SC-401 Exam Guide 2026: Pass Microsoft Info Security FREE

SC-401 in 2026: The Modern Path to Microsoft Purview Mastery

Microsoft SC-401 (Administering Information Security in Microsoft 365) is the 2026 role-based exam that earns the Microsoft Certified: Information Security Administrator Associate credential. It is the direct successor to the retired SC-400 (Information Protection Administrator) and the canonical certification for administrators who plan, deploy, and operate Microsoft Purview — sensitivity labels, DLP, retention, records management, Insider Risk Management, Communication Compliance, eDiscovery, and audit — across Microsoft 365 environments.

This guide is the most comprehensive free SC-401 resource on the web. Every detail is cross-referenced against learn.microsoft.com/credentials/certifications/information-security-administrator/ and the official SC-401 study guide effective 27 April 2026 and current through 2026.

free SC-401 practice questionsPractice questions with detailed explanations

---

SC-401 Exam At-a-Glance (2026)

---

Why SC-401 Matters in 2026

Three forces are making SC-401 one of the most strategic Microsoft role-based certifications you can earn this year:

1. The AI-data-protection problem is acute. Microsoft 365 Copilot and generative-AI workloads are now embedded in Word, Excel, Outlook, Teams, and SharePoint for most enterprise customers. Every IT and compliance leader needs admins who can apply sensitivity labels, DLP, and data security posture management (DSPM) so Copilot only surfaces content users are authorized to see. SC-401 is the only Microsoft cert that validates these skills end-to-end.

2. SC-400 retired — and SC-401 is the single replacement. Microsoft officially retired SC-400 on 31 May 2025 along with the Information Protection and Compliance Administrator Associate credential. There is no longer a way to earn that old title. SC-401 is the current, and only, associate-tier certification for Microsoft Purview administrators.

3. The MS-102 Administrator Expert ladder runs through SC-401. To earn the Microsoft 365 Certified: Administrator Expert credential, you must pass MS-102 and hold at least one qualifying associate certification: MD-102, MS-700, SC-300, or SC-401. SC-401 is the most natural pairing for admins who own data protection and compliance.

At $165, with 60-100 hours of study, and an average 2026 Information Security Administrator salary of $95,000-$140,000 in the US, SC-401 is one of the highest-ROI role-based certifications in the Microsoft ecosystem.

Start SC-401 practice questions nowPractice questions with detailed explanations

---

Who Should Take SC-401

Microsoft's SC-401 audience profile explicitly calls out the Information Security Administrator job role — professionals who plan and implement information security of sensitive data using Microsoft Purview and related services, and who collaborate with governance, data, and security stakeholders.

SC-401 Is a Fit If You Are

1. An existing Microsoft 365 administrator (MS-102 candidate or holder) who needs to deepen Purview expertise and earn the Administrator Expert credential
2. An SC-400 holder whose credential has lapsed or who wants the current, AI-aware version
3. A compliance officer, privacy manager, or DPO at a Microsoft-shop organization
4. A security administrator who owns data protection, DLP, and Insider Risk alongside identity or endpoint work
5. A Microsoft partner / MSP consultant deploying Purview for mid-market and enterprise clients
6. A career-changing IT pro specializing in data security and AI governance

SC-401 Is NOT a Fit If You Are

• Entirely new to Microsoft cloud — start with SC-900 (fundamentals) first
• Focused on identity and access — sit SC-300 (Identity & Access Administrator) instead
• Focused on security operations / SOC — sit SC-200 (Security Operations Analyst) instead
• Planning a career outside the Microsoft ecosystem — consider CompTIA Data+ or vendor-neutral privacy certs (CIPP, CIPM) instead

---

SC-400 vs SC-401: The Transition

Microsoft retired SC-400 on 31 May 2025 and replaced it with SC-401 on the same timeline. If you prepared for SC-400 or hold it today, here is what you need to know.

Certification Mapping

What Transfers (Roughly 60-70%)

If you studied for SC-400, most of your knowledge transfers directly:

• Sensitivity labels (create, publish, auto-label, encrypt)
• Data classification (sensitive info types, trainable classifiers)
• DLP policies across Exchange, SharePoint, OneDrive, Teams
• Retention policies and labels
• Records management basics
• eDiscovery Standard and Premium
• Communication Compliance
• Insider Risk Management basics

What Is NEW on SC-401

• Protecting data used by AI services (Microsoft 365 Copilot sensitivity label honoring, DSPM for AI, AI-specific data governance)
• Adaptive scopes for DLP and retention (query-driven dynamic scoping)
• Endpoint DLP expanded scenarios (Mac, Windows, browser, cloud egress)
• Microsoft Purview portal navigation (purview.microsoft.com replaces the old Compliance Center UI)
• Expanded Insider Risk Management — forensic evidence, policy customization, triage workflows
• Data security posture management (DSPM) — visualizing data risk across M365

If You Hold an Active SC-400

You can continue to renew SC-400 for free on Microsoft Learn as long as it remains active — but Microsoft is no longer updating SC-400 content. Most admins are transitioning to SC-401 within one renewal cycle to stay current.

