Am I Ready for SC-401? Exam Readiness Checklist (2026)
Tick what you can do today, without notes. The board scores you against the Microsoft outline and says GO, HOLD or NO-GO before you spend US$165 on a booking.
- Not publishedQuestions
- 100 minTime
- 700 / 1000Pass mark
- US$165Fee
- Pearson VUEDelivery
Table of Contents
SC-401 replaced SC-400 in 2025 and earns Microsoft Certified: Information Security Administrator Associate. It is for the administrator who owns Microsoft Purview day to day: sensitive info types and classifiers, sensitivity and retention labels, DLP across Microsoft 365 and endpoints, Insider Risk Management, audit, and the newer controls that protect data used by AI services, including DSPM for AI.
Ready for SC-401 is a practical bar. The three domains are weighted almost evenly, so a strong area cannot hide a weak one. You should be able to build a DLP policy, predict which retention setting wins, and walk an insider-risk alert to a case without hunting through the portal. If you have only read about Purview and never configured it, spend a couple of weeks in a trial tenant with the E5 compliance features before you book. The checklist below is weighted by the official outline, so trust the score more than the box count.
How to use this checklist
Tick only what you can do today, without notes. Each tick is weighted by its domain's share of the official outline, so the score follows the exam, not the number of boxes. A heavy domain (15%+ of the weight) at NO-GO holds the verdict even when the total looks fine. Your ticks are saved in this browser only.
The SC-401 readiness checklist
18 items across 3 domains, each one a thing the exam expects you to do rather than recognise.
Your go / no-go board
One lamp per domain, one verdict overall. Amber and red rows are your study plan for the next week or two.
Check your ticks under exam conditions
A tick is a claim; a timed set of questions is the evidence. ExamCert AI has exam-style SC-401 questions with an explanation for every option. Do a mixed set and see whether the domains you ticked hold up.
Practise on ExamCert AISC-401 practice questionsRed flags: don't book yet if...
Any one of these on the SC-401 is a better predictor of a fail than a low tick count.
You have never configured Purview in a real tenant
SC-401 questions describe portal settings, policy options and the outcome when policies overlap. Reading alone rarely tells you which setting lives in a label and which in a policy, and Microsoft says the exam may include interactive components.
Fix:In a trial tenant, build two sensitivity labels, one DLP policy, one retention label policy and one insider risk policy end to end.
Retention precedence still feels like guesswork
Working out which retention or deletion setting wins when a label and several policies apply is a classic trap, and Policy lookup is now a named objective.
Fix:Learn Microsoft's principles of retention (retention beats deletion, longest retention wins, explicit beats implicit, shortest deletion wins) and solve three conflicting scenarios.
You are treating the AI objectives as optional
Protecting data used by AI services, including DSPM for AI, is a full subsection of a domain worth 30-35%. Skipping it gives away marks that are easy once you have read the docs.
Fix:Read the DSPM for AI documentation, note its prerequisites such as auditing and device onboarding, and what each of its policies does.
Insider Risk Management is a blank
Insider Risk Management has more listed objectives than any other area of the SC-401 outline, from connectors to notice templates, and it feeds Adaptive Protection in the DLP domain.
Fix:Create one data-theft policy for departing users in a trial tenant, with an HR connector if you can, and follow an alert through to a case.
The free Practice Assessment is your only practice
Microsoft says its practice questions show style and difficulty but are not the exam, and may not reflect case studies, interactive items or exam length.
Fix:Pair it with hands-on builds and the exam sandbox, and treat the practice score as one readiness signal among several.
The numbers that say you're ready
Rules of thumb, not official thresholds: Microsoft does not publish a readiness score. Hit all four before you pay for a booking.
Rule of thumb, not an official cut score. Two strong attempts a week apart suggest the knowledge has stuck rather than been memorised from one sitting.
Rule of thumb. If you can create a sensitivity label, a DLP policy, a retention label policy and an insider risk policy without a tutorial, configuration questions read like familiar screens.
Rule of thumb. Write five scenarios mixing retention labels, retention policies and DLP rules, solve each without notes, then check against Policy lookup or the docs.
Rule of thumb. With every domain at 30-35%, a strong DLP score cannot make up for a weak risks-and-alerts score, so aim for an even practice profile.
Booking and ID checklist
The logistics that trip people up are specific to the SC-401 and its delivery provider. Work through them in order.
Set up your certification profile
Sign in to Microsoft Learn with a personal Microsoft account; Microsoft warns that records on a work or school account can be lost if you leave. Make the profile name match your government ID exactly.
Check the language and accommodations
SC-401 is offered in English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified) and Spanish. If yours is not listed, request an extra 30 minutes; any accommodation must be approved before you book.
Book through Pearson VUE
Use Schedule exam on the certification page and choose a test centre or online (OnVUE). The US price is US$165; other countries differ and tax may apply. Apply any voucher or Exam Replay offer at checkout.
Check which outline applies
If your date falls after the late-October 2026 refresh, study the revised sensitivity-label objectives in the current study guide. Domains and weights are unchanged.
Run the OnVUE system test
For online delivery, run Pearson VUE's system test on the same computer, network and room you will use. A personal machine with admin rights avoids corporate VPNs and security agents that block the secure browser.
Last chance to move the slot
Reschedule or cancel from your Learn profile at least 24 hours ahead. Later than that, the fee or voucher is forfeited.
