SC-401
Exam SC-401: Administering Information Security in Microsoft 365
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
SC-401 is the exam behind Microsoft Certified: Information Security Administrator Associate, an intermediate-level credential for administrators who plan and implement information security for sensitive data by using Microsoft Purview and related services. The work is policy-driven and defensive: protecting data inside Microsoft 365 collaboration environments from internal and external threats, protecting data used by AI services, and taking part in incident response alongside governance, data, and security teams. The exam measures three skill areas, each weighted 30–35%: implement information protection; implement data loss prevention and retention; and manage risks, alerts, and activities. Expect classification work such as sensitive information types, exact data match, trainable classifiers and document fingerprinting; sensitivity labels with their publishing and auto-labeling policies; the Purview Information Protection client and scanner; message encryption; DLP policy design including endpoint DLP and Adaptive Protection; retention labels and policies; Insider Risk Management; audit, Activity explorer and alert investigation; and controls that protect content used by AI services, including DSPM for AI. You get 100 minutes, the exam is proctored and may include interactive components, and a score of 700 or greater is required to pass. Prepare with hands-on Purview practice plus the study guide, exam sandbox, prep videos and practice assessment.
What you'll study
About SC-401 preparation
How long is the SC-401 exam and what does the format look like?
You have 100 minutes to complete the assessment. The exam is proctored and may include interactive components alongside standard question types, so budget time for tasks that require you to configure or interpret a scenario rather than just pick an answer.
What score do I need to pass?
A score of 700 or greater is required to pass. Microsoft does not publish a simple percentage-of-questions equivalent, so aim for broad coverage of all three skill areas rather than perfection in one.
Can I retake the exam if I fail?
Yes. You can retake it 24 hours after the first attempt. For subsequent retakes, the waiting period is not fixed and varies, so plan your scheduling with a possible second attempt in mind rather than assuming a same-week slot.
Does the certification expire, and how do I renew it?
Microsoft associate, expert, and specialty certifications expire annually. You renew at no cost by passing a free online assessment on Microsoft Learn, which focuses on what has changed in the technology since you certified.
How is the exam weighted across topics?
The three skill areas are weighted evenly in bands: implement information protection (30–35%), implement data loss prevention and retention (30–35%), and manage risks, alerts, and activities (30–35%). Skipping any one area means surrendering roughly a third of the scored content.
What background should I have before sitting the exam?
The role expects familiarity with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps. Practical experience designing and tuning Purview policies matters more than memorizing menu locations, since questions are scenario-based.
In what order should I study the domains?
Follow the dependency chain: classification and sensitivity labels first, since DLP, retention and Insider Risk Management all consume labels and sensitive information types. Then DLP and retention, then alerts, audit and investigations. Finish with the AI-services and DSPM for AI objectives, which build on the earlier controls.
What languages is the exam offered in, and do translations lag?
It is offered in English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified) and Spanish. Localized versions are updated approximately eight weeks after the English version. If the exam isn't available in your preferred language, you can request an additional 30 minutes to complete it.
Are preview features tested?
Most questions cover features that are generally available, but the exam may contain questions on Preview features if those features are commonly used. Don't ignore newly announced Purview capabilities, especially around AI data protection, but prioritize generally available behavior.
What are the most common ways candidates underprepare?
Two recurring gaps: knowing label and DLP policy settings without understanding rule and policy precedence, and never having worked in Activity explorer or Insider Risk Management case workflows. Alert triage and investigation objectives are a full third of the exam and are hard to answer from reading alone.