Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the Microsoft Certified: Information Security Administrator Associate, Microsoft's data security certification for Microsoft 365, as of October 2026. This guide covers the SC-401 exam on the outline that takes effect October 28, 2026, the three Purview domains and their weights, the 100-minute format and 700 passing score, the $165 fee, the free annual renewal, what happened to SC-400, and the roles it fits.
The Microsoft Certified: Information Security Administrator Associate, earned by passing exam SC-401: Administering Information Security in Microsoft 365, is Microsoft's role-based certification for protecting data inside a Microsoft 365 tenant. It is built around Microsoft Purview, covering how you classify sensitive information, label it, keep it from leaking, retain it as long as policy requires, and investigate insider risk.
This is an associate exam, so it tests configuration more than vocabulary. Expect questions on which sensitive info type, label setting, DLP rule, or retention label meets a stated requirement, and on what happens when two policies overlap. Microsoft expects candidates to be familiar with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps. The role also covers protecting data used by AI services, which is newer ground for most admins.
SC-401 replaced SC-400. Microsoft announced the change in February 2025 and retired SC-400, its Information Protection and Compliance Administrator Associate certification, and the renewal assessment on May 31, 2025. Its stated reason was that SC-400 bundled two roles, information protection and compliance, and each needed its own validation. SC-401 keeps the information security side. The certification is issued and maintained by Microsoft, has no formal prerequisites, and renews free every year. Its English exam updates on October 28, 2026, and this page describes that outline.
Sensitive info types, EDM, trainable classifiers, sensitivity labels, the Purview client and scanner, and message encryption. 30 to 35%.
DLP policy design and precedence, Endpoint DLP, just-in-time protection, retention labels and policies, and adaptive scopes. 30 to 35%.
Insider Risk Management, Purview Audit, Activity explorer, alert response in Purview and Defender XDR, eDiscovery, and DSPM for AI. 30 to 35%.
Four things that set the Information Security Administrator Associate apart for people who protect data in Microsoft 365.
Microsoft Purview has a long feature list, and SC-401 covers its data security side in one exam, from classification, sensitivity labels, DLP, and retention to insider risk, audit, and the alert work that follows. For an admin who inherited a tenant full of unlabeled files and default DLP templates, the skills outline reads like a work plan.
Each domain carries 30 to 35 percent of the exam. There is no small domain to skim, so a candidate who knows labels well but has never opened Insider Risk Management will feel it. Split your study time roughly in thirds.
The third domain includes protecting data used by AI services, with controls in Purview and Microsoft 365 workloads and Data Security Posture Management for AI. The new SC-500 exam touches the same Purview work, as our article on the AZ-500 to SC-500 change explains.
Microsoft claims no DoD 8140 mapping for SC-401, so it won't satisfy a cyber-coded position requirement by itself. It also doesn't count toward the prerequisite for the SC-100 Cybersecurity Architect Expert, which catches some candidates off guard.
Its weight is market-driven instead. Microsoft partners, managed service providers, and organizations that run on Microsoft 365 ask for it because it maps to the Purview controls their security and compliance teams rely on.
The certification and the SC-401 exam as of October 2026, on the October 28, 2026 skills outline.
Most people go one of two ways from here. They add a second Microsoft security associate, which also opens the SC-100 architect exam, or they pick up a vendor-neutral privacy credential that covers the rules behind their Purview policies.
The security operations move. SC-200 covers triage, incident response, and threat hunting with Microsoft Defender XDR and Microsoft Sentinel. SC-401 already has you responding to Purview alerts inside Defender XDR, so the console will look familiar, and SC-200 is one of the three certifications that satisfy the SC-100 prerequisite.
The identity move. SC-300 is the role-based Microsoft Entra exam, covering user identities, authentication and access management, workload identities, and identity governance. Data protection policies lean on identity, so the two pair naturally, and SC-300 counts toward SC-100 where SC-401 does not.
The vendor-neutral move. If privacy law and data handling rules drive your Purview work, ISACA's CDPSE covers privacy engineering and the data life cycle, and the IAPP's CIPP/US covers US privacy law. See our CDPSE guide and CIPP/US guide.
SC-401 sits at the associate tier of Microsoft's role-based path. SC-900 is useful groundwork, and from here the path branches into Microsoft security architecture (after an eligible associate certification) or vendor-neutral privacy credentials.
Helpful groundwork, not required
The data security credential
Two questions to answer before you commit: can you sit it, and should you pursue SC-401 specifically. Here's a straight answer to both.
