Skip to content

SC-900 deep review — September 27, 2026

The complete guide was read and 58 October objectives in 14 groups were individually mapped. The accepted July 28 baseline remains separate from the October 21 revision. The credential confirms a 45-minute exam and thirteen languages; the introductory instructor-led course remains one day.

Learning changes

Four original worked examples explain an application's two tenant instances, access-review decisions versus effective removal, NSG priority and connection state, and retention end dates. The guide now includes seven labs and eighteen answered checks: answers were added for the original six questions and twelve new questions test the expanded distinctions.

The review develops the workload-identity and Microsoft Threat Intelligence objectives, adds network-segmentation coverage, and distinguishes human versus software policies, label publication versus application, and vulnerability recommendations versus incident evidence. Data Explorer terminology and privileged content permissions supplement the blueprint's Content explorer wording.

Current lifecycle notes cover passkey registration/preference, population-specific Microsoft SMS/voice delivery retirement, new-subscription Foundational CSPM opt-in, new-vault Key Vault defaults and the Sentinel portal transition. Updated September Learn guidance refines the July passkey blog's earlier blanket February deadline. Five dated checkpoints include shared identity follow-ups for SC-300 and MS-102.

Eight offline checks verified synthetic counts, sets, ordering, retention-year arithmetic and public course/question sums. No identity, policy, access review, network, Key Vault, Purview, Sentinel, credential or other tenant action was executed. All seven labs remain learner exercises/tabletops.

Resource and blog decisions

Pluralsight's six Vlad Catrinescu lessons total 8h45, rounded to nine path hours, and date from December 2023–January 2024. LinkedIn confirms Christopher Wojahn and Microsoft Press, 3h32, June 11, 2024. MeasureUp still lists 124 questions and an August 2025 update. None of these public listings proves complete July/October 2026 coverage; no paid lessons, questions or demo were reviewed.

O'Reilly and Udemy blocked retrieval. Partner, Whizlabs, YouTube and Service Trust responses were shells; direct Practice Assessment returned no content. Historical metadata is labeled accordingly. The public companion repository was accessible; its unlicensed artifact is linked rather than republished. Current Learn module runtime totals, event availability and signed-in assessments were not verified.

  • Nadim Abdo's July 13 passkey announcement supplies a task distinguishing enabled, registered, preferred and required. Its public article was read; current Learn dates supersede the broader older deadline. Tenant rollout was not tested.
  • Microsoft Security Research's September 9 social-engineering investigation supplies a verified-helpdesk and evidence-mapping exercise. The introduction, initial-access examples and mitigations were reviewed, not every technical query or indicator. A passkey-themed lure is not evidence that passkey cryptography failed; no attack reproduction was performed.

Linked intelligence, videos and deployments were not tested. Research, repair and checks used the same AI context; independent and human review remain pending.

The evidence ledger is ADLC_Docs/operations/2026-09-27-sc-900-deep-review.json. It preserves previous records, objective mapping, source observations, guide hashes, findings and completed local validation.