Guide
SC-900 vs AZ-900: security or cloud first?
Compare cloud fundamentals with security fundamentals and choose the first exam that fits your role.
Quick answer
Which one should you sit first?
If you only have time to prepare for one Fundamentals exam right now, the short version comes down to what your next role actually needs.
Pick AZ-900 if…
- You want the broad grounding: cloud service models, Azure's region and subscription structure, core compute and storage, cost management and governance.
- It's the standard on-ramp toward Azure Administrator (AZ-104) and most general infrastructure roles.
Pick SC-900 if…
- Your near-term work touches identity, compliance, or the security stack — Entra ID, Defender products, Purview, or Sentinel.
- It's the on-ramp toward the security-analyst and identity-administrator associate tracks.
Neither is a formal prerequisite for the other, and neither certification expires once you pass, so there's no real penalty for choosing the "wrong" one first if your role changes direction later. The distinction that actually matters is what your next job needs: general cloud administration, or security, compliance, and identity.
Side by side
SC-900 and AZ-900 compared
Strip away the domain content and the two exams are built on the same skeleton: both are online-proctorable, both run to the same length, and both use the same 700-out-of-1000 passing bar. The difference is entirely in what they ask you to know.
| Category | SC-900 | AZ-900 |
|---|---|---|
| Full name | Microsoft Certified: Security, Compliance, and Identity Fundamentals | Microsoft Certified: Azure Fundamentals |
| Focus | Security, compliance, and identity concepts across Azure and Microsoft 365 | General cloud computing concepts and core Azure services |
| Skills domains | 4 domains | 3 domains |
| Largest domain | Microsoft security solutions (35–40%) | Azure architecture and services (35–40%) |
| Questions | 40–60, multiple choice | 40–60, multiple choice |
| Duration | 45 minutes (65-minute seat time) | 45 minutes (65-minute seat time) |
| Pass score | 700 / 1000 | 700 / 1000 |
| Validity | Doesn't expire | Doesn't expire |
| Delivery | Online or a test centre | Online or a test centre |
| Typical next step | SC-200 or SC-300 (Associate) | AZ-104 (Associate) |
Exam pricing varies by country for both, so check Microsoft's SC-900 and AZ-900 certification pages for the fee where you live rather than trusting a number you read elsewhere.
Under the hood
What each exam actually tests
Compare the domain lists below to see which Fundamentals exam fits the work you want to do.
AZ-900: cloud concepts, architecture, governance
- Its first domain covers why cloud computing exists at all — the shared responsibility model, public versus private versus hybrid cloud, consumption-based pricing, and the IaaS/PaaS/SaaS service models.
- Its largest domain covers Azure's actual architecture: regions, availability zones, subscriptions, and management groups, plus compute, networking, and storage services.
- Identity and security get one section inside that domain — Entra ID basics, MFA, Conditional Access, RBAC, Zero Trust, a mention of Defender for Cloud — but it stays at "what is this," not implementation detail.
- The final domain covers cost management, Azure Policy, resource locks, and monitoring tools such as Azure Monitor.
| Domain | Weight |
|---|---|
| Describe cloud concepts | 25–30% |
| Describe Azure architecture and services | 35–40% |
| Describe Azure management and governance | 30–35% |
SC-900: security, compliance, and identity capabilities
- Opens with the concepts domain everything else leans on: the shared responsibility model again, paired with defence-in-depth, Zero Trust, and the difference between authentication and authorisation.
- From there it goes deep rather than wide: a quarter to nearly a third of the exam is Microsoft Entra alone — identity types, authentication methods, Conditional Access, Entra roles, Identity Protection, Privileged Identity Management.
- Microsoft security solutions, the largest domain, covers Azure network security tools (NSGs, Azure Firewall, DDoS Protection), the whole Microsoft Defender family, and Microsoft Sentinel for SIEM and SOAR.
- The final domain is compliance: Microsoft Purview, sensitivity labels and data lifecycle management, insider risk management, and Microsoft Priva.
| Domain | Weight |
|---|---|
| Concepts of security, compliance, and identity | 10–15% |
| Capabilities of Microsoft Entra | 25–30% |
| Capabilities of Microsoft security solutions | 35–40% |
| Capabilities of Microsoft compliance solutions | 20–25% |
The overlap
Where SC-900 and AZ-900 actually overlap
The two exams share more conceptual ground than their domain lists suggest, even though neither is a prerequisite for the other.
- Both introduce the shared responsibility model early: AZ-900 treats it as the baseline distinction between what Microsoft manages and what you manage, and SC-900 builds its opening domain directly on the same idea.
