1.1 Current SC-401 Exam Facts
Key Takeaways
- Passing Exam SC-401: Administering Information Security in Microsoft 365 is how you earn Microsoft Certified: Information Security Administrator Associate.
- Microsoft's SC-401 page lists 100 minutes to complete the exam; associate exams without labs use 120 minutes of seat time for instructions and comments.
- Microsoft does not publish an SC-401-specific question count; most Microsoft certification exams typically contain 40–60 questions.
- SC-401 is proctored through Pearson VUE in English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified), and Spanish, and may include interactive components.
- Register with a personal Microsoft account (MSA). A work or school Azure AD account makes exam records unrecoverable if you leave that organization.
1.1 Current SC-401 Exam Facts
Quick Answer: Exam SC-401: Administering Information Security in Microsoft 365 is the Pearson VUE exam that earns Microsoft Certified: Information Security Administrator Associate. Microsoft's live certification page lists 100 minutes to complete the assessment. Microsoft does not publish an SC-401-specific question count; the duration policy says most Microsoft Certification exams typically contain 40–60 questions. Schedule with a personal Microsoft account (MSA).
Exam identity: exam code versus credential name
Treat the exam code and the credential name as two related but different labels. Exam SC-401 is the assessment you sit. The certification you hold after you pass is Microsoft Certified: Information Security Administrator Associate. Recruiters, partner scorecards, and Microsoft Learn transcripts display the credential name. Pearson VUE appointment confirmations display the exam code. Searching only for "Information Security Administrator" on a third-party calendar can land you on a retired SC-400 listing or on instructor-led courseware such as SC-401T00. Book from the Microsoft Learn certification page for Information Security Administrator, then follow the Pearson VUE schedule link that names exam SC-401.
Microsoft classifies the credential as Intermediate, maps it to the Administrator role, and places the subject under information protection and governance. The product family on the certification page is Microsoft 365 security, but the work you actually do is centered on Microsoft Purview plus related services: Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps (MDCA). The certification page last-updated stamp is July 28, 2026, which matches the skills-measured date on the official study guide.
There is no formal prerequisite exam. Microsoft does not require SC-900, SC-200, SC-300, or MS-102 before you book SC-401. What Microsoft does expect in practice is fluency: you should already know Microsoft 365 workloads, be able to run PowerShell, and navigate Entra, Purview, Defender, and Defender for Cloud Apps without a tutorial. If you cannot find the Purview portal, create a sensitivity label, or open an audit search without screenshots, you are not ready to spend exam minutes hunting menus.
Who should take SC-401
The audience is an information security administrator who plans and implements protection for sensitive data. You mitigate risk inside Microsoft 365 collaboration surfaces—Exchange Online, SharePoint, OneDrive, Teams, and connected cloud apps—against both internal and external threats, and you extend those controls to data used by artificial intelligence (AI) services. Day-to-day work includes information protection, data loss prevention (DLP), retention, Insider Risk Management (IRM), and the investigation of information-security alerts.
You do not work in isolation. The role collaborates with governance, data, and security stakeholders to turn policy into Purview controls, and it participates in incident response. If your job is primarily identity engineering, security-operations hunting, or tenant-wide Microsoft 365 administration, SC-401 is a neighboring skill set, not a substitute. Those neighboring exams are useful background; they are not gates on the registration form.
Duration, typical item count, and seat time
The SC-401 certification page states that you will have 100 minutes to complete this assessment. That 100-minute figure is the exam clock, not the full appointment. Microsoft's exam-duration table lists associate and expert role-based exams without labs as 100 minutes of exam duration and 120 minutes of seat duration. Seat time covers instructions, the Microsoft Certification Exam Candidate Agreement, the questions themselves, and optional comments after you finish.
Microsoft's duration page also states that the number of questions is subject to change and that most Microsoft Certification exams typically contain between 40 and 60 questions. Microsoft does not publish a fixed SC-401 item count. Do not memorize a practice-bank size as the live length. A local practice set of about 200 items is a study inventory, not the exam you will sit. Do not convert 100 minutes into a guaranteed seconds-per-question formula that assumes 50 items—your seating might be nearer 40 or nearer 60, and interactive items take longer than a single multiple-choice stem.