---

The 3 SC-401 Skills Measured (Effective April 2026, Current for 2026)

Microsoft updated SC-401 skills measured on 27 April 2026, and this version is in effect throughout 2026. The current exam weights:

All three domains carry essentially equal weight. Unlike SC-900 where one domain dominates, SC-401 rewards balanced preparation across labels, DLP+retention, and risk/alerts.

---

Skill 1 — Implement Information Protection (30-35%)

This domain is the labels-and-classification spine of Purview. Expect 15-18 questions.

Sub-Skills You Must Master

Sensitivity Labels: The Conceptual Core

Sensitivity labels do three things simultaneously:

1. Classify — apply a human- and machine-readable tag (e.g., "Highly Confidential")
2. Protect — optionally enforce encryption, usage rights (view/edit/print/forward), and content marking
3. Persist — the label metadata travels with the file wherever it goes (email attachments, external sharing, downloads)

Key concepts to memorize:

• Label scope — which workloads the label applies to (files & emails / groups & sites / Teams & M365 Groups / schematized data assets in Purview Data Map)
• Sublabels — nested refinement (e.g., Confidential > Finance, Confidential > Legal)
• Label priority — lower-priority label wins when sublabels conflict
• Publishing policy — controls which users/groups see which labels in Office apps
• Mandatory labeling — forces users to label before saving or sending

Auto-Labeling: Service-Side vs Client-Side

The AI Data Protection Addition (NEW on SC-401)

SC-401 specifically tests your ability to protect data used by AI services — primarily Microsoft 365 Copilot:

• Copilot respects sensitivity labels: if a user does not have usage rights to a labeled file, Copilot will not surface content from that file in responses
• DSPM for AI (Data Security Posture Management for AI) shows you which AI interactions touched sensitive data
• Conditional Access + label-based policies restrict Copilot access from non-compliant devices
• You can block Copilot entirely for users with certain labels via DLP

---

Skill 2 — Implement Data Loss Prevention and Retention (30-35%)

The DLP + lifecycle domain. Expect 15-18 questions. This is where hands-on time in a dev tenant pays off most.

Data Loss Prevention (DLP)

The DLP Mental Model

DLP = "Prevent sensitive data from leaving the boundaries we define."

1. What is sensitive? — Define via sensitive info types, trainable classifiers, sensitivity labels, or keyword dictionaries
2. Where is the boundary? — Choose locations: Exchange, SharePoint, OneDrive, Teams, endpoints, Defender for Cloud Apps, on-prem
3. What action on match? — Notify, warn, block with override, block without override, generate incident report

Retention and Records Management

Adaptive Scopes (NEW and Heavily Tested)

Adaptive scopes let you dynamically scope a retention policy or DLP policy using queries. Instead of a static list of users/sites:

• Scope to users by department = "Finance" (Entra attribute)
• Scope to sites by label = "Confidential" (site sensitivity label)
• Scope to M365 Groups by naming convention

When users move departments, the policy follows them automatically. Expect at least one SC-401 question on when to use adaptive vs static scopes.

Records Management Workflow

1. File plan — inventory of all record types with retention/disposition rules
2. Declare as record — via retention label with "mark items as record" enabled
3. Enforce retention — immutable during retention period
4. Trigger disposition — time-based OR event-based
5. Disposition review — optional human sign-off before delete
6. Proof of disposition — audit log of deletion

---

Skill 3 — Manage Risks, Alerts, and Activities (30-35%)

The security-operations side of Purview. Expect 15-18 questions. This domain tests Insider Risk Management, Communication Compliance, eDiscovery, Audit, and incident response workflows.

