Azure Fundamentals vs Security, Compliance, and Identity Fundamentals
Both are $99, both take a fortnight, and both are Microsoft fundamentals certifications that never expire.
AZ-900 covers Azure as a platform. SC-900 covers security, compliance and identity across Microsoft's stack. They barely overlap, and neither is a prerequisite for anything.
Side by side
| Azure Fundamentals | Security, Compliance, and Identity Fundamentals | |
|---|---|---|
| Exam cost | $99. | $99. |
| Experience assumed | None. | None. |
| What it covers | Cloud concepts, Azure architecture, services, pricing and support. | Security and compliance concepts, Entra ID, Microsoft security and compliance tooling. |
| Leads toward | AZ-104, and the Azure role-based track. | SC-300 identity, SC-200 operations, and the security track. |
| Study time | One to two weeks. | One to two weeks. |
| Difficulty | The easiest Microsoft exam. Passable from one course. | Comparable, with more terminology to hold. |
| Typical roles | None directly. Used by sales, project and management roles near cloud teams. | None directly. Used by compliance, governance and management roles near security teams. |
| Renewal | Never expires. | Never expires. |
Which one to take first
AZ-900 if your direction is infrastructure or cloud engineering. It builds the model of subscriptions, regions and resource groups that everything else in the Azure track assumes.
SC-900 if your direction is security, identity or compliance. It is the shorter path into SC-300 and SC-200, and it covers Entra ID concepts that AZ-900 mentions only in passing.
Neither if you already work in technology and are heading for a role-based certification. Both are optional, both are unmentioned in job postings, and the two weeks are better spent starting AZ-104 or SC-200 directly.
When the answer is the other one
Take SC-900 instead if security is the destination
AZ-900 spends most of its weight on compute, storage and cost management, which a security-track candidate will meet again in more depth and in better context later. SC-900 introduces the identity and compliance vocabulary that SC-300 and SC-200 both assume from the first page.
Take Security+ instead if you want a credential employers name
Neither of these appears in job postings. Security+ costs more and takes longer, and it is requested constantly, satisfies DoD 8140, and is vendor-neutral so it travels between employers. For somebody who can only afford one certification this year, it is the better spend.
Take neither if you already work in IT
Fundamentals exams exist to build a mental model for people who lack one. Somebody who already administers systems has that model, and the honest use of $99 and two weeks is as the first two weeks of a role-based certification instead.
The short version
Cloud and infrastructure direction: AZ-900. Security, identity and compliance direction: SC-900.
Already technical: skip both and start the role-based exam you actually want.
Frequently asked questions
Do I need AZ-900 before SC-900?
No. Neither is a prerequisite for the other and they cover different material. Take whichever matches the track you are heading toward, or neither.
Do these expire?
No. Microsoft fundamentals certifications do not expire. Role-based certifications such as AZ-104 and SC-200 renew annually through a free assessment.
Will either get me a job?
On their own, rarely. Neither appears in job postings as a requirement. Their value is as structured preparation for a role-based certification, and as evidence of direction for a career changer.
Answer a few from each.
Free sample questions for both, with the full explanation on every answer. Nothing tells you which exam suits you like sitting a few of its questions.