The short version
This sheet is for your last pass before the exam. It follows the three domains of the skills outline that Microsoft lists as “Skills measured as of October 28, 2026”, with term pairs people mix up and rules of thumb for scenario questions. It does not cover everything: Microsoft says related topics may appear, so use it to review, not to learn from zero. Features and menu names change often, so confirm details in Microsoft’s documentation.
Exam facts at a glance
| Item | What Microsoft publishes |
|---|---|
| Exam | SC-401, Administering Information Security in Microsoft 365 |
| Level | Intermediate, administrator role |
| Time | 100 minutes to complete the exam |
| Questions | Number not published |
| Passing score | 700 on a scale of 1 to 1000 |
| Domains | Three, each 30-35% |
| Delivery | Proctored, through Pearson VUE |
| Retakes | 24 hours after the first fail, then 14 days; five attempts in 12 months |
| Credential | Expires after one year; free online renewal |
Details are on the exam format page and the renewal page.
Domain 1: Implement information protection (30-35%)
Key concepts
- Classification finds and names sensitive data. Labels act on it.
- Tools: sensitive info types, document fingerprinting, exact data match (EDM), trainable classifiers, OCR support for images.
- Data explorer and Content explorer show where classified and labeled data sits.
- Sensitivity labels can encrypt, mark content, and apply to items and to containers (Teams, Microsoft 365 groups, SharePoint sites, Power BI items).
- A label does nothing for users until a publishing policy offers it, or an auto-labeling policy applies it.
- The Information Protection client works on Windows files. The scanner reaches on-premises file shares in bulk. Message Encryption and Advanced Message Encryption cover mail.
Easily confused pairs
| Pair | Remember |
|---|---|
| Sensitive info type vs EDM | A type matches a pattern. EDM matches values against a table of real data. |
| Fingerprinting vs trainable classifier | Fingerprinting matches documents that look like a template. A classifier learns a category from examples. |
| Item label vs container label | Container labels govern settings of the site or team, not the files inside. |
| Publishing policy vs auto-labeling | Publishing lets users choose. Auto-labeling applies the label for them. |
| Client vs scanner | Client is per device and per user. The scanner crawls on-premises repositories. |
Decision rules
- A fixed format such as a number pattern points to a sensitive info type.
- A database column of real values points to EDM.
- A form or template points to document fingerprinting.
- “Files on an on-premises share” points to the scanner.
- A new auto-labeling policy usually starts in simulation, so check what it would do before it acts.
Domain 2: Implement data loss prevention and retention (30-35%)
Key concepts
- A DLP policy has locations, rules, conditions, and actions. Not every condition works in every location.
- Policy and rule precedence decides what happens when several apply.
- Adaptive Protection links Insider Risk Management levels to DLP, so riskier users get stricter rules.
- Endpoint DLP needs onboarded devices and covers activity such as copying or uploading. Just-in-time protection is a setting for it.
- Retention labels set how long items are kept and what happens afterward. Retention policies apply broadly to locations. Adaptive scopes pick targets by attributes instead of fixed lists.
- Policy lookup helps you see which retention settings apply to an item.
Easily confused pairs
| Pair | Remember |
|---|---|
| Sensitivity label vs retention label | One protects and marks. The other controls how long content stays. |
| Retention label vs retention policy | A label hits individual items. A policy hits locations. |
| Static vs adaptive scope | Static is a fixed list. Adaptive follows attributes. |
| DLP policy vs rule | The policy holds the locations. The rules hold conditions and actions. |
| Block vs audit-only | Read the verb: does the scenario want to stop the action or just see it? |
Decision rules
- “Keep for a period, then delete” is retention, not DLP.
- “Stop users from sharing or copying” is DLP.
- A rule that never fires on laptops makes you check device onboarding first.
- If two requirements cannot share one policy because of location limits, split the policy.
Domain 3: Manage risks, alerts, and activities (30-35%)
Key concepts
- Insider Risk Management: roles, connectors, settings, policy templates, indicators, alerts, cases, forensic evidence, notice templates.
- Audit (Premium) needs user licenses, and retention for audit records is set by audit retention policies.
- Activity explorer shows labeling and protection activity. Audit is the searchable log.
- You respond to DLP and insider risk alerts in the Purview portal, to Purview alerts in Microsoft Defender XDR, and to file policy alerts from Defender for Cloud Apps.
- eDiscovery searches content for legal or investigation purposes.
- Data Security Posture Management (DSPM) for AI has prerequisites, roles, and policies. Controls for content used by AI services sit in Purview and in the productivity workloads.
Easily confused pairs
| Pair | Remember |
|---|---|
| Template vs indicator | A template is the starting scenario. Indicators are the signals that feed it. |
| Audit vs Activity explorer | Query a log, or view a summary of activity. |
| Alert vs case | An alert is a signal. A case is where you investigate it. |
| Purview portal vs Defender XDR | Know which alert type lands where. |
| Audit search vs eDiscovery | One finds who did what. The other finds content. |
Decision rules
- “Who deleted or shared this and when” points to Audit.
- “Find all content that mentions a topic for a legal request” points to eDiscovery.
- “Departing employee downloading many files” points to an insider risk policy template.
- If the scenario mentions AI tools and sensitive prompts or files, think DSPM for AI.
Common traps
- Reading the answer options before the last sentence of the scenario, where the deciding constraint often sits.
- Picking the feature you know best instead of the one that fits the location.
- Forgetting roles and licenses, which can decide an answer on their own.
- Treating a policy as live when it is in simulation or test mode.
- Missing “without administrator involvement” or “for devices that are not onboarded”.
- Skipping the AI sub-area because older notes did not have it.
Last-day checklist
- Read the study guide’s three domain headings once and explain each aloud.
- Review your confusable pairs: EDM vs fingerprinting, label types, retention label vs policy, Audit vs Activity explorer.
- Rehearse where roles and licenses matter.
- Scan the change log of the study guide for anything new.
- Check your booking, ID, and test environment if you test online.
- Sleep. A tired mind misses the one deciding word.
More guides for SC-401
- SC-401 Study Plan: 4-Week and 8-Week
- Is SC-401 Hard? An Honest Difficulty Check
- SC-401 Prerequisites and Skills Self-Check
- Is SC-401 Worth It? An Honest Look
- SC-200 vs SC-401: Which First?
Next step
For examples of how a scenario is built, see the sample questions. For a longer explanation of each area, see domains explained. To measure where you stand, the SC-401 practice exams report your score per domain. The SC-401 overview lists the other pages.
FAQ
Can I use this sheet as my only study material?
No. It is a review aid. Learn the features first, ideally by using them in a test tenant.
Does the sheet cover every topic on the exam?
No. Microsoft says related topics may be covered, and features change.
Is this the same as the study guide?
No. The study guide lists Microsoft’s skills. This sheet gives short reminders in our own words.