SC-900 vs AZ-900 — take AZ-900 first if you are brand new to Microsoft cloud and want the broadest possible foundation. Take SC-900 first if your current or target role already touches security operations, identity management, governance, or compliance. Both are Microsoft fundamentals certifications that cost $165, never expire, and require no prior experience. The decision comes down entirely to whether your career is pointed at cloud infrastructure or cybersecurity.
Pick both if you want the strongest Microsoft fundamentals combination on a junior resume — once you have studied for one, the second takes only 1 to 2 additional weeks because the content overlap is significant.
SC-900 vs AZ-900: Key Differences at a Glance
| Factor | AZ-900 | SC-900 |
| Full name | Microsoft Azure Fundamentals | Microsoft Security, Compliance, and Identity Fundamentals |
| Exam cost | $165 USD | $165 USD |
| Exam duration | 60 minutes | 60 minutes |
| Questions | 32 to 40 | 40 to 60 |
| Passing score | 700 out of 1000 | 700 out of 1000 |
| Expiration | Never expires | Never expires |
| Prerequisites | None | None |
| Coding required | No | No |
| Study time | 2 to 4 weeks | 2 to 3 weeks |
| Free study resources | Complete Microsoft Learn path | Complete Microsoft Learn path |
| Primary focus | Azure cloud platform — infrastructure, services, pricing, governance | Security, compliance, and identity across Microsoft 365 and Azure |
| Best for | Cloud career starters, infrastructure professionals, beginners | Security career starters, compliance professionals, IT admins moving into security |
| Leads to | AZ-104, AI-200, AI-103, SC-500 — all Azure paths | SC-200, SC-300, SC-400, SC-500 — all Microsoft security paths |
| Content overlap | Azure governance, identity (Entra ID), shared responsibility model | Azure governance, identity (Entra ID), shared responsibility model |
| DoD 8570 approved | No | No — higher level SC certs required for DoD |
| Job posting recognition | Very high — listed across cloud job postings globally | Growing — especially in security and compliance roles |
What Is the Main Difference Between SC-900 and AZ-900?
Think of AZ-900 as the master architectural blueprint for the entire Microsoft Azure ecosystem. It details every floor — the compute services, the networking, the storage, and how the structure scales. AZ-900 gives you a holistic view of what the Azure platform is and what is possible within it.
Think of SC-900 as the security layer installed on top of that blueprint. It covers every lock, alarm, access control, and compliance certificate that governs who can enter the building, what they can do inside, and how the organization demonstrates it is following the rules.
AZ-900 asks: What is Azure and how does it work? SC-900 asks: How does Microsoft secure Azure and Microsoft 365 and how do organizations stay compliant?
Both are literacy certifications — they validate that you understand a technology domain at a conceptual level, not that you can implement it technically. Neither requires hands-on configuration. Neither requires coding. Both are entirely knowledge-based exams accessible to candidates from any background.
What Does AZ-900 Cover?
AZ-900 is the Microsoft Azure Fundamentals certification. It is the most popular Microsoft fundamentals exam and has been the standard starting point for anyone entering the Azure ecosystem since its launch.
AZ-900 Exam Domains
| Domain | Weight | What You Learn |
| Cloud concepts | 25-30% | IaaS vs PaaS vs SaaS, public vs private vs hybrid cloud, consumption-based pricing, scalability, high availability, CapEx vs OpEx, shared responsibility model |
| Azure architecture and services | 35-40% | Azure regions and availability zones, resource groups, subscriptions, compute services, networking services, storage services, database services, Azure AI and analytics overview |
| Azure management and governance | 30-35% | Azure Cost Management, Azure Policy, RBAC, Azure Blueprints, Microsoft Purview, Azure Monitor, Service Trust Portal, Compliance Manager |
Important 2026 update: Microsoft refreshed the official AZ-900 objectives in January 2026 with minor updates to the identity and security section. The structure and domain weightings stayed the same. Candidates using pre-2026 study materials may be missing content around the updated identity and governance topics.
