SC-401 Domains Explained With Weightings

The short version

SC-401 has three domains, each weighted 30-35% in the study guide that Microsoft lists as “Skills measured as of October 28, 2026”. That is an even split, so every domain matters. Most lost points come from look-alike features, not from obscure ones: two options that both sound right, and one stated condition that decides.

The names below are Microsoft’s. The “in practice”, “traps”, and “practice” notes are our own explanations.

Domain 1: Implement information protection (30-35%)

Microsoft divides this domain into three groups: data classification, sensitivity labels, and protection for Windows, file shares, and Exchange.

In practice. You find out what sensitive data the organization has and mark it so that other controls can act on it. Classification means choosing between built-in and custom sensitive info types, document fingerprinting, exact data match (EDM), and trainable classifiers, then checking results in Data explorer and Content explorer. Labels turn that into protection: encryption, content marking, and scopes for items or containers such as Teams, Microsoft 365 groups, and SharePoint sites. The client and scanner extend labeling to files on devices and on-premises file shares, and Message Encryption covers mail.

Typical traps.

  • Picking the wrong classifier. A sensitive info type matches a pattern. Document fingerprinting matches documents that resemble a template. EDM matches values against a table of real data. A trainable classifier learns a category from examples. Read for the clue: a pattern, a form, a database column, or a type of document.
  • Confusing a label on an item with a label on a container. Container labels govern things like privacy and sharing of the site or team, not the files inside it.
  • Forgetting who may do what. Roles and permissions to administer labels, and who can change a container label, are fair game.
  • Assuming an auto-labeling policy is live as soon as you create it. Know what simulation mode is for.

What to practice. Build one custom sensitive info type, publish one label, and create an auto-labeling policy in simulation. Know when the scanner is the answer and when a label policy is.

Domain 2: Implement data loss prevention and retention (30-35%)

Microsoft divides this domain into three groups: DLP policies, Endpoint DLP, and retention.

In practice. DLP stops sensitive data leaving through the wrong door. You design policies around requirements, pick locations, write rules with conditions and actions, handle precedence, and delegate administration. Adaptive Protection links DLP to Insider Risk Management so that stricter rules apply to riskier users. Endpoint DLP extends this to devices: which devices qualify, which settings apply, how just-in-time protection behaves, and how you monitor activity. Retention keeps content for as long as it must be kept and deletes it afterward, using retention labels, label policies (publish or auto-apply), adaptive scopes, and retention policies.

Typical traps.

  • Sensitivity label or retention label? One protects and marks content, the other controls how long it is kept. A question about “keep for seven years” is retention, even if “label” appears in every option.
  • Retention label or retention policy? A policy applies broadly to locations. A label applies to individual items and can be published or auto-applied.
  • Locations and conditions that do not mix. Some conditions are not supported across every location, so one policy may not fit a mixed set of requirements. Look for the answer that splits the policy.
  • Overlap. When several policies or rules apply, precedence decides. Know the principles and know that Policy lookup helps you see what applies to an item.
  • Endpoint DLP prerequisites. A rule that “never fires” often points to a device that is not onboarded or a missing setting.

What to practice. Create a DLP policy for two locations and note what each location lets you configure. Create one retention label with a publish policy and one with auto-apply. Read the section on how multiple retention settings interact.

Domain 3: Manage risks, alerts, and activities (30-35%)

Microsoft divides this domain into three groups: Insider Risk Management, alerts and activities, and protecting data used by AI services.

In practice. This is the operational side. In Insider Risk Management you pick a policy template, set indicators, connect data sources, and work alerts and cases, including notice templates and forensic evidence settings. For alerts and activities you assign Audit (Premium) licenses, search audit logs, set audit retention policies, use Activity explorer, respond to DLP and Insider Risk alerts in the Purview portal, handle Purview alerts in Microsoft Defender XDR and Defender for Cloud Apps file policy alerts, and run eDiscovery searches. The AI group covers controls that protect content when AI services are in use, plus the prerequisites, roles, policies, and monitoring for DSPM for AI.

Typical traps.

  • Audit versus Activity explorer. One is a searchable log you query, the other is a view of labeling and protection activity. The scenario tells you which one fits.
  • Templates and indicators. A template is a starting point for a risk scenario. Indicators are the signals that feed it. Do not swap them.
  • Where to respond. Know which alerts you work in the Purview portal and which in Defender XDR.
  • The AI sub-area is new enough that older study material skips it. Do not.
  • Licensing and roles. Some questions hinge on who must hold which role or license before a feature works.

What to practice. Run an audit search with a date range and a user filter, open Activity explorer, and walk through an Insider Risk policy wizard if your tenant allows it. For DSPM for AI, read the prerequisites and the roles that manage it.

How the domains connect

The three domains are one story. Classification and labels in domain 1 feed conditions in DLP and retention in domain 2. Those policies produce alerts and activities that you investigate in domain 3, and Adaptive Protection ties insider risk levels back to DLP. If you study them in isolation you will miss the cross-domain questions.

More guides for SC-401

Next step

Check your understanding on the sample questions page, which has a question or two from each domain. For a full workout, the SC-401 practice exams report your score by domain so you can see which of the three needs work.

FAQ

Are the domains weighted equally?

In the current study guide, each has the same 30-35% range. Microsoft does not give a single percentage for each.

Which domain is hardest?

It depends on your background. Candidates who administer Microsoft 365 often find domain 3 newest, because Insider Risk Management and DSPM for AI are rarely part of daily work.

Do I need to know PowerShell?

Microsoft lists PowerShell among the things you should be familiar with. Know what it is used for in Purview, but concepts and portal settings matter more in the study guide bullets.

Try the SC-401 practice exams