Five minutes of the exam time are built in for unscheduled breaks. The clock continues during a break. After you start a break you cannot return to questions you already viewed, even if they were unanswered or marked for review. Breaks are not allowed in the middle of a lab or a problem-solution set. If you need more than the built-in five minutes, request extra time through Microsoft's accommodation process before you register.
| Detail | Official position (as of 2026) |
|---|---|
| Exam code | SC-401 |
| Exam title | Administering Information Security in Microsoft 365 |
| Credential | Microsoft Certified: Information Security Administrator Associate |
| Exam duration | 100 minutes (SC-401 certification page) |
| Seat duration (associate, no labs) | 120 minutes (exam duration policy table) |
| Typical item count | 40–60 for most Microsoft exams; SC-401-specific count is not published |
| Delivery | Pearson VUE, proctored; interactive components possible |
| Languages | English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified), Spanish |
| Typical U.S. associate price | US$165; the SC-401 page itself says price varies by country or region |
Languages, Pearson VUE, and the MSA warning
SC-401 is offered in English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified), and Spanish. Localized versions of Microsoft exams are typically updated about eight weeks after the English skills-measured change. If the exam is not available in your preferred language, Microsoft lets you request an additional 30 minutes. If you must sit the exam in English as a second language, extra time is a separate accommodation requested in advance through Pearson VUE's English-as-a-second-language process—the proctor cannot grant it on the day.
You schedule through Pearson VUE, either at a test center or via online proctoring. Microsoft's FAQ allows scheduling no more than 90 days in advance and, effective January 16, 2023, a maximum of two Microsoft Certification exams on the calendar at once. After you take or cancel one, you can register for another.
Microsoft strongly recommends registering with a personal Microsoft account (MSA). If you register with an organizational work or school Azure Active Directory (Azure AD) / Microsoft Entra ID account, exam records will be lost if you leave your organization and they will be unrecoverable. That warning is printed on the SC-401 certification page. Use the same MSA you will later use to view score reports and to connect your certification profile to Microsoft Learn.
Proctoring, interactive components, and the sandbox
SC-401 will be proctored. Microsoft also states that you may have interactive components to complete. Microsoft does not publish a list of exams that currently include labs, because labs can be removed because of Azure outages or bandwidth. When you launch the exam, read the overview screens: they tell you whether labs, case studies, or other special formats are in your seating. Plan as if interactive items are possible so you are not surprised if a lab section appears at the end.
Microsoft's exam sandbox (aka.ms/examdemo) lets you practice the interface—active screen, build list, case studies, drag and drop, hot area, multiple choice, labs, mark-for-review, and the timer—without the live exam's secure browser. If you use assistive technology, request an accommodation before you register. The sandbox does not enable the real exam's secure browser, which blocks unapproved third-party tools.
Microsoft Learn during the exam
Because SC-401 is an associate role-based exam, you can open Microsoft Learn in a split screen while you test. Fundamentals and GitHub exams do not get this resource. Extra time is not added; the exam timer continues while you browse. You can reach content on the learn.microsoft.com domain except Q&A, practice assessments, and your profile (you cannot sign in). Ctrl+F (Windows) or Command+F (Mac) works inside a Learn page, not inside the exam stem window. Links that leave the Learn domain are blocked. Use Learn to confirm a portal path or a PowerShell noun you already understand—not to discover DLP precedence for the first time. Candidates who treat Learn as an open-book encyclopedia routinely run out of the 100-minute clock.
Cost caveats
The SC-401 page does not print a dollar amount. It says price is based on the country or region where the exam is proctored. Microsoft's certification FAQ states that associate and expert exams typically cost US$165, priced according to local currency, subject to change, with taxes in some regions. Academic discounts and Exam Replay packages exist separately. Confirm the amount at Pearson VUE checkout. Every failed retake is another paid attempt unless a Microsoft offer applies. Microsoft does not refund exams you fail or appointments you miss.
What this exam is not
Official Microsoft pages to re-check before you pay
- Information Security Administrator Associate — duration, languages, Pearson VUE, MSA warning
- Exam duration and exam experience — 40–60 typical items, seat time, Learn-during-exam, breaks
- Exam SC-401 study guide — skills measured as of July 28, 2026
Which credential do you earn by passing Exam SC-401: Administering Information Security in Microsoft 365?
How much time does Microsoft list to complete Exam SC-401 itself (the exam clock, not seat time)?
Why does Microsoft strongly recommend registering for SC-401 with a personal Microsoft account (MSA) instead of a work or school Azure AD account?