Updated 1 Nov 2026 · 5 min read
On this page
What the Microsoft SC-401 is and who it is for
The SC-401, Administering Information Security in Microsoft 365, is the exam behind the Microsoft Certified: Information Security Administrator Associate certification. Microsoft rates it intermediate. The role it describes plans and implements information security for sensitive data with Microsoft Purview and related services, protecting data in Microsoft 365 collaboration environments from internal and external threats, and protecting data used by AI services.
Day to day, that means information protection, data loss prevention, retention and insider risk management, plus handling information security alerts and activities. You work with governance, data and security colleagues to turn policy into controls, and take part in responding to information security incidents. Microsoft expects you to be familiar with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal and Microsoft Defender for Cloud Apps.
Microsoft is updating the English version of the exam in October 2026. The certification page gives the date as 14 October 2026, while the study guide labels the new skills measured as of 28 October 2026. Either way, the change log lists a single change, rated minor, in the objectives for sensitivity labels in Purview. Localised versions follow about eight weeks after the English update.
Microsoft SC-401 at a glance
| Item | Detail |
|---|---|
| Exam code | SC-401 |
| Time allowed | 100 minutes |
| Passing score | 700 or greater |
| Exam fee | US$165 in the US, priced by the country or region where you sit it |
| Languages | English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified) and Spanish |
| Where you sit it | Proctored, scheduled through Pearson VUE |
| Certification valid for | One year, renewed with a free online assessment on Microsoft Learn |
Microsoft does not publish a question count for the SC-401. It says most of its certification exams typically contain between 40 and 60 questions, but that the number varies by exam. The exam may also include interactive components.
What is on the exam
The three domains carry the same weight, 30 to 35% each, so no area is safe to skip.
Implement information protection (30 to 35%). Data classification first: turning requirements into built-in or custom sensitive info types, document fingerprinting, exact data match, trainable classifiers, OCR support, and monitoring with Data explorer and Content explorer. Then sensitivity labels: roles, labels for items and containers, protection and content marking, publishing and auto-labeling policies, and labels on Teams, Microsoft 365 Groups, SharePoint sites and Power BI items. It ends with the Purview Information Protection client and scanner for Windows and file shares, and Purview Message Encryption and Advanced Message Encryption for Exchange.
Implement data loss prevention and retention (30 to 35%). Designing DLP policies from requirements, roles, Adaptive Protection, rule precedence and Defender for Cloud Apps file policies. Endpoint DLP covers device requirements, advanced rules, settings, just-in-time protection and monitoring endpoint activities. Retention covers retention labels and label policies (published and auto-applied), adaptive policy scopes, retention policies, policy precedence with Policy lookup, and recovering retained content.
Manage risks, alerts, and activities (30 to 35%). Insider Risk Management: roles, connectors, integration with Defender for Endpoint, indicators, templates, policies, forensic evidence, risk levels for Adaptive Protection, and alerts, cases and notice templates. Then investigation: Purview Audit and audit retention, Activity explorer, DLP and insider risk alerts, Purview alerts in Defender XDR, Defender for Cloud Apps alerts and eDiscovery searches. The domain closes with protecting data used by AI services, including Data Security Posture Management (DSPM) for AI.
Why people fail it
Precedence is a common trap. The exam asks you to interpret rule precedence in DLP and policy precedence in retention, and questions that combine several labels or policies need you to know which one wins. Learning each feature on its own without these rules is not enough.
The second trap is overlap. Sensitivity labels and retention labels are different things with similar names. DLP lives in Purview, on endpoints and in Defender for Cloud Apps file policies. Adaptive Protection links Insider Risk Management to DLP. Scenarios often hinge on choosing the right one of these.
The third is AI. Protecting data used by AI services, including DSPM for AI, is a named objective group, and it is easy to miss if your notes do not cover it. Just-in-time protection and the Defender XDR alert objectives are also named objectives that are easy to overlook.
A study plan that fits the exam
Eight weeks suits most people who already administer Microsoft 365. With three equal domains, each gets two or three weeks and the last week is for timed practice.
- Week 1: classification. Custom sensitive info types, fingerprinting, EDM, trainable classifiers and Content explorer. Try the free SC-401 practice questions to see where you stand.
- Week 2: sensitivity labels. Create labels for items and containers, set protection and marking, then publishing and auto-labeling policies. Label a Team, a SharePoint site and a Power BI item.
- Week 3: client, scanner and encryption. The Information Protection client and scanner, then Message Encryption and Advanced Message Encryption.
- Week 4: DLP. Build policies from a written requirement, work through rule precedence, set up Endpoint DLP with just-in-time protection, and create a Defender for Cloud Apps file policy.
- Week 5: retention. Retention labels and policies, adaptive scopes, auto-apply policies, Policy lookup and recovery of retained content.
- Week 6: insider risk. Connectors, indicators, templates, policies, forensic evidence, Adaptive Protection and case handling.
- Week 7: alerts, audit and AI. Audit and audit retention, Activity explorer, alerts in Purview and Defender XDR, eDiscovery searches and DSPM for AI.
- Week 8: timed runs. Take Microsoft's free Practice Assessment, then work through the 280 questions in the SC-401 practice question pack in 100 minute blocks and read the explanation for every miss.
On exam day
You schedule through Pearson VUE. Microsoft strongly recommends registering with a personal Microsoft account, because exam records tied to a work or school account are lost if you leave that organisation. Try Microsoft's exam sandbox first to see the question types in the real interface.
You get 100 minutes, and Microsoft suggests allowing 120 minutes of seat time for associate exams of this length. Five minutes of break time is built in. Breaks are allowed, but the clock keeps running and you cannot go back to questions you saw before the break. You can open Microsoft Learn in a split screen during the exam, but the timer does not stop. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Frequently asked questions
What happens if I fail the SC-401?
You can retake it after 24 hours. After that, Microsoft imposes a 14 day wait between attempts, with no more than five attempts in 12 months from the first. Microsoft's policy says you must pay to retake the exam where applicable.
Does the October 2026 update change what I should study?
Very little. Microsoft rates the only change as minor and limits it to the sensitivity labels objectives. If you sit in English after the update, read that objective group in the study guide once more before your exam.
How do I keep the certification?
Microsoft associate certifications expire annually. Once yours is within six months of expiry, you can renew at no cost by passing an online assessment on Microsoft Learn, with no limit on attempts before it expires.
Is the practice pack enough on its own?
No. It is practice, not a course. The 280 questions show how Microsoft frames Purview scenarios and explain why the wrong options are wrong, but they do not replace building labels, DLP policies and insider risk policies in a test tenant. Learn there first, then use the questions to find your gaps.
When you are ready to test yourself properly, get the SC-401 practice questions with full explanations.
Sources
The official pages the facts in this guide were checked against.
- learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-401
- learn.microsoft.com/en-us/credentials/certifications/information-security-administrator/
- learn.microsoft.com/en-us/credentials/exam-pricing.json
- learn.microsoft.com/en-us/credentials/certifications/information-security-administrator/renew/
- learn.microsoft.com/en-us/credentials/support/retake-policy
- learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
What people say about this pack
Using Certstash for my SC-401 exam prep was the best decision. The materials were so on point that I passed on my very first try. I highly recommend them to anyone who is serious about getting certified.