Microsoft SC-900 (Security Fundamentals)

The situation. An alert fires on a suspicious sign-in, and the analyst wants to know what that account did next: mailbox rules, file downloads, a new device. Whether that question can be answered was decided weeks earlier, by whoever chose which data sources to connect, which tables to keep, and for how long. A SIEM is a log pipeline before it is a detection engine. Detections, hunting, workbooks and automation all read from the tables that ingestion fills, and none of them can find what was never collected.

What this module covers. How Microsoft Sentinel is put together (the Log Analytics workspace, the Sentinel solution on top of it, the Microsoft Defender portal and the Sentinel data lake), how data gets in (connectors, agents, APIs and data collection rules), which tables you will query, what ingestion costs and how to keep it under control, and how to tell whether the data you rely on is still arriving. The logging fundamentals (what to log, time sync, retention, log integrity) are covered in SecOps I: Logs, SIEM, and Detection That Actually Works; this module assumes them and goes into the Sentinel specifics.

Where it maps. SC-900 (skills measured as of October 21, 2026) asks you to define SIEM and SOAR and to describe threat detection and mitigation capabilities in Microsoft Sentinel, inside the domain "Describe the capabilities of Microsoft security solutions" (35–40% of the exam). SC-900 tests description, not configuration. This module goes further than the exam needs because the configuration choices are what you will be asked about in an interview and what you will live with in a job.

Two definitions to have ready. A SIEM (security information and event management) collects logs from many sources, normalizes them, correlates across them and raises alerts. SOAR (security orchestration, automation and response) runs response steps, such as enrichment, ticketing, account or device containment, from a playbook instead of by hand. Sentinel does both: analytics rules are the SIEM side; automation rules and playbooks are the SOAR side, covered in Defender XDR and Automated Response: From Alert to Action.

What transfers to other platforms. Splunk (query language SPL), IBM QRadar (AQL), Elastic Security (EQL, ES|QL and Kibana Query Language, which is also abbreviated KQL but is unrelated to Microsoft's) and Google Security Operations all make the same decisions: which sources, which parsing, which storage tier, which retention. The buttons and the billing meters differ. This track teaches Sentinel and KQL and does not teach SPL; say so plainly if an interviewer asks.