Who AZ-900 is for: Complete beginners to cloud computing and IT, business professionals working with Azure-powered organizations, IT administrators starting their cloud journey, anyone who needs foundational cloud vocabulary before specializing in Azure administration, development, AI, or security.
What Does SC-900 Cover?
SC-900 is the Microsoft Security, Compliance, and Identity Fundamentals certification. It covers the complete Microsoft security ecosystem — how Microsoft protects Azure and Microsoft 365 environments and how organizations achieve compliance across both platforms.
SC-900 Exam Domains
| Domain | Weight | What You Learn |
| Security, compliance, and identity concepts | 10-15% | Zero trust principles, shared responsibility, defense in depth, encryption fundamentals, common threats and mitigations |
| Microsoft identity and access management solutions | 25-30% | Microsoft Entra ID, authentication methods, MFA, conditional access, Privileged Identity Management, identity governance |
| Microsoft security solutions | 35-40% | Microsoft Defender XDR, Microsoft Sentinel, Defender for Cloud, Azure DDoS Protection, Azure Firewall, network security |
| Microsoft compliance solutions | 25-30% | Microsoft Purview, compliance manager, information protection, data lifecycle, communication compliance, audit and eDiscovery |
The security solutions domain at 35 to 40 percent is the exam’s center of gravity. Microsoft Defender products, Sentinel, and Defender for Cloud together make up the largest portion of the exam. Candidates who underinvest in this domain consistently fall short of the 700 passing score.
Who SC-900 is for: IT professionals transitioning into security roles who need a structured introduction, business stakeholders including project managers and compliance officers who interact with security teams, students and career changers exploring cybersecurity, Azure and Microsoft 365 administrators who want to formalize their security knowledge, and anyone planning to pursue SC-200, SC-300, or SC-400 as a warm-up foundation.
The Content Overlap Between AZ-900 and SC-900
This is the insight most comparison articles miss — and it is the most practically useful fact for anyone considering both certifications.
AZ-900 and SC-900 share meaningful content in three specific areas:
Microsoft Entra ID (formerly Azure Active Directory): AZ-900 covers Entra ID at an overview level as part of the Azure management and governance domain. SC-900 covers Entra ID deeply as 25 to 30 percent of the exam including authentication methods, MFA, Conditional Access, and PIM. SC-900 deepens what AZ-900 introduces.
Shared responsibility model: Both exams cover the cloud shared responsibility model — what Microsoft manages versus what the customer manages in IaaS, PaaS, and SaaS contexts. Study it once and it applies to both exams.
Azure governance and compliance: AZ-900’s governance domain and SC-900’s compliance domain overlap in Microsoft Purview coverage, compliance frameworks, and the Service Trust Portal. Content studied for one exam accelerates the other.
The practical implication: Once you have studied for AZ-900, SC-900 preparation typically takes only 1 to 2 additional weeks. The identity and governance content you learned for AZ-900 transfers directly to SC-900’s heaviest domains. Conversely, if you take SC-900 first, AZ-900’s governance domain will feel very familiar.
SC-900 vs AZ-900: Difficulty Comparison
Both are beginner-level certifications designed for candidates with no prior technical experience. Neither is a significant challenge for candidates who study properly using official Microsoft Learn resources.
| Factor | AZ-900 | SC-900 |
| Overall difficulty | Beginner | Beginner |
| Slightly harder area | Azure management and governance domain | Microsoft compliance solutions domain |
| Questions | 32 to 40 | 40 to 60 |
| Study time | 2 to 4 weeks | 2 to 3 weeks |
| Pass rate | 75 to 85 percent prepared candidates | Similar — slightly higher pass rate reported |
| Free study resources | Complete Microsoft Learn path | Complete Microsoft Learn path |
| Hardest domain | Azure governance and compliance | Compliance solutions including Purview and eDiscovery |
| Most common failure reason | Underestimating governance domain | Underestimating compliance and eDiscovery product names |
SC-900 is reported by many candidates as slightly easier than AZ-900 because the Microsoft security product names are more memorable as a structured ecosystem, while AZ-900’s Azure service catalog is broader and more varied. However the difference in difficulty is minimal — both certifications are accessible to candidates who complete the free Microsoft Learn preparation path.
