Both are Microsoft Fundamentals exams, both take a week or two of focused study, and both stay on your CV forever without expiring. But they teach genuinely different material. Here's what each one actually tests, where the two overlap, and how to pick.
Updated July 2026·~8 min read
Quick answer
Which one should you sit first?
If you only have time to prepare for one Fundamentals exam right now, the short version comes down to what your next role actually needs.
Pick AZ-900 if…
You want the broad grounding: cloud service models, Azure's region and subscription structure, core compute and storage services, and how cost management and governance work. It's the standard on-ramp toward Azure Administrator (AZ-104) and most general infrastructure roles.
Pick SC-900 if…
Your near-term work touches identity, compliance, or the security stack — Microsoft Entra ID, Microsoft Defender products, Microsoft Purview, or Microsoft Sentinel. It's the on-ramp toward the security-analyst and identity-administrator associate tracks.
Neither is a formal prerequisite for the other, and neither certification expires once you pass, so there's no real penalty for choosing the "wrong" one first if your role changes direction later. The distinction that actually matters is what your next job needs: general cloud administration, or security, compliance, and identity.
Side by side
SC-900 and AZ-900 compared
Strip away the domain content and the two exams are built on the same skeleton: both are online-proctorable, both run to the same length, and both use the same 700-out-of-1000 passing bar. The difference is entirely in what they ask you to know.
SC-900 vs AZ-900 at a glance
Category
SC-900
AZ-900
Full name
Microsoft Certified: Security, Compliance, and Identity Fundamentals
Microsoft Certified: Azure Fundamentals
Focus
Security, compliance, and identity concepts across Azure and Microsoft 365
General cloud computing concepts and core Azure services
Exam pricing varies by country for both, so check Microsoft's SC-900 and AZ-900 certification pages for the fee where you live rather than trusting a number you read elsewhere.
Under the hood
What each exam actually tests
The domain lists below are what really separates the two exams. Read them side by side and it's obvious these are built for different jobs, even though both sit at the Fundamentals level.
AZ-900: cloud concepts, architecture, governance
AZ-900 spends its first domain on why cloud computing exists at all — the shared responsibility model, public versus private versus hybrid cloud, consumption-based pricing, and the IaaS/PaaS/SaaS service models. Its largest domain then covers Azure's actual architecture: regions, availability zones, subscriptions, and management groups, plus compute, networking, and storage services. Identity and security get one section inside that domain — Microsoft Entra ID basics, MFA, Conditional Access, Azure RBAC, Zero Trust, and a mention of Microsoft Defender for Cloud — but it stays at "what is this and when would you use it," not implementation detail. The final domain covers cost management, Azure Policy, resource locks, and monitoring tools such as Azure Monitor.
AZ-900 skills measured
Domain
Weight
Describe cloud concepts
25–30%
Describe Azure architecture and services
35–40%
Describe Azure management and governance
30–35%
SC-900: security, compliance, and identity capabilities
SC-900 opens with the concepts domain everything else leans on: the shared responsibility model again, paired with defence-in-depth, Zero Trust, and the difference between authentication and authorisation. From there it goes deep rather than wide. A quarter to nearly a third of the exam is Microsoft Entra alone — identity types, authentication methods, Conditional Access, Microsoft Entra roles, Identity Protection, and Privileged Identity Management. The largest domain, Microsoft security solutions, covers Azure network security tools (NSGs, Azure Firewall, DDoS Protection), the whole Microsoft Defender family, and Microsoft Sentinel for SIEM and SOAR. The final domain is compliance: Microsoft Purview, sensitivity labels and data lifecycle management, insider risk management, and Microsoft Priva.
SC-900 skills measured
Domain
Weight
Concepts of security, compliance, and identity
10–15%
Capabilities of Microsoft Entra
25–30%
Capabilities of Microsoft security solutions
35–40%
Capabilities of Microsoft compliance solutions
20–25%
The overlap
Where SC-900 and AZ-900 actually overlap
The two exams share more conceptual ground than their domain lists suggest, even though neither is a prerequisite for the other. Both introduce the shared responsibility model early: AZ-900 treats it as the baseline distinction between what Microsoft manages and what you manage, and SC-900 builds its own opening domain directly on the same idea. Both also introduce Zero Trust and defence-in-depth — AZ-900 mentions them briefly inside its architecture domain, while SC-900 treats them as core concepts from the first domain onward.
Microsoft Entra ID is the clearest shared thread. AZ-900 introduces it at a glance — authentication basics, MFA, single sign-on, Conditional Access, and Azure RBAC — inside a broader "identity, access, and security" section. SC-900 dedicates a quarter to nearly a third of the exam to the same product, going into identity types, access management, and identity governance in real depth. The pattern repeats with Microsoft Defender for Cloud: AZ-900 name-checks it once, while SC-900 treats it as one entry point into a much larger Microsoft security solutions domain covering the whole Defender family plus Microsoft Sentinel.
