The short version
SC-401 is Microsoft’s intermediate exam for people who protect data in Microsoft 365 with Microsoft Purview. It covers three equally weighted areas: information protection, data loss prevention and retention, and managing risks, alerts, and activities. This guide uses the study guide that Microsoft lists as “Skills measured as of October 28, 2026”.
What the exam is
The full name is Administering Information Security in Microsoft 365. Passing it earns the Microsoft Certified: Information Security Administrator Associate credential, which Microsoft labels as intermediate level and aims at the administrator role.
This is an administrator exam, not a vocabulary test. You are expected to choose the right control for a business need and to know how it is set up: which role is required, which setting has which effect, and what happens when two policies overlap. Questions are scenario based. A typical one describes a company, a requirement, and a constraint, then asks what you should configure.
The work behind the exam is described by Microsoft as planning and implementing information security for sensitive data with Microsoft Purview and related services. That includes protecting data used by AI services, which is its own set of skills in the current outline.
Who it is for
Microsoft describes the information security administrator as someone who reduces risk to data inside Microsoft 365 collaboration environments, from internal and external threats. You work with governance, data, and security teams to turn policy into settings, and you take part in responding to security incidents.
Microsoft says you should be familiar with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps. The prerequisites page turns that list into a self-check.
Format at a glance
| Item | What Microsoft says |
|---|---|
| Exam code | SC-401 |
| Level | Intermediate |
| Time | 100 minutes to complete the exam |
| Questions | Number not published |
| Passing score | 700 on a scale of 1 to 1000 |
| Languages | English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified), Spanish |
| Delivery | Proctored, scheduled through Pearson VUE |
| Retake | 24 hours after a first failed attempt, then 14 days |
The question count is not published for this exam. Microsoft only says that most of its exams have between 40 and 60 questions and that the number can change. Interactive components may appear. The exam format page goes through scoring, breaks, and retakes.
The three domains
Microsoft gives each domain a range instead of a single figure. All three have the same range.
| Domain | Weighting |
|---|---|
| Implement information protection | 30-35% |
| Implement data loss prevention and retention | 30-35% |
| Manage risks, alerts, and activities | 30-35% |
In short:
- Implement information protection covers data classification (sensitive info types, fingerprinting, exact data match, trainable classifiers), sensitivity labels, and protection for Windows, file shares, and Exchange with the Purview Information Protection client, the scanner, and Message Encryption.
- Implement data loss prevention and retention covers DLP policies, Endpoint DLP, retention labels, retention policies, and adaptive scopes.
- Manage risks, alerts, and activities covers Insider Risk Management, Audit, Activity explorer, eDiscovery, alert handling in Microsoft Defender XDR, and protecting data used by AI services.
Because the three ranges are the same, no domain can be skipped. A weak spot in one of them costs as much as a weak spot in another. The domains explained page covers each area in depth.
What is new in this version
Microsoft’s change log for the October 28, 2026 skills outline marks the sensitivity labels area as a minor change and the audience profile and information protection group as unchanged. The portion of the log that we could read did not show the other groups. Treat the study guide as the authority and check its change log yourself before you start.
AI is easy to underestimate. The outline has a full sub-area on protecting data used by AI services, including Data Security Posture Management (DSPM) for AI. If your study material predates that, it has a gap.
Official source
Read the study guide once, end to end, before you plan anything. It is free, and the bullets show exactly how Microsoft phrases each skill.
You can read Microsoft’s pages here:
More guides for SC-401
- SC-401 Study Plan: 4-Week and 8-Week
- SC-401 Sample Questions With Answers
- Is SC-401 Hard? An Honest Difficulty Check
- SC-401 Renewal and Retakes Explained
- Is SC-401 Worth It? An Honest Look
- SC-401 Cheat Sheet: Key Facts to Review
- SC-200 vs SC-401: Which First?
Next step
Continue with the exam format page to see how the 100 minutes and the scoring work. When you want to check your readiness, the SC-401 practice exams give you five sets of original questions with an explanation for every answer option.
FAQ
Is SC-401 a beginner exam?
No. Microsoft labels the credential intermediate and expects familiarity with Microsoft 365 services, PowerShell, Microsoft Entra, and the Defender portal. There are no formal prerequisites listed on the pages we checked.
Does the certification expire?
Microsoft says associate certifications expire unless renewed. Renewal is free, done through an unproctored online assessment on Microsoft Learn, and extends the credential by one year.
How many questions are on SC-401?
Microsoft does not publish a number for this exam. Plan for the 100-minute time limit rather than for a fixed count.
Is the exam available in languages other than English?
Yes. Microsoft lists seven languages. Localized versions are updated about eight weeks after the English version, and you can ask for 30 extra minutes if your language is not available.