Anyone can register, but the exam assumes tenant experience.
Microsoft lists no prerequisite certification for SC-401. You register through Pearson VUE, pay the $165 US fee, and sit a 100-minute exam at a test center or online. If the exam isn't offered in your preferred language, you can request an extra 30 minutes.
An associate exam written for people who configure Purview.
Microsoft expects familiarity with all Microsoft 365 services, PowerShell, Microsoft Entra, the Defender portal, and Defender for Cloud Apps. Questions ask what to configure and which policy wins when two overlap, and that is hard to learn from slides. Build labels and DLP policies in a lab tenant, then take Microsoft's free SC-401 practice assessment on Microsoft Learn to see which domains need more work.
SC-401 is a role-based certification, so it maps to real job duties. These are the roles where the Purview skills it tests are used every day.
The role SC-401 is named for. Plans and runs data security in a Microsoft 365 tenant with Microsoft Purview, from classification and sensitivity labels to DLP, retention, and insider risk. Microsoft describes it as a role that works with governance, data, and security teams and takes part in incident response.
Owns the sensitivity label taxonomy, the publishing and auto-labeling policies, and the scanner that classifies on-premises file shares. The first SC-401 domain maps almost line for line to this job.
Tunes DLP policies across Microsoft 365 workloads and Windows endpoints, then works the alerts those policies raise. SC-401 covers both halves, building the policies in the second domain and responding to DLP alerts in the third.
Reviews insider risk alerts, opens and manages cases, collects forensic evidence, and sends notices through the Insider Risk Management workflow. The work often pulls in HR and legal teams before a case goes any further.
Runs the tenant and inherits its data protection settings. Admins preparing for Microsoft 365 Copilot or other AI services get the most from the SC-401 skill area on protecting data used by AI, including DSPM for AI.
Deploys Purview for clients at a Microsoft partner or managed service provider. SC-401 is the role-based credential that tells a customer the consultant has configured labels, DLP, and insider risk policies, not only read about them.
SC-401 is most often weighed against the fundamentals exam that comes before it, the identity exam that sits beside it, and a vendor-neutral data privacy credential. Here is how the four line up.
| SC-401 | Security, Compliance, and Identity Fundamentals (SC-900) | Identity and Access Administrator (SC-300) | ISACA CDPSE | |
|---|---|---|---|---|
| Issuer | Microsoft | Microsoft | Microsoft | ISACA |
| Level | Associate (role-based) | Fundamentals | Associate (role-based) | Experienced practitioner, vendor-neutral |
| Focus | Data security with Microsoft Purview | Microsoft security, compliance, and identity concepts | Identity and access with Microsoft Entra | Privacy engineering and the data life cycle |
| Domains | 3 | 4 | 4 | 4 |
| Prerequisites | None | None | None | 3+ years in CDPSE domains (can pass first, apply within 5 years) |
| Exam | 100 min, count not published | 45 min, count not published | 100 min, count not published | 120 questions, 3.5 hours |
| Passing Score | 700 of 1000 | 700 of 1000 | 700 of 1000 | 450 on a 200 to 800 scale |
| Cost (US) | $165 | $99 | $165 | $575 members, $760 non-members |
| Validity | 1 year, free renewal | Does not expire | 1 year, free renewal | 3-year CPE cycle, annual fee |
| Counts Toward SC-100 | No | No | Yes | Not applicable |
| DoD 8140 | No mapping claimed | Not listed | No mapping claimed | Not listed (Matrix V2.1) |
| Best For | Admins who own labels, DLP, retention, and insider risk in Microsoft 365 | First security credential in a Microsoft shop | Admins who run Entra ID and Conditional Access | Technical privacy roles on any platform |
Pricing varies by region and taxes. Microsoft claims no DoD 8140 mapping for SC-401 or SC-300, and their recognition is market-driven. SC-300 facts are from Microsoft Learn as of October 2026, and its English exam also updates on October 28, 2026. SC-900 facts are from our SC-900 guide and CDPSE facts are from our CDPSE guide.
Certification Matchups: 92 head-to-head matchups with the published facts, strengths and weak spots side by side.
Our Microsoft Information Security Administrator boot camp covers all three SC-401 domains in four days of live, instructor-led training, online or in person. You work in hosted Microsoft Purview lab tenants with Microsoft Official Courseware and practice questions mapped to the domains, and your $165 exam voucher, a free retake, and 180 days of instructor support after class are included.
