SC-400 to SC-401: What Changed, and What Your Old Notes Miss
SC-400 retired on 31 May 2025. SC-401 is not a renumbering — compliance came out, AI data protection went in, and the domain balance changed completely.
On this page
Microsoft retired SC-400 — and the Information Protection and Compliance Administrator certification with it — on 31 May 2025. Its replacement, SC-401, had already become available in April 2025 and leads to Microsoft Certified: Information Security Administrator Associate.
The rename is the clue to what actually happened. Microsoft had feedback that SC-400 was covering two distinct jobs — data security and compliance — inside one credential. SC-401 keeps the data security half and drops compliance. No dedicated compliance certification replaced the part that was removed.
This brief is built against the SC-401 skills-measured document published 28 July 2026.
SC-401 is not SC-400 renumbered. The compliance scope is gone, the three domains are now weighted almost equally at 30–35% each, and an entirely new objective group covers protecting data used by AI services.
Why SC-400 was retired
SC-400 asked one person to be responsible for both information protection — labels, DLP, encryption, the technical machinery of keeping sensitive data contained — and organisational compliance. In most organisations those are different people with different reporting lines.
Microsoft's response was to split the credential along that seam and keep the technical half. If your interest was the compliance half, the uncomfortable answer is that there is no direct successor certification.
Old structure versus new
SC-401's three domains, from the current study guide:
Three domains at identical weight. That is unusual and it carries a clear message: there is no domain you can afford to skip. SC-400 rewarded candidates who went deep on DLP; SC-401 rewards balanced preparation.
| Theme | Under SC-400 | Under SC-401 |
|---|---|---|
| Compliance management | In scope | Removed entirely |
| Information protection | In scope | In scope — its own domain at 30–35% |
| Data loss prevention | In scope, the heaviest area | Merged with retention into one domain |
| Retention and lifecycle | Sat under information governance | Now paired with DLP |
| Insider risk | Present | Expanded, and shares the third domain |
| AI data protection | Did not exist | New objective group — DSPM for AI |
| Role name | Information Protection and Compliance Administrator | Information Security Administrator |
What carried over
Most of the information protection core survives, so SC-400 notes are not wasted. Still tested:
- Data classification — sensitive information types, custom types, document fingerprinting, exact data match (EDM), trainable classifiers, and monitoring via Data explorer and Content explorer.
- Sensitivity labels — roles and permissions, labels for items and containers, protection settings and content marking, publishing policies, auto-labelling, applying labels to Teams, Microsoft 365 Groups, Power BI and SharePoint, and applying labels via Defender for Cloud Apps.
- Information protection beyond Microsoft 365 — the Purview Information Protection client and scanner for Windows, file shares and on-premises data, plus Message Encryption and Advanced Message Encryption.
- DLP policy design — policies from requirements, roles and permissions, policy and rule precedence, and file policies in Defender for Cloud Apps.
- Retention — retention labels and policies, publishing and auto-applying labels, policy precedence and Policy lookup, and recovering retained content.
- Insider Risk Management — roles, connectors, Defender for Endpoint integration, policy indicators and templates, alerts and cases.
Our older SC-400 material remains a reasonable foundation for this carried-over core — the information protection guide and the SC-400 complete guide both still describe the underlying Purview features accurately. Use them for the technology, and this brief for the exam scope.
What is genuinely new
Six additions that SC-400 either did not test or did not test in this form.
If you studied SC-400, you have nothing on protecting data used by AI services — the objective did not exist. It is part of a domain worth 30 to 35 percent and it is the area Microsoft is most actively developing. Treat it as new material, not revision.
What is gone
Compliance management. Anything you learned for SC-400 that centred on organisational compliance posture as an end in itself is out of scope.
One nuance worth holding: Compliance Manager has not vanished from the Microsoft world, and related concepts still appear in neighbouring exams. But SC-401's objectives are framed around securing data, not demonstrating compliance. When you meet a topic in old notes, ask which of those two jobs it serves.
A two-week restudy plan
For someone who prepared for SC-400 and is converting. If you are starting fresh, budget six to eight weeks instead.
Two habits help. First, for every Purview capability, be able to say which portal you work in — the Microsoft Purview portal, the Defender portal, or Defender for Cloud Apps. SC-401 crosses all three. Second, prefer policy precedence reasoning over memorisation: both DLP and retention have explicit precedence objectives, and questions tend to give you conflicting policies and ask what actually applies.
Who should take SC-401 now
The rename from Information Protection and Compliance Administrator to Information Security Administrator narrowed who this credential is aimed at. Worth checking yourself against the current audience profile before committing six weeks.
| If you are… | Verdict |
|---|---|
| A Purview or data security administrator | Strong fit. This is now precisely your job description |
| A Microsoft 365 admin taking on data security | Good fit, but expect a real step up from fundamentals-level material |
| In a compliance or audit role | Weaker fit than SC-400 was — the compliance scope was removed |
| Coming from SC-900 | Natural next step, though SC-900 is conceptual and SC-401 is hands-on implementation |
| Focused on identity rather than data | Consider SC-300 instead — different problem, different exam |
Microsoft's audience profile also expects familiarity with all Microsoft 365 services, PowerShell, Microsoft Entra, the Defender portal and Defender for Cloud Apps. PowerShell being named explicitly is worth noticing — this is an implementation exam, and some Purview configuration is more naturally done or verified from the command line.
The audience profile describes working with governance, data and security stakeholders, and participating in incident response. That shows up in the questions: scenarios often specify a business requirement and ask you to translate it into a policy, rather than asking you to recall what a setting does. Practise reading a requirement and naming the control it implies.
When you are ready to test yourself, the SC-401 practice test is written against the current objectives, and the study-time calculator will size a schedule around your available hours.
Frequently Asked Questions
Is SC-400 still available?
No. Microsoft retired the SC-400 exam and the Information Protection and Compliance Administrator certification on 31 May 2025. SC-401 is the replacement path.
What certification does SC-401 lead to?
Microsoft Certified: Information Security Administrator Associate. The role was renamed from Information Protection and Compliance Administrator, reflecting the removal of the compliance scope.
Do I need to retake anything if I already hold SC-400?
A certification you already earned remains on your transcript. SC-401 is the current path for new candidates. If you want the Information Security Administrator credential specifically, you take SC-401.
How much of my SC-400 study material is still useful?
The information protection and DLP material largely carries over, though with new sub-topics. The compliance material is out of scope, and the risk, alerts and AI data protection content is substantially new.
Practise SC-401 With Current Objectives
500–1,000+ SC-401 practice questions written against the current skills-measured document.
SC-401 Practice Test
Practice Before You Book
500–1,000+ practice questions per exam with detailed explanations, across Azure, AWS, GCP, security, and AI certifications.