Passed SC-100 last week — identity management section was the sleeper topic

Passed SC-100 with an 812 last Thursday. I've been a cloud security architect for three years, Azure-heavy, previously held AZ-500 and MS-500. I thought this exam would be a straightforward extension of what I already knew. It mostly was, but there were a few areas I underweighted in my prep that I want to flag for anyone getting ready.

The identity and access management architecture questions hit harder than I expected. Not the mechanics of Conditional Access or PIM — I know those cold. It was the governance and design questions: when to use which identity pattern for a hybrid environment, how to architect zero-trust identity at an enterprise scale, which controls to layer when you have on-prem AD plus Entra ID plus a bunch of SaaS apps. The SC-100 practice tests I used covered this material but the real exam went deeper on the architectural tradeoffs.

The MCRA (Microsoft Cybersecurity Reference Architecture) is worth reading in full, not just skimming. I skimmed it. I noticed on the exam. The sections on identity and on security operations are especially testable at the architectural reasoning level.

Four weeks of prep, roughly 90 minutes a day. Solid foundation from AZ-500 made a real difference. Happy to answer questions.