Where SC-401 sits in the 2026 Microsoft lineup, what the exams around it require, and how to study an outline this detailed.
Where SC-401 sits in the current Microsoft lineup after a year of retirements, including the May 2025 switch from SC-400, and how the security track runs from SC-900 up to SC-100.
The expert exam at the top of the Microsoft security track. Read the prerequisite section before you plan around it, because SC-100 requires SC-200, SC-300, or SC-500, and SC-401 is not on that list.
What the new Cloud and AI Security Engineer exam covers, including the Purview Data Security Posture Management and Copilot exposure work that overlaps with the AI skill area in SC-401.
Which Microsoft exams people are sitting this year, what associate exams cost in the United States, and the yearly renewal every associate certification needs.
A February 2026 federal ruling made consumer AI chats discoverable. The piece explains why data classification and endpoint DLP now matter for AI use, the same controls SC-401 tests.
Microsoft publishes its objectives as the study guide on Microsoft Learn. This article shows how to read the verbs and weights in an outline like the SC-401 skills measured list.
How Microsoft's retake windows (24 hours, then 14 days, five attempts a year) and its Pearson VUE waiver process compare with other certification bodies.
The SC-401 exam is organized into three domains, each weighted 30 to 35 percent, and each holds three skill areas, running from data classification to DSPM for AI. Click any domain for what it covers.
Classification comes first: translating an organization's sensitive information requirements into built-in or custom sensitive info types, document fingerprinting, exact data match (EDM) types, trainable classifiers, and OCR support, then checking the results in Data explorer and Content explorer. The domain moves on to sensitivity labels in Microsoft Purview, covering admin roles, labels for items and containers, protection settings and content marking, publishing and auto-labeling policies, and labels for Teams, Microsoft 365 Groups, SharePoint sites, and Power BI, including labeling through Defender for Cloud Apps. It closes with the Purview Information Protection client and scanner for Windows and on-premises file shares, and Purview Message Encryption and Advanced Message Encryption for Exchange.
Designing DLP policies from business requirements, assigning DLP roles, and building and managing the policies, including DLP for Adaptive Protection, policy and rule precedence, and Defender for Cloud Apps file policies that use a DLP policy. Endpoint DLP gets its own skill area: device requirements and extensions, advanced device rules, Endpoint DLP settings, just-in-time protection, and monitoring endpoint activity. The retention half covers retention labels for retention and disposition, adaptive policy scopes, publishing and auto-applying labels, policy precedence with Policy lookup, retention policies, and recovering retained content in Microsoft 365.
Insider Risk Management from setup to casework: roles, connectors, the Defender for Endpoint integration, settings, policy indicators, choosing a policy template, policies, forensic evidence, insider risk levels for Adaptive Protection, and working alerts and cases with notice templates. Then the investigation work, with Audit (Premium) licensing, searches in Microsoft Purview Audit, audit retention policies, Activity explorer, responding to DLP alerts in the Purview portal and to Purview alerts in Microsoft Defender XDR, Defender for Cloud Apps file policy alerts, and eDiscovery searches. The last skill area protects data used by AI services, with controls in Purview and in Microsoft 365 workloads plus the prerequisites, roles, policies, and monitoring for Data Security Posture Management (DSPM) for AI.
Domains and weights reflect the Microsoft SC-401 skills-measured outline as of October 28, 2026 for the English exam. Microsoft's change log lists a minor change to the sensitivity labels skill area and no change to the audience profile. Localized exams follow about eight weeks later, so confirm the current outline in the SC-401 study guide before scheduling.
The questions candidates ask most often when researching the Microsoft Information Security Administrator Associate certification.
The Microsoft Certified: Information Security Administrator Associate, earned by passing exam SC-401: Administering Information Security in Microsoft 365, is Microsoft's role-based certification for data security in Microsoft 365. It covers information protection, data loss prevention, retention, insider risk management, and information security alerts and activities, mostly through Microsoft Purview. It's an associate exam, so it tests how you configure and run these controls, not just what they are.
Microsoft updates the English version of SC-401 on October 28, 2026. The three domains and their weights stay the same, and the audience profile doesn't change. Microsoft's change log lists one minor change, in the skill area for implementing and managing sensitivity labels in Purview. Localized versions are updated about eight weeks after the English one. This page describes the October 28, 2026 outline.
