Cloud Security Stack
Certification guides

Certifications

SC-401 study guide: Information Security Administrator

The exam that replaced SC-400 in 2025. Purview end to end, with a heavier weighting toward data security than the exam it replaced.

13 min read · Reviewed 22 August 2026 · Written against Microsoft's published SC-401 skills-measured outline.

What changed from SC-400

SC-400 retired on 30 May 2025 and SC-401 replaced it. The shape shifted: less emphasis on records management and retention as a discipline, more on data security posture, insider risk and protecting information in the places it actually leaks.

If you studied SC-400 material, a good deal carries across, but the weighting has moved and some of it is genuinely new.

The areas that carry the exam

01

Sensitivity labels end to end

Creation, scoping, publishing, auto-labelling in simulation and then enforcement, and what encryption a label actually applies. This is the spine of the exam.

02

Data loss prevention across the estate

Exchange, SharePoint, OneDrive, Teams, endpoint DLP. Knowing which policy locations cover which behaviours, and where endpoint DLP is required rather than optional.

03

Insider risk management

Policy templates, indicators, triage. Frequently under-prepared because few candidates have run it in anger, and it is worth real marks.

04

Data security posture for AI

How Purview reports on what Copilot can reach. Newer material, thin third-party coverage, and increasingly present in the objectives.

Study resources

Microsoft Learn

Microsoft Learn, the official SC-401 outline

Best for
Everyone. Purview changes quickly and Learn is the only source that keeps up
Watch out for
Screenshots in third-party courses date fast. Trust the current portal over any video
Open Microsoft Learn (opens in a new tab)
MeasureUp

MeasureUp practice tests

Best for
Exam-realistic questions from Microsoft's official practice partner
Watch out for
Confirm the SC-401 set exists and is current before buying, this exam is relatively new
See MeasureUp (opens in a new tab)

Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.

The verdict

Our pick

Worth it if you own Purview or data governance

It is the only Microsoft exam covering information protection properly, and the labelling and DLP knowledge is directly applicable from day one.

Who should skip

Skip it if you have no Purview access. This exam is unusually difficult to pass without a tenant to configure, because the questions are about configuration order rather than concepts.

Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.