- Both introduce Zero Trust and defence-in-depth — AZ-900 mentions them briefly inside its architecture domain, SC-900 treats them as core concepts from the first domain onward.
- Microsoft Entra ID is the clearest shared thread: AZ-900 introduces it at a glance inside a broader "identity, access, and security" section, while SC-900 dedicates a quarter to nearly a third of the exam to it.
- The pattern repeats with Microsoft Defender for Cloud: AZ-900 name-checks it once, SC-900 treats it as one entry point into a much larger security solutions domain covering the whole Defender family plus Sentinel.
- The short version: AZ-900 gives you the vocabulary, SC-900 gives you the depth. Already passed one? Expect a handful of familiar terms in the other, not a free pass on study time.
Doing both
Which one first, if you want both eventually
Plenty of people end up sitting both exams over time, especially in roles that straddle infrastructure and security.
- General Azure administration now or soon? Take AZ-900 first — it establishes the resource-hierarchy vocabulary SC-900 assumes lightly rather than teaches.
- Security, compliance, or identity the actual target role? SC-900 first is fine too — it's self-contained and needs only conceptual awareness of the cloud, not Azure operational knowledge.
- Genuinely undecided? Most people study AZ-900 first because it's the broader on-ramp — more of Microsoft's other Fundamentals and Associate certifications assume its vocabulary.
- Either way, avoid sitting both in the same fortnight — the two outlines only overlap on a handful of concepts, and cramming both into one short block blurs the material rather than reinforcing it.
- Still not sure which certification or order fits? Which Microsoft certification first? walks through the wider decision.
Career paths
Where each path leads next
Each Fundamentals exam opens onto a different associate-level branch.
- After AZ-900, the associate-level credential most job postings actually mean is AZ-104 (Azure Administrator Associate) — hands-on subscription, identity, storage, compute, and networking administration, from where the expert tracks branch toward architecture or DevOps engineering.
- After SC-900, there are two natural branches depending on which half interested you more: SC-200 (Security Operations Analyst Associate) if the Microsoft security solutions domain — Defender, Sentinel — was the more engaging half.
- SC-300 (Identity and Access Administrator Associate) if the Microsoft Entra domain was more your speed; both feed into SC-100 (Cybersecurity Architect Expert) further up the security track.
- Security engineering specifically the goal? AZ-500 retired on 31 August 2026 and replaced by SC-500 (Cloud and AI Security Engineer Associate), which also pairs with SC-900 on the way in — so aim for SC-500, SC-200, or SC-300, not the retired AZ-500.
Frequently asked
SC-900 vs AZ-900 FAQs
Is SC-900 harder than AZ-900?
Neither is harder generally — same format, same 700-out-of-1000 pass bar. It's your background that decides. SC-900 feels harder if security and identity terms (Conditional Access, Purview, Zero Trust) are new. AZ-900 feels harder if you've never touched regions, subscriptions, or the shared responsibility model.
Do I need AZ-900 before I can sit SC-900, or the other way round?
No. Neither is a formal prerequisite. Both are entry-level Fundamentals credentials designed to stand alone. AZ-900 touches identity and security briefly, and SC-900 assumes a general sense of what "the cloud" is, but neither expects you to have passed the other first.
Which certification do employers actually ask for?
Can I study for SC-900 and AZ-900 at the same time?
You can, but sitting them back to back in the same week or two is usually a mistake. The two outlines overlap on only a handful of concepts, so most revision time goes on material unique to each. Finish one, then start the other, rather than holding both domain lists in your head at once.
Do SC-900 and AZ-900 expire?
No. Fundamentals certifications, SC-900 and AZ-900 included, don't expire once you pass. That's different from Associate and Expert certifications such as SC-200, SC-300, or AZ-104, which need a free annual renewal assessment on Microsoft Learn.
I already know I want to work in security — should I skip AZ-900 entirely?
You can go straight to SC-900; it needs only conceptual awareness, not Azure operational knowledge. That said, plenty of Microsoft security tooling sits on top of Azure infrastructure, so if "resource group" or "subscription" mean nothing to you, an hour with AZ-900's cloud-concepts material first helps SC-900 click faster.
Cloud concepts or security concepts, covered either way
Azure Mastery covers both exams from a single download, with a rationale for every option so a wrong answer teaches you the distinction, not just costs a mark. Each bank gets its own on-device Exam IQ score and its own adaptive plan. Free to start, works offline.
Download Azure Mastery — freeReady to start on SC-900 or AZ-900?
Pick whichever fits the role you want and start seeing your Exam IQ readiness score climb from the first session. Free to start, no account required.
Download Azure Mastery — free iPhone & iPad · Free to start · No account required