Side-by-side comparison of AZ-900 and SC-900 — exam format, difficulty, career paths, and which to take first based on your goals.
| Factor | AZ-900 | SC-900 |
|---|---|---|
| Full name | Azure Fundamentals | Security, Compliance & Identity Fundamentals |
| Cost | £130 / $165 | £130 / $165 |
| Questions | 40–60 | 40–60 |
| Duration | 60 minutes | 60 minutes |
| Pass mark | 700/1000 | 700/1000 |
| Difficulty | Beginner | Beginner–Intermediate |
| Prerequisites | None | None (but AZ-900 helps) |
| Primary focus | Cloud services & Azure | Security, identity & compliance |
AZ-900 covers the fundamentals of cloud computing and Microsoft Azure services. The three domains are:
SC-900 focuses specifically on Microsoft's security, compliance, and identity products. The four domains are:
Both are fundamentals-level exams, but SC-900 is generally considered slightly harder than AZ-900. The security domain requires understanding more specific products (Defender for Endpoint, Defender for Cloud, Microsoft Sentinel, Purview) and their relationships to each other. AZ-900's content is broader but shallower.
That said, both are very passable with 2–3 weeks of focused study.
You're new to Microsoft cloud products entirely and want a broad foundation before specialising.
Your role is specifically in security, compliance, or identity and you don't need broad Azure knowledge.
You want a comprehensive Microsoft cloud foundation, or you're pursuing the Microsoft Security, Compliance, and Identity path.
AZ-900 leads into the Azure administrator and architect paths: AZ-104 (Azure Administrator), AZ-305 (Solutions Architect Expert), AZ-500 (Security Engineer).
SC-900 leads into the security specialist paths: SC-300 (Identity and Access Administrator), SC-200 (Security Operations Analyst), SC-400 (Information Protection Administrator).
Security specialist roles in the UK command salaries of £55K–£90K+ at the associate level. Azure administrator roles are comparable. Both paths are strong — the choice depends on whether you prefer infrastructure/cloud or security/compliance work.
For most people new to Microsoft cloud: start with AZ-900. The Azure knowledge gives you context for everything else — security products are built on top of Azure infrastructure, so understanding the foundation makes SC-900 easier when you get to it. AZ-900 → SC-900 is a natural progression and together they give you a very solid base.
If you're specifically targeting a security career and already have some IT experience, start with SC-900 and add AZ-900 as a second cert.