiring MFA, a compliant device or an authentication strength. It is enforced after first-factor authentication and also supports session controls.
Microsoft Entra roles grant granular permissions to administrators following the principle of least privilege. An assignment joins a security principal, a role definition and a scope (tenant, administrative unit or object). Built-in roles have fixed permissions, and custom roles can be created. Azure roles, by contrast, control Azure resources rather than Microsoft Entra resources.

Describe identity protection and governance capabilities of Microsoft Entra

Microsoft Entra ID Governance helps ensure the right people have the right access to the right resources through automation, delegation and visibility. It covers the identity lifecycle (lifecycle workflows), the access lifecycle (entitlement management with access packages, and access reviews) and the privileged access lifecycle (Privileged Identity Management).
Access reviews let organizations regularly check who still needs access to group memberships, applications, Microsoft Entra and Azure resource roles, and access packages. They can recur, reviewers can be group owners, selected users, managers or the users themselves, and the results can be applied automatically.
Privileged Identity Management (PIM) manages, controls and monitors privileged access to Microsoft Entra roles, Azure resource roles and groups. It offers just-in-time, time-bound access, approval, MFA, justification, notifications, access reviews and audit history. An eligible assignment must be activated before use, while an active one needs no action.
Microsoft Entra ID Protection detects, investigates and remediates identity-based risks such as leaked credentials, anonymous IP addresses or password spray. It distinguishes sign-in risk from user risk and classifies them as low, medium or high. Risk-based Conditional Access policies enable self-remediation, for example with MFA or a secure password change.

3. Describe the capabilities of Microsoft security solutions

35–40%

Describe core infrastructure security services in Azure

Azure DDoS Protection defends Azure resources that have public IP addresses against distributed denial-of-service attacks at layers 3 and 4. It monitors traffic continuously, tunes its thresholds automatically through traffic profiling, and provides metrics, analytics and alerts. To protect web applications at layer 7 it is combined with a web application firewall.
Azure Firewall is a managed, cloud-based network security service: a stateful firewall with built-in high availability and cloud scalability. It filters traffic by IP, port, protocol and FQDN, uses threat intelligence, supports SNAT and DNAT, and is managed centrally with Azure Firewall Manager. Premium adds IDPS and TLS inspection.
Azure Web Application Firewall provides centralized protection of web applications from common exploits such as SQL injection and cross-site scripting. It is deployed with services such as Application Gateway and Azure Front Door, uses managed and custom rules, offers bot protection, and can run in detection or prevention mode.
An Azure virtual network is a private, isolated portion of network dedicated to your subscription, and it is segmented into subnets. Subnets let you apply different rules to each tier, but Azure routes traffic between them by default, so you restrict it with network security groups or network virtual appliances. Several virtual networks are connected with peering.
A network security group (NSG) filters traffic between Azure resources with allow or deny rules based on source, destination, port, protocol and direction. Rules are processed by priority (lowest number first) and processing stops at the first match. NSGs are stateful and can be associated with subnets or network interfaces.

Describe security management capabilities of Azure

Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP) that protects Azure, AWS, GCP and on-premises resources. It combines cloud security posture management (CSPM), DevSecOps and cloud workload protection (CWPP), and produces recommendations, alerts and incidents that correlate related alerts.
Cloud security posture management (CSPM) continuously assesses Azure, AWS and GCP resources and issues recommendations to reduce misconfigurations and risks. The secure score summarizes the security posture: the higher it is, the lower the identified risk. Advanced capabilities, such as governance or attack path analysis, require the Defender CSPM plan.
A Defender for Cloud security policy includes standards (benchmarks such as the Microsoft cloud security benchmark, regulatory compliance standards and custom standards) that define controls and assessment logic. When a resource does not meet a control, a recommendation with remediation steps is generated, and the regulatory compliance dashboard shows the state of each standard.
Cloud workload protection is turned on with Defender plans for specific resource types, such as servers, storage, databases, containers, App Service or Key Vault. These plans provide advanced detections that generate threat alerts, and capabilities such as just-in-time VM access or malware scanning for storage.

Describe capabilities of Microsoft Sentinel

A SIEM collects, aggregates and analyzes data from applications, devices, servers and users across the organization to detect and investigate incidents. SOAR works afterwards: it automates response workflows for the alerts the SIEM generates. Microsoft Sentinel is a cloud-native SIEM that is also a SOAR platform, with automation rules and playbooks built on Azure Logic Apps.
Microsoft Sentinel analytics rules run regularly against collected data and generate alerts, which are grouped into incidents. Types include scheduled, near-real-time (NRT) and anomaly rules (which create no alerts of their own), plus Fusion multistage attack detection. Hunting proactively explores what no alert has flagged, and UEBA detects deviations from behavioral baselines.

