SC-401 case studies
SC-401 · Put your knowledge to work in context.
SC-401 is the exam behind Microsoft Certified: Information Security Administrator Associate, an intermediate-level credential for administrators who plan and implement information security for sensitive data by using Microsoft Purview and related services. The work is policy-driven and defensive: protecting data inside Microsoft 365 collaboration environments from internal and external threats, protecting data used by AI services, and taking part in incident response alongside governance, data, and security teams. The SC-401 case studies are 5 cases and about 4,396 words.
1Northwind Legal: encryption settings that silently break co-authoring
Northwind Legal has 14,000 staff and 3.2 TB of active matter files in SharePoint Online. Its taxonomy ends in a sublabel, 'Highly Confidential - Matter Team', configured with Assign permissions now using a predefined Co-Owner role mapped to an Entra group per practice.
855 words, about 4 min2Fabrikam: container labels, defaults, and 300 unlabeled sites
Fabrikam Manufacturing runs 900 Teams and 40 SharePoint sites on Microsoft 365 E5. Sensitivity labels are scoped for files and emails and for groups and sites.
859 words, about 4 min3Vertex Financial: a DLP program the business has learned to override
Vertex Financial has 25,000 users and one DLP policy for PCI data across Exchange, SharePoint, OneDrive, Teams, and Endpoint. The rule uses the built-in Credit Card Number sensitive information type at default confidence and blocks external sharing with an override that requires a business justification.
863 words, about 4 min4Riverton Health Plan: retention that deletes what audit needs
Riverton Health Plan has 12,000 mailboxes, 8 TB of SharePoint, and 900 Teams. Claims records must be kept seven years and general correspondence three years.
856 words, about 4 min5Aurora Software: insider risk noise, missing HR signal, and adaptive protection
Aurora Software has 6,000 users on E5. An insider risk policy built from the departing-employees template selects these indicators: downloading files from SharePoint, sending email with attachments to personal domains, and copying to USB.
963 words, about 5 min