Can a B.Com or BA graduate take SC-900?

Yes. SC-900 has no prerequisites, and Microsoft's audience profile names students and business stakeholders alongside IT professionals. Microsoft expects familiarity with Azure and Microsoft 365, which you can build in your first few days of study. The compliance section, on data classification, retention, audit and eDiscovery, often suits commerce and law graduates well.

Does the SC-900 certification expire?

No. Microsoft's renewal FAQ says fundamentals certifications do not expire, so there is no yearly renewal assessment for SC-900. Associate and expert certifications, such as SC-401 or SC-500, are different: they expire after a year and you renew them with a free online assessment.

Will SC-900 alone get me a job in cybersecurity?

Usually not on its own, and no certificate can promise one. SC-900 proves you know the basics and gives interviewers a common vocabulary to test. Combine it with a small piece of practical work, good communication, and a next step such as SC-200, SC-300 or SC-401 to stand out for entry-level roles.

Should I take AZ-900 or SC-900 first?

Take AZ-900 first if you want a broad cloud career covering infrastructure, data or development. Take SC-900 first if security, identity or compliance is what interests you. Neither is a prerequisite for the other, and the SC-900 study guide assumes only basic familiarity with Azure and Microsoft 365.

How many questions are on the SC-900 exam?

Microsoft does not publish a fixed number for each exam. Its exam experience page says most certification exams contain between 40 and 60 questions, and fundamentals exams last 45 minutes. Expect several question formats, and try the free exam sandbox beforehand so the interface holds no surprises.

SC-900 for Freshers and Non-IT Graduates in India: A 2-Week Plan

Yes, SC-900 is a sensible first certification for an Indian fresher or a non-IT graduate. It is Microsoft's beginner-level exam on security, compliance and identity, it has no prerequisites, and the certification never expires. It tests concepts and what Microsoft's tools do, not hands-on configuration, so two focused weeks of study are enough for most beginners. You need 700 to pass.

At a glance

Exam: SC-900, Microsoft Security, Compliance, and Identity Fundamentals
Level: beginner; Microsoft names students and business stakeholders in the audience
Skills measured: as of 21 October 2026, in four areas
Exam time: 45 minutes, as for all Microsoft fundamentals exams
Pass mark: 700 or greater
Expiry: none; fundamentals certifications do not expire
Practice: a free official practice assessment on Microsoft Learn

Who SC-900 suits, and who can skip it

Engineering, BCA and BSc freshers aiming for cloud support, IT helpdesk, security operations or Microsoft 365 administration roles. SC-900 gives you the vocabulary interviewers use: identity, MFA, Zero Trust, SIEM, data loss prevention.

Non-IT graduates, such as B.Com, BBA, BA or law graduates, who are curious about risk, audit and compliance work. Up to a quarter of the exam is about compliance: classifying data, retention, eDiscovery, audit and insider risk. If you have studied auditing or company law, those ideas will feel familiar, only applied to email, files and chats.

Who can skip it: anyone already working hands-on with Azure or Microsoft 365 security. Go straight to an associate exam such as SC-500, SC-200 or SC-401.

An honest word: a fundamentals certificate on its own rarely gets anyone a job. What it does is prove you have learned the basics properly, give you a credible line on your CV, and make your first associate exam much easier. Pair it with one small, visible piece of work, such as a short write-up of how you secured your own accounts, explained in plain English.

Why Indian employers value these basics

You do not need statistics to see the reason. Indian regulation now asks organisations to take security and personal data seriously, and every one of those duties needs people who understand the basics. This is general information, not legal advice:

CERT-In's directions of 28 April 2022 require listed cyber incidents to be reported within 6 hours and logs of ICT systems to be kept for a rolling 180 days. Someone has to understand what a log is, where it lives and why clocks must be in sync.
The Digital Personal Data Protection Act, 2023, with its Rules notified on 14 November 2025, gives organisations an eighteen-month period for phased compliance, according to the Government's PIB explainer. The same explainer says the penalty for failing to maintain reasonable security safeguards can reach ₹250 crore. Our guide to the DPDP Act and AI tools explains more.

Day to day, every organisation on Microsoft 365 signs its people in through Microsoft Entra ID, and many add MFA, Conditional Access and Purview sensitivity labels on top. A new hire who already understands why those controls exist is easier to train and makes fewer basic mistakes.

