Certifications
SC-401 study guide: Information Security Administrator
The exam that replaced SC-400 in 2025. Purview end to end, with a heavier weighting toward data security than the exam it replaced.
What changed from SC-400
SC-400 retired on 30 May 2025 and SC-401 replaced it. The shape shifted: less emphasis on records management and retention as a discipline, more on data security posture, insider risk and protecting information in the places it actually leaks.
If you studied SC-400 material, a good deal carries across, but the weighting has moved and some of it is genuinely new.
The areas that carry the exam
Sensitivity labels end to end
Creation, scoping, publishing, auto-labelling in simulation and then enforcement, and what encryption a label actually applies. This is the spine of the exam.
Data loss prevention across the estate
Exchange, SharePoint, OneDrive, Teams, endpoint DLP. Knowing which policy locations cover which behaviours, and where endpoint DLP is required rather than optional.
Insider risk management
Policy templates, indicators, triage. Frequently under-prepared because few candidates have run it in anger, and it is worth real marks.
Data security posture for AI
How Purview reports on what Copilot can reach. Newer material, thin third-party coverage, and increasingly present in the objectives.
Study resources
Microsoft Learn, the official SC-401 outline
- Best for
- Everyone. Purview changes quickly and Learn is the only source that keeps up
- Watch out for
- Screenshots in third-party courses date fast. Trust the current portal over any video
MeasureUp practice tests
- Best for
- Exam-realistic questions from Microsoft's official practice partner
- Watch out for
- Confirm the SC-401 set exists and is current before buying, this exam is relatively new
Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.
The verdict
Worth it if you own Purview or data governance
It is the only Microsoft exam covering information protection properly, and the labelling and DLP knowledge is directly applicable from day one.
Skip it if you have no Purview access. This exam is unusually difficult to pass without a tenant to configure, because the questions are about configuration order rather than concepts.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.