SC-401 is the exam for people who protect data with Microsoft Purview: classifying it, labeling it, stopping it from leaving, and investigating when someone tries. It also covers protecting data used by AI services such as Microsoft 365 Copilot. In this post I'll lay out a study plan: what the exam measures, which Microsoft Learn paths map to each domain, what to practice in a lab tenant, and what to do after you pass.
Status (October 2026): Microsoft's SC-401 study guide shows an October 2026 update to the skills measured. Its change log lists no domain-level changes; the only revision is a minor one to the sensitivity label objectives. Localized versions of the exam are usually updated about eight weeks after the English version, so re-check the study guide for the version that applies on your exam date.
Who this path is for (and prerequisites)#
This plan suits Microsoft 365 and endpoint administrators who have been handed a DLP or labeling project, and security engineers moving into data security. Microsoft's audience profile expects familiarity with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal and Microsoft Defender for Cloud Apps.
If you studied for the retired SC-400, don't reuse those notes as they are. The current SC-401 list has no communication compliance or Compliance Manager objectives, and it includes a whole objective group on protecting data used by AI services.
Practical prerequisites: a lab tenant licensed for the Purview features you plan to practice, a few test users, a Windows device you can onboard, and Security & Compliance PowerShell (see my guide to Connect-IPPSSession).
The exam at a glance#
| Item | Detail |
|---|---|
| Exam | SC-401: Administering Information Security in Microsoft 365 |
| Certification earned | Microsoft Certified: Information Security Administrator Associate (intermediate) |
| Time allowed | 100 minutes, proctored, may include interactive components |
| Passing score | 700 or greater |
| Price | 165 USD, varies by the country or region where the exam is proctored |
| Languages | English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified), Spanish |
| Renewal | Annually, through a free online assessment on Microsoft Learn |
The skills measured, as published in Microsoft's study guide:
| Domain | Weight |
|---|---|
| Implement information protection | 30–35% |
| Implement data loss prevention and retention | 30–35% |
| Manage risks, alerts, and activities | 30–35% |
Microsoft updates study guides regularly, so re-check the official guide before you book. With three equally weighted domains, no section is safe to skip. Most questions cover generally available features, but commonly used preview features can appear.
Stage-by-stage plan#
Microsoft's course Protect sensitive information with Microsoft Purview in the AI era bundles six self-paced learning paths. The stages below follow them and add the articles on this site that go deeper.
Stage 1: Data classification (weeks 1–2)#
Start the longest path, Implement Microsoft Purview Information Protection (nine modules, a little over six hours). The classification objectives cover built-in and custom sensitive information types, document fingerprinting, exact data match, trainable classifiers, optical character recognition, and monitoring with Data explorer and Content explorer. Go deeper with custom sensitive information types, exact data match and trainable classifiers and content explorer.
Stage 2: Sensitivity labels and encryption (weeks 3–4)#
Finish the same path. Expect questions on label permissions, labels for items and for containers (Teams, Microsoft 365 Groups, SharePoint sites) and Power BI, protection settings and content marking, publishing and auto-labeling policies, labeling through Defender for Cloud Apps, the Microsoft Purview Information Protection client and scanner, and Microsoft Purview Message Encryption and Advanced Message Encryption. Useful reading: rolling out sensitivity labels, container labels and the Information Protection scanner.
Stage 3: Data loss prevention and endpoint DLP (weeks 5–6)#
Study Implement and manage Microsoft Purview Data Loss Prevention (five modules). The objectives cover designing policies from requirements, DLP roles, policy and rule precedence, DLP policies for Adaptive Protection, file policies in Defender for Cloud Apps, and endpoint DLP: device requirements including browser extensions, advanced device rules, global settings, just-in-time protection and monitoring endpoint activity. Read DLP policy design, simulation to enforcement and endpoint DLP settings.
Stage 4: Retention and recovery (week 7)#
Study Implement and manage Microsoft 365 retention and recovery (two modules): retention labels and label policies that publish or auto-apply them, adaptive policy scopes, retention policies, policy precedence with Policy lookup, and recovering retained content. See adaptive scopes and retention policies that don't apply.
Stage 5: Insider risk, alerts and AI (weeks 8–10)#
Work through Implement and manage Microsoft Purview Insider Risk Management, Audit and search activity in Microsoft Purview and Secure AI interactions and environments with Microsoft Purview. This domain covers insider risk policies, indicators, connectors, forensic evidence and risk levels for Adaptive Protection; audit retention policies and activity explorer; responding to DLP alerts in Purview and Defender XDR; eDiscovery searches; and DSPM for AI prerequisites, roles, policies and monitoring. Pair it with insider risk setup, Adaptive Protection and DSPM for AI.
Stage 6: Review (week 11)#
Take Microsoft's free practice assessment, try the exam sandbox, and spend the remaining days on your weakest domain, using the study guide's bullets as a checklist.
Hands-on practice#
- Classification. Build a custom sensitive information type with a regular expression and a keyword list, test it against a sample file, then check where matches appear in content explorer.
- Labels. Create three labels with encryption on the most restrictive one, publish them to a pilot group, apply them in Word and Outlook, and add a container label to a test team.
- DLP. Run a policy for credit card numbers in simulation mode across Exchange, SharePoint, OneDrive and Teams, review the matches, then enforce it with policy tips and check the events in activity explorer.
- Endpoint DLP. Onboard a Windows device, block copying labeled files to USB storage, and test uploads in Microsoft Edge and in Chrome with the Purview extension.
- Retention. Create an adaptive scope, auto-apply a retention label, delete a labeled file and recover it, then use Policy lookup to see which retention policies apply to that site.
- Insider risk and audit. Turn on insider risk analytics, create a policy from a template, link insider risk levels to a DLP policy for Adaptive Protection, and search the audit log for the activity.
- Permissions. Add a test user to Information Protection Analysts and note what they can and can't change; my guide to Purview role groups explains the model.
Tip: keep a lab journal with the portal path, required role and observed result for every exercise. It becomes your revision sheet in week 11.
Exam-day tips#
- Register with a personal Microsoft account. Microsoft warns that exam records tied to a work or school account are lost if you leave that organization.
- Budget the 100 minutes: flag hard questions and come back.
- If the exam isn't offered in your preferred language, you can request an extra 30 minutes.
- Read each scenario for the location first (email, files, Teams, devices or AI apps) and for the least-privilege role it asks about.
- If you don't pass, you can retake after 24 hours; later retakes have longer waiting periods.
After the exam#
Associate certifications expire every year, and renewal is free. During a six-month eligibility window before expiry you take a short online assessment that is open book, unproctored and focused on recent product changes; you can retake it as often as needed before expiry. Passing extends the certification by one year from the expiration date.
For next steps, SC-401 pairs well with SC-200 if you'll investigate the alerts your policies raise (see my SC-200 training path), with SC-300 if identity keeps coming up in your investigations (SC-300 path), and with MS-102 for broader Microsoft 365 administration (MS-102 path). Check each certification page for its current prerequisites before planning.