Insider Risk Management (IRM)

The Departing Employee Template (High-Yield)

The departing employee policy template is the single most-tested IRM scenario. Its logic:

1. HR connector imports the employee's termination date
2. Starting X days before termination (configurable), Purview scores that user's activity for exfiltration signals
3. Signals — mass file downloads, external sharing, unusual USB activity, copy-to-personal-cloud
4. Policy score crosses threshold → alert created
5. Analyst triages alert → opens IRM case
6. Analyst investigates timeline, content, user history
7. Analyst escalates to eDiscovery, HR, Legal

Communication Compliance

eDiscovery

The standard eDiscovery workflow:

1. Create case → 2. Add custodians → 3. Place hold → 4. Collect content → 5. Add to review set → 6. Review/redact → 7. Export

Audit

Managing Alerts and Activities

• Microsoft Purview portal alert queue — triage Purview alerts in one place
• Microsoft Defender XDR integration — unified incidents correlating DLP, IRM, and endpoint signals
• Playbooks and response workflows — document investigation steps and outcome
• DLP incident review — for each policy match, reviewer decides legitimate use vs escalation
• Activity Explorer — forensic view of labeled-content and DLP-matched actions across M365

---

Cost, Registration, and Retake Policy

SC-401 Cost (2026)

• United States: $165 USD
• United Kingdom: ~GBP 113
• European Union (most): ~EUR 150-165
• India: ~INR 4,800-5,500
• Australia: ~AUD 270
• Canada: ~CAD 210

Taxes may apply. Exact pricing is shown at checkout during Pearson VUE scheduling.

How to Register

1. Create (or sign in to) a personal Microsoft Account (MSA) — Microsoft strongly recommends NOT using a work/school account, because exam records are lost if you leave that organization
2. Go to learn.microsoft.com/credentials/certifications/information-security-administrator/ and click "Schedule exam"
3. Pay and select Pearson VUE delivery (online-proctored OR test center), pick date/time

Discounts and Free Vouchers

• Exam Replay — bundle of one exam + one retake at reduced total cost
• Microsoft Learn Cloud Skills Challenges — periodic free voucher opportunities
• Microsoft Security Virtual Training Days — free voucher for attendees in select regions
• Employer sponsorship — many Microsoft-shop employers reimburse passed exams
• Microsoft Partner Network benefits — partners receive exam discounts for staff

Retake Policy

• After first failure: wait 24 hours
• After second+ failure: wait 14 days
• Maximum: 5 attempts per 12-month period
• Full exam fee applies to every retake

Open Book During the Exam

SC-401 gives you access to Microsoft Learn documentation during the exam (via an in-exam browser pane). Use it sparingly — you only have 100 minutes for ~50 questions. Best practice: flag a question where you need to look something up, move on, and return with remaining time to consult Learn.

---

Renewal: FREE Every Year on Microsoft Learn

SC-401 is valid for 1 year from the date you pass. Microsoft provides a free online renewal assessment on Microsoft Learn — no re-testing at Pearson VUE, no fee.

Renewal Key Facts

• Renewal window opens: 6 months before expiration
• Renewal window closes: 6 months after expiration (up to 12 months total grace)
• Format: online, open-book, shorter than the full exam (~30-45 minutes)
• Retries: unlimited — take it as many times as needed until you pass
• Cost: free
• Content: delta content — what is new in Microsoft Purview since you certified
• Where: learn.microsoft.com → your certification dashboard

If you miss the full 12-month renewal window, the credential expires and you must re-take SC-401 at full price. Set a calendar reminder at 6 months before expiration.

---

10-Week SC-401 Study Plan

This plan assumes 8-10 hours per week (80 total hours) for a mid-experience Microsoft 365 administrator. Compress to 4-6 weeks if you have an active SC-400 background. Extend to 12-16 weeks if you are new to Microsoft Purview.

Week 1 — Orientation + Free E5 Dev Tenant

• Read: Official SC-401 study guide in full (45 min)
• Provision: Free Microsoft 365 E5 Developer tenant (joinmicrosoft365developerprogram.com) — 25 licenses, all Purview features enabled
• Tour: The Microsoft Purview portal at purview.microsoft.com — click through every major solution
• Microsoft Learn: Complete the foundational learning path on Microsoft Purview overview (~3 hours)
• Practice: 20 SC-401 questions across all 3 domains to set a baseline

Weeks 2-3 — Skill 1 — Information Protection

• Microsoft Learn: Complete the learning path "Implement information protection in Microsoft Purview" (~6 hours)
• Hands-on labs (in E5 dev tenant):
  • Create 4 sensitivity labels with sublabels (Public, Internal, Confidential > Finance, Highly Confidential)
  • Configure encryption and content marking on Confidential/Highly Confidential
  • Publish a label policy to all users
  • Create a service-side auto-labeling policy using a sensitive info type
  • Run the policy in simulation mode; review results
  • Test Microsoft 365 Copilot label honoring with a labeled document
• Memorize:
  • Label scopes (items, groups/sites, schematized data)
  • Encryption + usage rights options
  • Service-side vs client-side auto-labeling differences
  • Label priority and inheritance
• Practice: 30 SC-401 questions on Skill 1

