Home › Guides › AZ-900 vs SC-900

AZ-900 vs SC-900: Which Fundamentals First?

AZ-900 covers Azure cloud broadly; SC-900 goes deep on Microsoft security. Here's how they differ and which to take first.

✔ Last updated: August 2026 · Sources: official Microsoft Learn & Microsoft exam outline

The short answer

Take AZ-900 first, then SC-900 if you're interested in security. AZ-900 introduces cloud and identity basics (including Microsoft Entra ID, Zero Trust, and Defender for Cloud), which makes SC-900 much easier. Both are entry-level, $99, and never expire.

AZ-900 vs SC-900: full comparison

FactorAZ-900 (Azure Fundamentals)SC-900 (Security, Compliance & Identity Fundamentals)
FocusAll Azure basics: compute, storage, networking, governanceSecurity concepts, Microsoft Entra ID, Defender XDR, Purview, compliance
DifficultyEasyEasy–moderate (more technical terms)
Cost$99 USD$99 USD
Questions40–6040–60
Duration45 minutes45 minutes
ExpiryNeverNever

What SC-900 covers

SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) covers security concepts and responsibilities, Microsoft Entra ID (identities, MFA, Conditional Access), Microsoft Defender (XDR) products, Microsoft Purview (compliance), and Microsoft Sentinel. It's the entry certification for security-focused careers.

Which should you take?

  • General cloud career: AZ-900 first — broader foundation
  • Security career path (SOC, GRC, IAM): SC-900 (after AZ-900 ideally)
  • Limited time / one exam: AZ-900 gives broader value
  • Security + cloud combo: Both — a popular, strong pairing
💡 Note: AZ-900 already covers security fundamentals (defense in depth, Zero Trust, Key Vault, Defender for Cloud overview) — so taking it first gives you a head start on SC-900.

Test your knowledge with 225+ free questions

Practice with real exam-style questions — including the new 2026 AI content — and detailed explanations.

Take a Free Practice Test →

Frequently Asked Questions

Which is harder: AZ-900 or SC-900?
SC-900 is slightly more technical with more security-specific terminology, but both are entry-level. Candidates with AZ-900 first find SC-900 easier.
Can I take SC-900 without AZ-900?
Yes — no prerequisites. But AZ-900 first is recommended since it covers cloud/identity basics that SC-900 assumes.
Do AZ-900 and SC-900 expire?
No — both are fundamentals certifications and never expire.
Which is better for a security career?
SC-900 is the security-specific entry cert. Pair it with AZ-900 for a stronger cloud+security foundation.