Describe threat protection with Microsoft Defender XDR

Microsoft Defender XDR natively coordinates detection, prevention, investigation and response across endpoints, identities, email and applications. It groups related alerts into incidents, supports cross-product threat hunting with queries, and can contain attacks in progress through automatic attack disruption. It correlates signals from the licensed Microsoft products.
Microsoft Defender for Office 365 is the primary email and collaboration security solution for Microsoft 365 and builds on the protections built into every cloud mailbox. Safe Links verifies URLs at time of click, Safe Attachments detonates attachments in a virtual environment, and attack simulation training identifies vulnerable users with simulated phishing.
Microsoft Defender for Endpoint is an endpoint security platform to prevent, detect, investigate and respond to advanced threats on Windows, macOS, Linux, Android and iOS. It includes attack surface reduction (prevention), next-generation protection and endpoint detection and response (EDR), and it feeds its signals into the unified Defender portal.
Microsoft Defender for Cloud Apps protects SaaS apps with CASB functionality: Cloud Discovery finds the apps in use (shadow IT) and scores their risk, while SSPM recommends configuration improvements. It controls sensitive data, monitors sessions with Conditional Access app control and, through app governance, protects OAuth permissions between apps.
Microsoft Defender for Identity detects, investigates and responds to identity-based attacks using signals from on-premises Active Directory and Microsoft Entra ID. Its sensors run on the identity infrastructure and send only the required signals. It covers reconnaissance, compromised credentials, lateral movement and AD domain dominance, and assesses posture, including lateral movement paths.

4. Describe the capabilities of Microsoft compliance solutions

20–25%

Describe Microsoft Service Trust Portal and privacy principles

The Service Trust Portal is Microsoft's public site for publishing audit reports from external auditors and whitepapers on how cloud services protect data. Content is organized into certifications and regulations, reports and artifacts, industry and regional resources, and resources for your organization. Some content requires a Microsoft Entra organization account.
Microsoft outlines its privacy commitment in four areas: data control, data location, data security and data defense. You can access, modify or delete your data, choose where it is stored and rely on encryption at rest and in transit. Microsoft does not use your data for advertising and directs government requests to the customer.

Describe compliance management capabilities of Microsoft Purview

The Microsoft Purview portal is a unified experience for data security, data governance, and risk and compliance solutions, with a single entry point for settings, search and permissions. The home page shows solution cards based on your permissions and subscription, plus compliance posture status coming from Compliance Manager.
Compliance Manager helps assess and manage compliance, including multicloud environments. It is organized around controls (Microsoft managed, your own or shared), assessments, regulations and improvement actions, which can be assigned, tested and backed with evidence. Its recommendations do not guarantee compliance: the organization must validate its own controls.
The compliance score measures progress in completing recommended improvement actions within controls. Each action contributes points according to risk: mandatory preventative actions are worth more than discretionary ones, and detective and corrective actions are worth less. It helps you understand your posture and prioritize, and the initial score starts from the Microsoft 365 data protection baseline.

Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview

Microsoft Purview identifies sensitive content with several classifier types: pattern-based sensitive information types, named entities, exact data match using hashed values, trainable classifiers that learn from examples, template fingerprinting and OCR for images. Data explorer shows the classified items.
Content explorer shows a current snapshot of items that have a sensitivity label, a retention label or a sensitive information type, and lets you see where they are. Activity explorer gives a historical view of the actions taken on labeled content, based on the unified audit log, and is not a real-time view.
Sensitivity labels classify and protect content with encryption and markings such as watermarks or headers, and they are stored in metadata, so they travel with the file. Label policies publish them to specific users or groups and can set a default label, mandatory labeling and a justification when a label is lowered.
Data loss prevention (DLP) uses policies to identify, monitor and protect sensitive items, such as card numbers, in Exchange, SharePoint, OneDrive, Teams, devices and on-premises repositories. Depending on the location, it can show a policy tip, block with or without override, or move the file to quarantine.
Records management helps meet legal and regulatory obligations by managing retention, records declaration and disposition. Records are declared with retention labels; a regulatory record is stricter still, because nobody can remove its label. It includes a file plan, event-based retention and disposition review.

Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview

Insider Risk Management correlates signals to detect malicious or inadvertent risks, such as data theft by departing users or information leaks. It uses policy templates, raises alerts that are triaged and turned into cases, and protects privacy through pseudonymization. Cases can be escalated to eDiscovery.
eDiscovery identifies, preserves, reviews and exports content from Exchange, Teams, OneDrive, SharePoint and other services as evidence in investigations and legal cases. A case groups searches, holds and review sets, and its members control access. Holds prevent deletion during the investigation and review sets allow filtering and tagging.
Purview Audit records thousands of user and admin operations in a unified log, which can be searched by activity, user and date range. Audit (Standard) is enabled by default; Audit (Premium) adds retention policies, intelligent insights and higher bandwidth for the Management Activity API.

Practice this certification