SC-401 study guide
SC-401 · Work through your exam, one topic at a time.
SC-401 is the exam behind Microsoft Certified: Information Security Administrator Associate, an intermediate-level credential for administrators who plan and implement information security for sensitive data by using Microsoft Purview and related services. The work is policy-driven and defensive: protecting data inside Microsoft 365 collaboration environments from internal and external threats, protecting data used by AI services, and taking part in incident response alongside governance, data, and security teams. The exam measures three skill areas, each weighted 30–35%: implement information protection; implement data loss prevention and retention; and manage risks, alerts, and activities. Expect classification work such as sensitive information types, exact data match, trainable classifiers and document fingerprinting; sensitivity labels with their publishing and auto-labeling policies; the Purview Information Protection client and scanner; message encryption; DLP policy design including endpoint DLP and Adaptive Protection; retention labels and policies; Insider Risk Management; audit, Activity explorer and alert investigation; and controls that protect content used by AI services, including DSPM for AI. The SC-401 study guide has 3 sections and about 1,098 words.
01Implement Information Protection
A sensitivity label bundles what protection to apply : encryption (usage rights, content expiry, offline access), content marking (header, footer, watermark), auto-labeling of matching items, and container settings for sites, groups, and Teams. A label only protects anything once it is published through a label policy, which decides who sees it, the default label, whether justification is required to remove or downgrade a label, and the help link shown to users.
378 words, about 2 min02Implement Data Loss Prevention and Retention
DLP policies attach to locations - Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, endpoint devices, on-premises scanner, and Fabric/Power BI. Inside a policy, rules combine conditions (sensitive information types, sensitivity labels, trainable classifiers, EDM, document fingerprinting, recipient domains, file size), exceptions, and actions (block, block with override, restrict access, encrypt, audit only, policy tips, alert).
336 words, about 2 min03Manage Risks, Alerts, and Activities
IRM policies are built from a template (for example, data theft by departing users, data leaks, security policy violations, or risky AI usage), a scope of users or groups, and a set of indicators with thresholds. Supporting settings decide anonymization of usernames, policy timeframes, and whether sequence detection is on.
384 words, about 2 min