What the exam covers, in plain words

The SC-900 study guide lists four areas. Every objective starts with "Describe" or "Define", which is your clue: you must understand and recognise, not configure.

Area	Weight	In plain words
Security, compliance and identity concepts	10 to 15%	Zero Trust, shared responsibility, encryption, authentication
Microsoft Entra	25 to 30%	How people and apps sign in, and who can do what
Microsoft security solutions	35 to 40%	Azure network protection, Defender for Cloud, Sentinel, Defender XDR
Microsoft compliance solutions	20 to 25%	Purview: labels, DLP, retention, eDiscovery, audit

The largest area, security solutions, is also the one with the most product names. Learn them as pairs of "tool and job", for example Sentinel collects and correlates security events, Defender for Endpoint protects laptops and servers, and Defender for Office 365 protects email.

Three mistakes beginners make

Memorising product names without the job each one does. Questions describe a problem and ask which tool fits.
Mixing up Entra ID Protection and Conditional Access. One detects risky sign-ins and users; the other enforces rules at sign-in, and can use that risk as a condition.
Skipping the compliance section because it looks less technical. It carries up to a quarter of the marks.

Ten terms to know before day one

Shared responsibility: in the cloud, Microsoft secures some layers and you secure the rest; which layers depends on the service type.
Defence in depth: several layers of protection, so one failure is not a breach.
Zero Trust: verify explicitly, use least privilege, assume breach.
Authentication and authorisation: proving who you are, then deciding what you may do.
MFA: a second proof, such as an authenticator app, on top of a password.
Conditional Access: rules such as "block sign-ins from unknown devices to finance apps".
SIEM and SOAR: collecting security events, then automating the response.
XDR: detection and response across email, endpoints, identities and cloud apps together.
Sensitivity labels: tags such as "Confidential" that can encrypt or restrict a file.
DLP: rules that stop sensitive data, such as Aadhaar or PAN numbers, leaving where it should stay.

A two-week plan

The plan assumes 90 minutes to 2 hours a day, around college or a job. Use the free SC-900 learning path on Microsoft Learn as your main text.

Days	Focus	Do this
1 to 2	Concepts	Write the ten terms above in your own words, without notes
3 to 5	Microsoft Entra	Draw how a sign-in flows through MFA and Conditional Access
6 to 9	Security solutions	Make a one-page table: each Defender product, what it protects
10 to 12	Compliance solutions	Explain labels, DLP, retention and eDiscovery to a friend
13	Practice assessment	Take it timed, then reread every wrong answer's explanation
14	Revision and booking	Revise weak areas; try the exam sandbox once

Two cheap ways to make it real. First, open the security settings of your own Microsoft account and turn on MFA or a passkey; you will understand authentication methods far better after doing it once. Second, browse Microsoft's Service Trust Portal to see the kind of audit reports and compliance documents the exam mentions.

Exam day tips for first-timers

Microsoft Learn is not available during fundamentals exams. Role-based exams allow it; SC-900 does not, so you must know the material.
The clock keeps running during breaks, and you cannot return to questions you saw before a break, according to Microsoft's exam experience page.
Language: if the exam is not offered in your preferred language, the study guide says you can request an extra 30 minutes.
Booking: you can sit the exam online from home or at a test centre. Our guide to booking a Microsoft exam in India walks through Pearson VUE. Students should also check whether a student discount applies before paying.
Read the whole question. Fundamentals questions often turn on one word, such as "detect" versus "prevent".

After SC-900: where to go next

If you enjoyed	Next exam	Typical role
Sign-ins and access	SC-300	Identity and access administrator
Alerts and investigations	SC-200	Security operations analyst
Labels, DLP and compliance	SC-401	Information security administrator
Azure infrastructure	AZ-104, then SC-500	Cloud security engineer

Non-IT graduates drawn to compliance often find SC-401 the natural next step; see our SC-401 guide. For a wider view of first certifications, read Microsoft certifications for freshers in India.

How CertTulen Academy can help

CertTulen Academy, a Microsoft Training Services Partner, runs the SC-900 Security, Compliance and Identity Fundamentals course as a one-day, live, MCT-led online class with hands-on labs, so the product names stop being abstract. Professional certification courses include an exam voucher, mock practice tests and lab access; check the course page for what this course includes and its INR pricing, with UPI, card and netbanking checkout. Organisations can book a private cohort. Message us on WhatsApp at +91 93618 83583 or use our contact page.