SC-401
SC-401: Information Security Administrator
Everything for Microsoft exam SC-401: 100 minutes, passing score 700, the three Purview skill areas, a four-week study plan and free sample questions.
- Duration
- 100 min
- Passing score
- 700 / 1000
- Level
- Associate
- Languages
- 7
SC-401, Administering Information Security in Microsoft 365, is Microsoft’s exam for the people who protect sensitive data in a Microsoft 365 tenant. Passing it earns the Microsoft Certified: Information Security Administrator Associate credential. The work behind it is done almost entirely in Microsoft Purview: classifying data, labelling and encrypting it, stopping it from leaking, keeping or deleting it on schedule, watching for insider risk, and, newly, controlling what AI services can see.
It is a configuration exam. Questions describe an organisation, a requirement and a Purview feature set, and ask which policy, label setting, role or workflow meets the requirement. Microsoft’s audience profile expects familiarity with Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal and Microsoft Defender for Cloud Apps.
What the exam covers
| Skill area | Weight |
|---|---|
| Implement information protection | 30–35% |
| Implement data loss prevention and retention | 30–35% |
| Manage risks, alerts, and activities | 30–35% |
All three areas carry the same range, so there is no domain you can afford to skip. Inside them, the topics are classification and sensitivity labels; data loss prevention (DLP), Endpoint DLP and retention; and Insider Risk Management, audit, eDiscovery and Data Security Posture Management (DSPM) for AI.
Where to start
Read the exam format for the mechanics and the notice about the October 2026 outline update. If you are choosing between security exams, see SC-401 vs SC-200. Then follow the four-week study plan and check yourself with the free practice test.
SC-401 guides
- SC-401 exam format: questions, score and costThe SC-401 format: 100 minutes, passing score 700, 7 languages, question types, pricing and what the three 30-35% domain weights mean for revision.
- SC-401 vs SC-200: which exam to take?SC-401 vs SC-200: information protection and Purview data governance versus security operations, Sentinel and threat hunting. Which exam fits your role.
- SC-401 study plan: pass in 4 weeksA four-week SC-401 study plan: classification and labels, DLP and retention, insider risk, audit and AI data protection, with a Purview lab every week.
- Free SC-401 sample questions with answersFive free SC-401 practice questions on sensitivity labels, DLP, retention, Insider Risk Management and DSPM for AI, each with an explained answer.
- SC-401 information protection explainedThe SC-401 information protection domain explained: sensitive info types, EDM, trainable classifiers, sensitivity labels, auto-labeling and message encryption.
- SC-401 data loss prevention explainedSC-401 DLP explained: policy design, locations, rule precedence, Adaptive Protection, Defender for Cloud Apps file policies and Endpoint DLP.
- SC-401 retention explainedSC-401 retention explained: retention policies versus labels, adaptive scopes, publish versus auto-apply, disposition, precedence, Policy lookup and recovery.
- SC-401 insider risk management explainedSC-401 Insider Risk Management explained: roles, HR connectors, templates, indicators, alerts, cases, forensic evidence and Adaptive Protection.
- SC-401 alerts, audit and eDiscoverySC-401 alerts and activities explained: Purview Audit Standard and Premium, retention policies, Activity explorer, DLP alerts, Defender XDR and eDiscovery.
- SC-401 protecting data used by AI servicesSC-401 AI data protection explained: DSPM for AI prerequisites, roles, policies and monitoring, plus Purview and Microsoft 365 controls for AI services.
- Free SC-401 practice test: 20 questionsA free 20-question SC-401 practice test on sensitive info types, labels, DLP, retention, Insider Risk, audit and DSPM for AI, with explained answers.
- SC-401 study resourcesWhat to study for SC-401: the official skills outline and practice assessment, the Purview docs worth reading, and six labs that cover most of the exam.
- SC-401 cheat sheetA one-page SC-401 reference: the three skill areas, which Purview feature answers each requirement, precedence rules, prerequisites and common traps.
- Is SC-401 hard? Exam difficulty explainedHow hard SC-401 really is: why similar Purview features, licence and prerequisite details and three equal domains matter more than any one feature.
- Is SC-401 worth it? Who should take itIs SC-401 worth taking? Who benefits, what it costs, and how the Information Security Administrator credential relates to SC-900, SC-200 and SC-300.
- SC-401 career: data protection rolesWhat SC-401 leads to: the Purview-based Information Security Administrator role, titles it fits, what it leaves unproved, and the exams that follow.
- SC-401 renewal and retake rulesSC-401 is valid for one year and renews free on Microsoft Learn. Retake waits, the five-attempt limit, and which October 2026 update date to trust.
- SC-401 study scenarios: three planning profilesPlan SC-401 around your Purview exposure: the Microsoft 365 administrator, the compliance specialist and the Defender SOC analyst, with time budgets.