Weeks 4-6 — Skill 2 — DLP + Retention

• Microsoft Learn: Complete the learning paths "Implement data loss prevention" and "Implement retention and records management" (~10 hours combined)
• Hands-on labs:
  • Create a DLP policy across Exchange, SharePoint, OneDrive, and Teams with 3 rules (blocking credit cards, PHI, and externally shared Confidential)
  • Enable Endpoint DLP on a Windows VM; test copy-to-USB and print blocks
  • Configure a retention policy with adaptive scope (department = Finance, 7 years retention)
  • Create a retention label for records; enable disposition review
  • Build a file plan with 3 record types and event-based retention
• Memorize:
  • DLP locations and actions matrix
  • Policy vs rule vs policy tip
  • Retention policy vs retention label vs retention label policy
  • Record vs regulatory record
  • Adaptive vs static scopes
• Practice: 40 SC-401 questions on Skill 2

Weeks 7-8 — Skill 3 — Risks, Alerts, Activities

• Microsoft Learn: Complete the learning path "Manage insider risks, alerts, and activities in Microsoft Purview" (~8 hours)
• Hands-on labs:
  • Configure the HR connector (simulated)
  • Create an Insider Risk Management departing-employee policy
  • Generate test signals; triage alerts; open a case
  • Create a Communication Compliance policy for offensive language
  • Run an eDiscovery (Standard) case — create case, add custodians, place hold, run search, export
  • Configure Audit Premium retention (1 year)
• Memorize:
  • IRM policy template matrix (when to use which)
  • Communication Compliance reviewer workflow
  • eDiscovery Standard vs Premium feature differences
  • Audit Standard vs Premium differences
• Practice: 40 SC-401 questions on Skill 3

Week 9 — Cross-Domain Synthesis + Full Mocks

• Scenario drills: For each of 20 business scenarios, match the correct Purview capability (label vs DLP vs retention vs IRM vs Communication Compliance vs eDiscovery vs Audit)
• Take the official Microsoft Practice Assessment — take it twice, aim for 85%+
• Take 2 full-length timed mocks (100 minutes, 50 questions)
• Review: For every missed question, click the linked Microsoft Learn module and re-read

Week 10 — Weak Spots + Exam Week

• Target your lowest-scoring domain for an extra 8-10 hours of focused review
• Re-run all hands-on labs one more time — muscle memory matters on interactive questions
• Day before: Flashcards only (IRM templates, DLP actions, retention precedence, eDiscovery tiers, audit tiers, label scopes). Sleep 8 hours
• Day of: Arrive/log in 30 min early, have government ID ready, close all other apps

---

Hands-On: The Free Microsoft 365 E5 Developer Tenant

SC-401 rewards hands-on practice more than any other Microsoft security associate exam. Microsoft gives you a free Microsoft 365 E5 Developer tenant with 25 licenses and all Purview features enabled — sensitivity labels, DLP, retention, IRM, Communication Compliance, eDiscovery Premium, Audit Premium.

Setup in 30 Minutes

1. Go to joinmicrosoft365developerprogram.com and sign up with a personal Microsoft account
2. Accept the program terms; complete the profile
3. Provision a new sandbox tenant (instant E5)
4. Add 5-10 test users (bulk CSV import)
5. Log in to purview.microsoft.com with your global admin account

15 Essential Hands-On Exercises

Plan 15-20 hours across the 10-week plan for these exercises. They are the single largest delta between candidates who pass on first attempt and candidates who fail.

---

Recommended Resources (Free-First)

Free (The Full Pass Stack)

Paid (Only If You Want Structure)

The lean budget stack: Microsoft Learn (free) + Microsoft Official Practice Assessment (free) + E5 Dev Tenant (free) + Tutorials Dojo practice tests ($20) + $165 exam. Total: $185.

---

Exam-Day Strategy: Working the 100 Minutes

SC-401 gives you 100 minutes for ~50 questions — that is ~2 minutes per question, which is generous compared to SC-900. But interactive case-study components consume 4-6 minutes each.

Pacing

• Minute 0-60: Work through every question as you encounter it. If a question takes more than 2.5 minutes, flag it and move on.
• Minute 60-85: Revisit flagged questions. Consult Microsoft Learn in the exam pane only for flagged questions you cannot narrow to 2 options.
• Minute 85-100: Final review. Change answers only with concrete reason.