SC-900 vs AZ-900: Career Paths
The most important difference between these two certifications is not what they cover — it is where they lead.
What AZ-900 Leads To
| Next Certification | Career Direction | Average Salary |
| AZ-104 Azure Administrator | Cloud administration and infrastructure | $88,000 to $161,000 |
| AI-200 Azure AI Cloud Developer | Cloud-native AI application development | $110,000 to $150,000 |
| AI-103 Azure AI Apps and Agents Developer | AI application and agent development | $120,000 to $160,000 |
| AI-300 MLOps Engineer | AI operations and model lifecycle | $115,000 to $155,000 |
| SC-500 Cloud and AI Security Engineer | Cloud and AI security engineering | $115,000 to $155,000 |
| AZ-305 via AZ-104 | Cloud architecture | $130,000 to $180,000 |
What SC-900 Leads To
| Next Certification | Career Direction | Average Salary |
| SC-200 Security Operations Analyst | Threat detection and SOC operations | $85,000 to $115,000 |
| SC-300 Identity and Access Administrator | Identity management and IAM engineering | $90,000 to $125,000 |
| SC-400 Information Protection Administrator | Data governance and compliance | $85,000 to $115,000 |
| SC-500 Cloud and AI Security Engineer | Cloud and AI security engineering | $115,000 to $155,000 |
| SC-100 Cybersecurity Architect Expert | Enterprise security architecture | $140,000 to $185,000 |
The convergence point: Both AZ-900 and SC-900 lead naturally toward SC-500 (Cloud and AI Security Engineer Associate, launching July 2026). AZ-900 provides the cloud infrastructure foundation. SC-900 provides the security concepts foundation. Together they create the strongest possible preparation for the SC-500 credential which is the most important new Microsoft security certification of 2026. For the full picture of SC-500, our SC-500 certification guide covers every detail.
Should You Take AZ-900 or SC-900 First?
Take AZ-900 first if: You are brand new to Microsoft cloud and IT certifications. AZ-900 is the default starting point because it reduces confusion later. Learning the cloud platform before memorizing the security layer is the more logical sequence for most candidates.
Take SC-900 first if: Your current role already involves security, identity, governance, or compliance work. If you manage user accounts, review access permissions, handle compliance reports, or work in a SOC environment, SC-900 maps more directly to your existing knowledge and unlocks more relevant follow-on certifications.
Take both if: You want the strongest Microsoft fundamentals combination on a junior resume. The content overlap between the two certifications means the second certification takes only 1 to 2 additional weeks of study after passing the first. The combined credential demonstrates both cloud platform literacy and security literacy — a combination that is increasingly expected of Microsoft technology professionals in 2026.
The total investment for both certifications is $330 in exam fees and 4 to 6 weeks of total study time. Both certifications never expire. This is one of the best cost-to-career-impact ratios available in enterprise IT certification.
Who Should Take AZ-900?
Take AZ-900 if:
You are entering cloud computing or Azure for the first time. AZ-900 is the universal starting point for the Azure certification ecosystem. It provides the vocabulary and conceptual framework that every subsequent Azure certification assumes you already have.
Your career target is cloud administration, development, or architecture. AZ-900 feeds into every Azure associate certification — AZ-104, AI-200, AI-103, and the broader Azure path. Starting with AZ-900 keeps every career door open.
You are a business professional working in Microsoft cloud environments. Project managers, consultants, and non-technical professionals working alongside Azure teams benefit from AZ-900 as a formal credential for their cloud literacy.
You want the broadest possible foundation before specializing. AZ-900 opens more follow-on certification paths than any other Microsoft fundamentals certification. If you are undecided about your specialization, AZ-900 keeps your options widest. For the complete analysis of AZ-900’s worth and career impact, our Is AZ-900 Worth It guide covers every detail.
