SC-900 and SC-100 are the entry and expert bookends of the Microsoft security track. SC-900 (Security, Compliance, and Identity Fundamentals) is a beginner exam introducing the concepts and the Microsoft security stack. SC-100 (Cybersecurity Architect Expert) is a top-of-track exam for designing an organization-wide security strategy. There are several associate exams in between.
SC-900 vs SC-100 at a glance
| SC-900 | SC-100 | |
|---|---|---|
| Level | Foundational | Expert |
| Best for | Anyone new to Microsoft security, compliance, and identity | Experienced security architects and senior engineers |
| Main focus | Core security/compliance/identity concepts and the Microsoft Entra, Defender, and Purview families | Designing a Zero Trust strategy and cybersecurity architecture across the organization |
| Prerequisites | None | Advanced security experience; an associate security certification recommended |
| Difficulty | Beginner - conceptual | Advanced - strategy and design, scenario-heavy |
| Exam length | 45 min | 120 min |
| Passing score | 70% | 70% |
Key differences
- Level. SC-900 is foundational and needs no experience. SC-100 is expert level and assumes advanced, hands-on security knowledge.
- Scope. SC-900 introduces concepts and product families. SC-100 is about designing a Zero Trust strategy and making architecture decisions across identity, operations, data, and applications.
- Sequence. Microsoft recommends earning an associate security certification (such as SC-200 or SC-300) between SC-900 and SC-100, because SC-100 builds on that depth.
Which should you take?
Take SC-900 if you are new to Microsoft security or want a broad overview of the security, compliance, and identity stack. Take SC-100 only once you have advanced security experience and ideally an associate certification - it is a design-level exam, not an introduction. Do not jump straight from SC-900 to SC-100 without the associate-level knowledge in between.
Frequently asked questions
Can I take SC-100 right after SC-900?
You can, but it is not recommended. SC-100 is an expert design exam that assumes advanced security experience. Microsoft recommends earning an associate certification such as SC-200 or SC-300 first.
Is SC-900 enough to get a security job?
SC-900 is a foundational certification that proves you understand the concepts. It is a good first step, but most security roles look for associate-level certifications (SC-200, SC-300) and hands-on experience.
What is the difference between SC-900 and SC-100?
SC-900 is a beginner fundamentals exam covering concepts and the Microsoft security stack. SC-100 is an expert exam about designing a cybersecurity architecture and Zero Trust strategy.