Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)

For IT leaders: When help desk technicians, sysadmins, and compliance stakeholders use terms like Zero Trust, least privilege, and shared responsibility differently, risk reviews stall and audit conversations take longer than they should. This course gives your team a shared Microsoft security, compliance, and identity baseline. It covers identity as the security perimeter, authentication and authorization, multifactor authentication, restricted access by IP address and location, Microsoft 365 security reporting areas, compliance score concepts, data governance across on-premises, cloud, and application data, and compliance standards such as GDPR, HIPAA, ISO, SOC, FINRA, and NIST.

Role fit: The course suits new IT hires, help desk and desktop support technicians, experienced technicians who want to validate fundamentals, and non-technical risk or compliance staff. The instruction stays conceptual on purpose. Walkthroughs in Azure and Microsoft 365 security and compliance areas show what each tool area does without deep configuration, so learners need no prior Microsoft security experience.

Time investment: Plan for about 21.7 hours per learner across 25 skills. Most skills run roughly 50 minutes, so learners can work through them in short weekly blocks alongside ticket queues.

Change-management note: Treat this course as the vocabulary layer, not the hands-on administration layer. Pair it with role-based Microsoft security training for the staff who will configure these tools.

Team Leads can bundle the course into Playlists for an onboarding cohort or an SC-900 certification push. Training Managers can use Team Reporting to track per-learner progress and completion before moving the team on to associate-level training.

IT teams complete this training so that help desk technicians, sysadmins, and compliance stakeholders work from the same security vocabulary. That shared baseline cuts down on misrouted tickets and keeps risk and audit conversations moving.

• Fewer password-reset escalations: Your team learns how Self-Service Password Reset (SSPR) in Azure AD lets users reset their own passwords. That frees help desk staff from repetitive resets and gives them a clear case for enabling it for user groups.
• Safer collaboration with partners: Learners see how identity governance and external identities let a partner company reach specific project resources through group membership, without handing out broad access. The principle of least privilege is applied throughout.
• Faster audit and compliance responses: Microsoft Purview coverage shows how compliance score, security templates, data governance, and labeling help organizations meet internal and external compliance standards. Data lifecycle management covers retaining records such as financial and HR files only as long as required.
• Clearer security triage: Your team learns to recognize common attacks such as port scanning and DDoS against DNS. They also learn how Microsoft Secure Score, multi-factor authentication, safe links, legacy authentication controls, and SIEM concepts fit into a broader Microsoft security program.

By treating breach as a working assumption, this Zero Trust-focused training helps your team build habits of vigilance before moving on to role-based Microsoft security training.

Knowledge

• Zero Trust principles, including the assume-breach mindset, defense in depth, the shared responsibility model, and the principle of least privilege
• Common threats such as port scanning, eavesdropping, man-in-the-middle, and DDoS attacks, plus the role of encryption in protecting data in transit
• Identity fundamentals: authentication, authorization, and accounting; Active Directory; Azure AD (Microsoft Entra ID) as identity-as-a-service; hybrid identity synchronization; and external identities for partner collaboration
• Azure and Microsoft 365 security capabilities, including network segmentation with subnets and virtual networks, security baselines, SIEM/SOAR/XDR concepts, and the Microsoft 365 Defender portal
• Microsoft Purview compliance capabilities: sensitivity labels and data classification, DLP policy scoping, eDiscovery and audit, data lifecycle management and retention, insider risk management, and compliance score improvement

Ability

• Explain Microsoft security, compliance, and identity terms to both technical teams and non-technical risk stakeholders
• Tell the difference between joining and registering devices in Azure AD, and describe device posture signals such as operating system and version
• Describe how self-service password reset (SSPR) and other authentication methods reduce repetitive help desk password resets
• Match an identity, threat, or compliance use case to the right Microsoft tool, such as Entra ID, Defender, Intune, or Purview
• Interpret compliance score improvement actions, and describe how Purview helps organizations analyze, account for, and protect data across on-prem, cloud, and application locations
• Prepare security teams for the SC-900 exam with a structured review of fundamentals, then continue into role-based Microsoft security training