Who Should Take SC-900?
Take SC-900 if:
Your career target is cybersecurity, identity management, or compliance. SC-900 is the starting point for the entire Microsoft security certification path including SC-200, SC-300, SC-400, SC-500, and SC-100. If security is your direction, SC-900 is the right first step.
You already work in IT administration and want to move into security. IT administrators who manage user accounts, access permissions, and compliance reporting already have significant practical SC-900 knowledge from their daily work. SC-900 formalizes that knowledge as a recognized credential.
You are a compliance officer, auditor, or risk professional. SC-900’s compliance solutions domain covers Microsoft Purview, eDiscovery, audit logs, and information protection — directly relevant to professionals with governance and compliance responsibilities.
You are planning to pursue SC-200, SC-300, or SC-400. SC-900 is specifically designed as the foundation for the Microsoft security associate certification path. Candidates who take SC-900 before attempting SC-200 or SC-300 consistently find the associate-level content more approachable because SC-900 establishes the product ecosystem familiarity those exams assume.
The Complete Microsoft Fundamentals Certification Landscape
Understanding how AZ-900 and SC-900 fit among all Microsoft fundamentals certifications helps you plan which ones are relevant to your specific career.
| Certification | Focus | Best For |
| AZ-900 | Azure cloud platform | Cloud infrastructure, all Azure career paths |
| SC-900 | Security, compliance, identity | Cybersecurity, compliance, identity management |
| AI-901 | AI and machine learning on Azure | AI development, data science, Copilot roles |
| DP-900 | Azure data services | Data engineering, analytics, database roles |
| PL-900 | Power Platform | Low-code development, business automation |
For most Microsoft technology professionals, AZ-900 plus SC-900 is the strongest two-certification fundamentals combination because they cover the two most universally relevant dimensions of enterprise Microsoft technology — the cloud platform and its security layer. For the complete picture of all Microsoft certifications including the major 2026 changes, our Microsoft certifications retiring in 2026 guide covers every path.
How to Prepare for AZ-900
Step 1: Complete the free Microsoft Learn AZ-900 path. Every exam objective is covered in free official modules with knowledge checks. Most candidates with some technology background need 10 to 15 hours of study on this path alone.
Step 2: Focus extra time on the governance and compliance domain. Azure management and governance at 30 to 35 percent of the exam is where most candidates lose points. Azure Policy, RBAC, Cost Management, Purview, and compliance tools need dedicated attention.
Step 3: Take practice exams until scoring above 80 percent consistently. Our AZ-900 exam preparation materials are aligned to the current 2026 blueprint including the January 2026 identity and security section updates.
How to Prepare for SC-900
Step 1: Complete the free Microsoft Learn SC-900 path. The official Microsoft Learn SC-900 path covers all four domains with structured modules and knowledge checks. Complete every module including the compliance and eDiscovery sections that many candidates skim.
Step 2: Build a product name reference sheet for all Microsoft Defender products. The Microsoft Defender family — Defender for Endpoint, Defender for Cloud, Defender XDR, Defender for Identity — is heavily tested and candidates frequently confuse which product does what. Create a clear reference comparing every Defender product’s specific purpose.
Step 3: Understand Microsoft Purview at a conceptual depth beyond surface level. Data lifecycle management, eDiscovery, communication compliance, and information barriers all appear in SC-900’s compliance domain. These are product categories many candidates find less intuitive than the security products. Study each one with a specific use case in mind.
Step 4: Use current practice materials. Our Microsoft exam preparation section covers current SC-900 practice materials.