Yes. Microsoft retired exam SC-400, the Information Protection and Compliance Administrator Associate certification, and its renewal assessment on May 31, 2025, and pointed new candidates to SC-401. The stated reason was that SC-400 combined two roles, information protection and compliance, that each needed their own validation. SC-401 covers the information security role. For compliance skills, Microsoft offers Applied Skills credentials such as Implement retention, eDiscovery, and Communication Compliance in Microsoft Purview. An SC-400 certification stays on your transcript, but it can no longer be renewed.
No. Microsoft lists no prerequisite certification, so anyone can register. The exam is written for working administrators, though. Microsoft says you should be familiar with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps. Without hands-on time in a tenant, the scenario questions are hard to answer.
The three domains are Implement information protection (30 to 35 percent), Implement data loss prevention and retention (30 to 35 percent), and Manage risks, alerts, and activities (30 to 35 percent). The weights are even, so no domain is safe to skim. Domain three also includes protecting data used by AI services with Data Security Posture Management (DSPM) for AI.
Microsoft doesn't publish a question count for SC-401. It says most of its certification exams contain between 40 and 60 questions, and the number can vary by exam. You have 100 minutes, and the exam may include interactive components. Associate exams also let you open Microsoft Learn during the exam, but the clock keeps running while you search, so treat it as a backup and not a study plan.
You need 700 on a scale of 1 to 1,000. It's a scaled score, so 700 doesn't mean 70 percent correct. Microsoft sets the passing line from the skills needed to show competence and the difficulty of the questions, so aim to be solid across all three domains rather than chasing a target percentage.
The SC-401 exam costs $165 USD in the United States as of October 2026. Microsoft sets the price by the country where you test, and local taxes can apply. You schedule it through Pearson VUE, at a test center or online. Training Camp's Microsoft Information Security Administrator boot camp includes the exam voucher in the program fee, along with a free retake.
Microsoft doesn't claim a DoD 8140 mapping for SC-401, so don't count on it to satisfy a cyber-coded position requirement on its own. Its value is with employers and Microsoft partners that run on Microsoft 365 and need people who can configure Purview. If you need an 8140-approved credential, CompTIA Security+ is the usual entry point. See the full DoD 8140 work role paths.
Yes. Like other Microsoft associate certifications, it's valid for one year. You renew it free by passing an unproctored, open-book online assessment on Microsoft Learn during the six months before it expires, and you can retake that assessment as often as you need before the expiration date. Passing extends the certification one year from its expiration date.
No. To earn the Microsoft Certified: Cybersecurity Architect Expert you pass SC-100 and hold at least one of three associate certifications: Identity and Access Administrator (SC-300), Security Operations Analyst (SC-200), or Cloud and AI Security Engineer (SC-500). SC-401 isn't on that list, so plan for one of those if the architect credential is your goal.
SC-401 fits roles that own data protection in Microsoft 365, such as information security administrator, information protection administrator, DLP analyst, insider risk analyst, Microsoft 365 administrator, and Microsoft security consultant at a partner. Employers read it as evidence that you have configured sensitivity labels, DLP, retention, and Insider Risk Management, not only studied them. Time in a real tenant still carries more weight than the certificate alone.
Pick the one that matches your work. SC-401 is about data, meaning how you classify it, label it, keep it from leaking, retain it, and investigate insider risk in Microsoft Purview. SC-300 is about identity, meaning users, authentication, Conditional Access, and governance in Microsoft Entra. Both are 100-minute, $165 associate exams that renew free each year. SC-300 also counts toward SC-100 and SC-401 doesn't, so if the architect credential is on your list, SC-300 does double duty.
Harder than SC-900, and the difficulty is in the details. Classification, labels, DLP, retention, and insider risk each have their own settings, roles, and precedence rules, and the exam moves between them. Questions about which policy wins when two apply are a good test of whether you have built the policies yourself. Plan on several weeks with the Microsoft Learn material, a lab tenant, and the free practice assessment, and give the third domain as much time as the first two.
For Microsoft 365 administrators and security staff who own data protection, yes. It's the Microsoft certification written for that role, it costs $165 with a free annual renewal, and its outline covers protecting data used by AI services, which matters to any tenant rolling out Microsoft 365 Copilot. It's a weaker fit if you want the SC-100 architect path, need a DoD 8140 credential, or work mainly in compliance, where Microsoft points to Applied Skills.
If you're weighing SC-401, moving on from an SC-400 certification, or arranging Purview training for a team, tell us where you are and we'll help you map out the right path.