Microsoft Question Archetypes

Key Decision Frameworks to Memorize

Label vs Retention label:

• Need to classify + encrypt + mark + restrict access? → Sensitivity label
• Need to retain/delete on schedule + declare as record? → Retention label

DLP vs Sensitivity label vs IRM:

• Prevent leakage based on content match? → DLP
• Classify + protect at rest + in transit? → Sensitivity label
• Detect risky user behavior? → Insider Risk Management

eDiscovery Standard vs Premium:

• Ad-hoc search + basic hold → Standard (E3)
• Custodian management + legal hold notices + advanced processing + review sets + predictive coding → Premium (E5)

Audit Standard vs Premium:

• 180-day retention, basic logs → Standard
• 1-year to 10-year retention, MailItemsAccessed + intelligent insights → Premium (E5)

Adaptive scope vs Static scope:

• Target changes with org (people move departments) → Adaptive
• Target is a fixed, hand-curated list → Static

---

Common Mistakes That Tank First-Time Candidates

Mistake #1: Skipping Hands-On Labs

SC-401 is the most hands-on-oriented Microsoft associate security exam. Candidates who only read Microsoft Learn and take practice tests consistently fail interactive components. Commit 15-20 hours in an E5 dev tenant.

Mistake #2: Confusing Sensitivity Labels and Retention Labels

These are completely different systems under the same "label" name. Sensitivity labels classify + protect access; retention labels govern lifecycle. Build a 1-page cheat sheet in Week 2 and drill it.

Mistake #3: Ignoring the AI / Copilot Content

SC-401 explicitly tests Microsoft 365 Copilot sensitivity label honoring, DSPM for AI, and data protection for generative AI workloads. This is new on SC-401 (not on SC-400). Candidates studying from old SC-400 material miss 3-5 questions here.

Mistake #4: Over-Studying One Domain

All three skill domains are 30-35%. Candidates who spent 70% of their time on information protection and crammed DLP + IRM in the last week consistently fail.

Mistake #5: Skipping Adaptive Scopes

Adaptive scopes appear in both Skill 1 and Skill 2. Knowing when to use adaptive vs static, and how to author the underlying query, is tested directly. Practice creating at least 2 adaptive-scope retention policies in your dev tenant.

Mistake #6: Underestimating Interactive Components

SC-401 now includes simulated Purview portal interactive components where you click to configure. Unless you have clicked through the real portal, these questions are slow and error-prone.

Mistake #7: Not Using the Open-Book Microsoft Learn Access

You have Microsoft Learn access during the exam. Do not try to look up every question — you do not have time. Use it strategically on 2-3 flagged questions per exam where you can narrow to 2 answers.

Mistake #8: Misreading "NOT" and "BEST" Questions

Microsoft loves questions like "Which is NOT a capability of Insider Risk Management?" or "What is the BEST solution for [scenario]?" Slow down on any question stem containing NOT, EXCEPT, ONLY, BEST, or FIRST.

---

Career Value After SC-401

SC-401 is an associate-tier role-based cert. Typical 2026 US salary bands for roles requiring SC-401 or equivalent Purview expertise:

Stack SC-401 With These Next

Realistic 2-year path: SC-900 now → SC-401 in 3-4 months → MS-102 in 6-9 months → Administrator Expert credential → senior Information Security Administrator or Purview consultant role at $120,000+.

---

Final CTA: Start Practicing Today

SC-401 is the modern, AI-aware successor to SC-400 and the fastest path to the Microsoft Certified: Information Security Administrator Associate credential in 2026. The candidates who fail almost always share two traits: they skipped hands-on labs, and they studied from outdated SC-400 material. You can fix both right now.

Start practicing nowPractice questions with detailed explanations

The 2026 Microsoft Purview market has more Information Security Administrator openings than qualified candidates. SC-401 is the fastest credential path into those openings, and the free annual renewal keeps it current for the rest of your career.

Good luck. You can pass this in 10 weeks.

---

Official Sources

• Microsoft SC-401 certification page: https://learn.microsoft.com/en-us/credentials/certifications/information-security-administrator/
• Official SC-401 study guide (effective 27 April 2026): https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-401
• Course SC-401T00-A on Microsoft Learn: https://learn.microsoft.com/en-us/training/courses/sc-401t00
• Microsoft Purview documentation: https://learn.microsoft.com/en-us/purview/
• Microsoft credential renewal policy: https://learn.microsoft.com/en-us/credentials/certifications/renew-your-microsoft-certification
• Microsoft exam retake policy: https://learn.microsoft.com/en-us/credentials/support/retake-policy
• Microsoft 365 Developer Program (free E5 tenant): https://developer.microsoft.com/microsoft-365/dev-program
• Microsoft Purview portal: https://purview.microsoft.com

Information current as of April 2026. Always verify specific fees, dates, and skills-measured details at learn.microsoft.com before scheduling.