Decision Framework: SC-900 vs AZ-900
| Your Situation | Take This |
| Completely new to Microsoft cloud and IT | AZ-900 |
| Currently in a security or compliance role | SC-900 |
| Target career is cloud administration or DevOps | AZ-900 |
| Target career is cybersecurity or identity management | SC-900 |
| Want maximum follow-on certification flexibility | AZ-900 |
| Planning to pursue SC-200, SC-300, or SC-400 next | SC-900 |
| Planning to pursue AZ-104 or AZ-305 next | AZ-900 |
| Want the strongest junior resume combination | Both — AZ-900 then SC-900 |
| Undecided about Microsoft specialization | AZ-900 — keeps more doors open |
| Work in compliance, audit, or risk management | SC-900 |
| Work in IT administration with security responsibilities | SC-900 is more directly applicable |
| Coming from a non-technical business background | Both are accessible — take AZ-900 first |
| Budget is your primary concern | Both cost $165 — take whichever aligns with your role |
| Time is your primary concern | SC-900 slightly faster — 2 to 3 weeks versus 2 to 4 for AZ-900 |
| Building toward SC-500 Cloud and AI Security Engineer | Take both as the ideal combined foundation |
Frequently Asked Questions: SC-900 vs AZ-900
What is the difference between SC-900 and AZ-900?
AZ-900 covers the Microsoft Azure cloud platform including infrastructure, services, pricing, and governance. SC-900 covers Microsoft security, compliance, and identity including Defender products, Sentinel, Purview, and Entra ID. AZ-900 is cloud literacy. SC-900 is security literacy. Both are fundamentals-level certifications that never expire and require no prerequisites.
Which should you take first — SC-900 or AZ-900?
Take AZ-900 first if you are new to Microsoft cloud. Take SC-900 first if you work in security, compliance, or identity roles. Take both if you want the strongest Microsoft fundamentals combination — the content overlap means the second certification takes only 1 to 2 additional weeks after passing the first.
Is SC-900 easier than AZ-900?
Both are beginner-level certifications of similar difficulty. SC-900 is reported by many candidates as slightly easier because the Microsoft security product ecosystem is more structured to memorize. AZ-900 covers a broader Azure service catalog that some candidates find more varied. Neither is a significant challenge for candidates who use the free Microsoft Learn preparation path.
Do SC-900 and AZ-900 expire?
Neither expires. Both are Microsoft fundamentals certifications with lifetime validity. Once earned they stay on your Microsoft Learn transcript permanently with no renewal requirement or annual maintenance fee.
How much do SC-900 and AZ-900 cost?
Both cost $165 USD. Microsoft runs free Virtual Training Days events throughout the year that include free exam vouchers for attendees, so the actual out-of-pocket cost can be reduced or eliminated with timing.
Can you take SC-900 without AZ-900?
Yes. SC-900 has no prerequisites and can be taken without AZ-900. Many candidates take SC-900 first if their role is already security-focused. However the content overlap means taking AZ-900 first makes SC-900 preparation faster and easier.
What jobs does SC-900 lead to?
SC-900 is a fundamentals credential and does not qualify you for specific roles on its own. It is the foundation for SC-200 (Security Operations Analyst), SC-300 (Identity and Access Administrator), SC-400 (Information Protection Administrator), and SC-500 (Cloud and AI Security Engineer) — all of which open $85,000 to $125,000 plus roles.
What is the difference between SC-900 and SC-200?
SC-900 is a fundamentals-level conceptual certification covering Microsoft security, compliance, and identity at an overview level. SC-200 is an associate-level technical certification for security operations analysts who investigate threats, respond to incidents, and hunt for attackers using Microsoft Sentinel and Defender products. SC-900 is the starting point. SC-200 is the specialization.
Should I take both AZ-900 and SC-900?
Yes if you want the strongest Microsoft fundamentals combination on your resume. The content overlap between the two certifications — particularly around Microsoft Entra ID, the shared responsibility model, and Azure governance — means the second certification takes only 1 to 2 additional weeks. Both credentials never expire and together demonstrate comprehensive Microsoft technology literacy.
How does SC-900 relate to SC-500?
SC-900 is a fundamentals-level foundation covering security concepts at a conceptual level. SC-500 is the new Cloud and AI Security Engineer Associate certification launching July 2026 that validates hands-on Azure security engineering skills. SC-900 provides security vocabulary and product familiarity. SC-500 proves you can implement security controls. Our SC-500 certification guide covers everything about SC-500.