Check in on time
Online, check in from 30 minutes before to 15 minutes after your start via Learn profile, Certifications, Go to the exam. At a centre, arrive early with ID whose name matches your profile.
Exam-week countdown: T-7 to T-0
Sit Microsoft's free SC-401 Practice Assessment timed, sort every miss into the three domains, and rebuild one weak policy type in your trial tenant.
Run your retention and DLP precedence drill without notes, then reread the Insider Risk Management and DSPM for AI objectives line by line.
No new topics. Rerun the OnVUE system test or check the route to the centre, confirm your ID name matches your profile, clear the desk and sleep.
Read each scenario for the deciding detail first, such as location, label scope or user risk level. Flag anything slow, keep about 10 minutes for review, and finish open questions before any break.
Test-day rules
✓ Allowed / expected
- One current government-issued photo ID whose name exactly matches your Microsoft certification profile
- The built-in Microsoft Learn pane on role-based exams, with the exam timer still running
- Unscheduled breaks through the Take a break button; the clock keeps running and 5 minutes are built into the exam time
- Pearson VUE's digital whiteboard online, or the note board provided at a test centre
- A drink in a clear, spill-proof container during an online exam
✕ Not allowed
- Phones, watches, notes, pens, paper or extra monitors within reach during an online exam
- Anyone else in the room, or help from another person or any AI tool
- Going back to questions you viewed before taking a break
- Copying, recording or sharing exam content; Microsoft can decertify and ban candidates
- Eating, smoking or chewing gum without an approved accommodation
After you pass
Score in minutes
Most Microsoft exams show pass or fail and a score report within minutes (about 30 minutes when labs are included). The report has a bar chart by skill area and reaches your Learn profile within 24 hours.
Credential in your Learn profile
Information Security Administrator Associate appears under Credentials in your Microsoft Learn profile with an Online Verifiable tag, ready to share on LinkedIn, by link or as a printed certificate.
Free renewal every year
The certification lasts 12 months. In the six months before it expires, pass a free, unproctored, open-book renewal assessment on Microsoft Learn; you can retake it as often as needed before the expiry date.
The SC-401 at a glance
| Item | Detail |
|---|---|
| Questions | Not published for SC-401; Microsoft says most of its exams have 40-60 questions |
| Time | 100 minutes of exam time (stated on the certification page); seat time is about 20 minutes longer. The exam may include interactive components |
| Passing score | 700 on a scaled 1-1,000 score (not the same as 70% correct) |
| Fee | US$165 in the United States; price varies by country or region and excludes tax |
| Delivery | Pearson VUE test centre or online proctored (OnVUE) |
| Retakes | 24 hours after a first fail, then 14 days between later attempts; no more than 5 attempts in 12 months; each retake is paid |
| Results | Pass/fail and a score report within minutes of finishing (about 30 minutes if labs are included); in your Learn profile within 24 hours |
| Validity and renewal | 12 months; renew free with an unproctored, open-book Microsoft Learn assessment in the 6 months before expiry |
Turn the amber rows green
Work SC-401 questions by domain, starting with whatever the board marked HOLD or NO-GO, then tick again.
Practise on ExamCert AISC-401 practice questionsFAQ
Is SC-401 the replacement for SC-400?
Yes. SC-401 replaced SC-400 in 2025 and leads to Microsoft Certified: Information Security Administrator Associate. It covers information protection, DLP and retention, and risks, alerts and activities, each worth 30-35%. Older SC-400 material can still help with labels and DLP basics, but check every topic against the current SC-401 study guide, which includes protecting data used by AI services and DSPM for AI.
How long is the SC-401 exam and how many questions are there?
Microsoft's certification page gives 100 minutes to complete the exam, with seat time about 20 minutes longer for instructions and the agreement. Microsoft does not publish a question count for SC-401; its general guidance says most exams have 40 to 60 questions. The page also says the exam may include interactive components, so expect more than plain multiple choice.
Which SC-401 domain should I study first?
All three domains carry 30-35%, so start with whichever is weakest on Microsoft's free Practice Assessment. If they look similar, begin with risks, alerts and activities: Insider Risk Management has the longest objective list in the outline, and it connects to Adaptive Protection in the DLP domain, so learning it first makes the DLP material easier.
Can I use Microsoft Learn during the SC-401 exam?
Yes. Associate and expert role-based exams include a split-screen Microsoft Learn pane covering learn.microsoft.com, except Q&A, practice assessments and your profile. No extra time is added and the timer keeps running, so use it to confirm one detail, such as a DLP location or audit retention option, not to learn a topic during the exam.
Does the SC-401 certification expire?
Yes, after 12 months. Renewal is free: in the six months before expiry, pass an unproctored, open-book renewal assessment on Microsoft Learn that focuses on recent product changes. You can retake it as often as you need until the expiry date, and a pass extends the certification by one year from that date.
Sources
Figures on this page come from Microsoft and the other primary sources below:
- Microsoft Certified: Information Security Administrator Associate (Exam SC-401)
- Study guide for Exam SC-401
- Exam duration and exam experience
- Exam scoring and score reports
- Exam and Applied Skills retake policies
- Reschedule and cancellation policies
- About online exams with Pearson VUE
- Microsoft Certification renewal
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with Microsoft before you book.