Date: 05/10/2026
One of the nice quirks of Microsoft’s licensing model is that there’s no lower limit to the number of licences you have, in my case that means that my solo venture Head and Heart CIC (H&H) has an enterprise-grade cloud environment for about £20 a month. The downside of this is that H&H doesn’t have an enterprise-grade support team to look after that environment. Microsoft does provide comprehensive documentation, and excellent free learning resources, but trying to work out where to start can be a frustrating experience.
When it comes to improving the security and compliance posture of a small organisation, the Microsoft Learn course SC-900T00-A: Introduction to Microsoft Security, Compliance, and Identity is the Getting Started manual that Microsoft never told you about when you signed up.
Taking the tour of Microsoft security and governance
The course provides a guided tour of Microsoft’s security, identity, and compliance toolkit, methodically explaining the purpose and function of the tools and services you can use to protect your organisation. There are instructor led courses that cram everything into a single day, but I chose to take my time. I spent a week going through the self-directed Learning Paths, reflecting on how H&H fitted into the landscape as I went.
If you’ve found yourself in charge of a Microsoft 365 tenant and you can afford the time, then I recommend that you take the tour. On its own, it won’t teach you how to make your Microsoft 365 tenant secure and compliant, but it will take someone from having no clear idea where to start to being able to make informed decisions about what to do next.
Appendix: Going beyond the basic tour
If you do want to take the learning experience further, the course accompanies the Security, Compliance, and Identity Fundamentals (SC-900) certification. It’s normally worth following through and certifying if you’re interested in a fundaments-level Microsoft certification, the exams are quite cheap and typically straightforward to prepare for, but SC-900 is unusually demanding for the Fundaments series because of the broad syllabus that makes it so useful.
I went on to take the exam because the certification is valuable for my wider work. After my first pass of the self-directed Learning Paths, I took the Microsoft Practice Assessment to get a benchmark, and then I used a set of third-party practice assessments that I bought on Udemy to identify gaps in my knowledge and direct me to further reading. I’ve always found choosing courses on Udemy to be a bit of a guessing game. In the end, I went with a set of tests from Next Arc, which worked well for me personally.
Preparing for the exam took another week of learning details that would be essential knowledge for large organisations, but which I am unlikely to apply while running H&H’s tiny tenant.
After all that preparation, the exam itself was surprisingly straightforward, there were no trick questions, you’re allowed 45 minutes to complete it, and I passed it comfortably in half that time.
Patrick Killeen
Head and Heart CIC
patrick@headandheart.info
www.headandheart.info
You are free to adapt and reuse this work under the MIT License, and it is available at
https://github.com/head-and-heart-cic/public/blob/main/in-practice/261005_the_m365_manual_microsoft_forgot_to_mention/README.md