The short version: AZ-900 gives you the vocabulary for these topics, SC-900 gives you the depth. If you've already passed one, expect a handful of familiar terms in the other — not a free pass on study time.
Doing both
Which one first, if you want both eventually
Plenty of people end up sitting both exams over time, especially in roles that straddle infrastructure and security. If your day job is, or will soon be, general Azure administration, take AZ-900 first — it establishes the resource-hierarchy vocabulary that SC-900 assumes lightly rather than teaches. If security, compliance, or identity is the actual target role, SC-900 first is fine too: it's self-contained and needs only conceptual awareness of what the cloud is, not Azure operational knowledge.
If you're genuinely undecided, most people study AZ-900 first because it's the broader on-ramp — more of Microsoft's other Fundamentals and Associate certifications assume the vocabulary it introduces. Either way, avoid sitting both in the same fortnight; the two outlines only overlap on a handful of concepts, so cramming both into one short study block blurs the material rather than reinforcing it. Still not sure which certification or order fits your goals? Which Microsoft certification first? walks through the wider decision.
Career paths
Where each path leads next
After AZ-900, the associate-level credential most job postings actually mean is AZ-104 (Azure Administrator Associate) — hands-on subscription, identity, storage, compute, and networking administration. From there, the expert tracks branch out toward architecture or DevOps engineering.
After SC-900, there are two natural associate-level branches depending on which half of the exam interested you more. If the Microsoft security solutions domain — Defender, Sentinel — was the more engaging half, SC-200 (Security Operations Analyst Associate) is the next step. If the Microsoft Entra domain was more your speed, SC-300 (Identity and Access Administrator Associate) fits better. Both feed into SC-100 (Cybersecurity Architect Expert) further up the security track.
Worth knowing if security engineering specifically is the goal: AZ-500 (Azure Security Engineer Associate) is being retired on 31 August 2026 and replaced by SC-500 (Cloud and AI Security Engineer Associate), which also pairs with SC-900 on the way in. So the security-track landing point to aim for now is SC-500, SC-200, or SC-300 depending on the specific role — not the retiring AZ-500.
Frequently asked
SC-900 vs AZ-900 FAQs
Is SC-900 harder than AZ-900?
Neither is harder in a general sense — both are Fundamentals-level exams with the same format: 40–60 multiple-choice questions in 45 minutes, passing at 700 out of 1000. Difficulty comes down to your background. SC-900 feels harder if security and identity terminology (Conditional Access, Microsoft Purview, Zero Trust) is new to you. AZ-900 feels harder if you have never touched cloud infrastructure concepts like regions, subscriptions, or the shared responsibility model.
Do I need AZ-900 before I can sit SC-900, or the other way round?
No. Neither exam is a formal prerequisite for the other. Both are entry-level Fundamentals credentials designed to stand alone. AZ-900 touches identity and security topics briefly inside its architecture and services domain, and SC-900 assumes you already have a general sense of what "the cloud" is, but neither exam expects you to have passed the other first.
Which certification do employers actually ask for?
It depends entirely on the role. Job adverts for general IT, cloud support, or infrastructure roles more often reference AZ-900 or its associate-level next step AZ-104. Adverts for security analyst, identity administrator, or compliance-adjacent roles more often reference SC-900 or its associate-level follow-ons SC-200 and SC-300. Fundamentals certifications rarely appear as a hard requirement either way — they signal that you have done the groundwork, not that you are job-ready on their own.
Can I study for SC-900 and AZ-900 at the same time?
You can, but sitting them back to back in the same week or two is usually a mistake. The two skills outlines only overlap on a handful of concepts — the shared responsibility model, Zero Trust, and the basics of Microsoft Entra ID — so most of your revision time for each exam is spent on material unique to that exam. Finish and sit one, then start the other, rather than trying to hold both domain lists in your head at once.
Do SC-900 and AZ-900 expire?
No. Microsoft Fundamentals certifications, including SC-900 and AZ-900, do not expire once you pass. This is different from Associate and Expert certifications such as SC-200, SC-300, AZ-104, or SC-500, which require a free annual renewal assessment on Microsoft Learn.
I already know I want to work in security — should I skip AZ-900 entirely?
You can go straight to SC-900 without ever sitting AZ-900. SC-900 does not require Azure operational knowledge, only conceptual awareness. That said, a lot of Microsoft security tooling sits on top of Azure infrastructure, so if terms like resource group, subscription, or region genuinely mean nothing to you, an hour or two with AZ-900's cloud-concepts material first will make SC-900's Microsoft Entra and Defender content easier to place in context.
Practise for either exam, or both, in one app
Azure Mastery covers both exams from a single download. Practise with over 300 SC-900 questions or over 300 AZ-900 questions, each mapped to their own skills outline, with an on-device Exam IQ readiness score, an adaptive study plan that targets your weak spots, and a timed Practice run built to each exam's own length and question count. Works offline, no account required to start.
Practise with over 300 exam-style questions for either certification, with an on-device readiness score, an adaptive study plan, and a full-length simulator. Free to start, works offline.
