Can I still take SC-400?

No. SC-400, its renewal assessment and the Information Protection and Compliance Administrator Associate certification retired on 31 May 2025. SC-401 is the current exam for this work, and it earns Microsoft Certified: Information Security Administrator Associate. Study material written for SC-400 will miss the AI data protection and Adaptive Protection topics.

What changed in the SC-401 skills on 28 October 2026?

The study guide calls it a minor change to the sensitivity labels section, with no change to the audience profile or the three area weightings. Each area still carries 30 to 35% of the exam. Check the study guide's change log before your exam date, because Microsoft updates these outlines regularly.

How long does SC-401 preparation take?

For someone already administering Microsoft 365, about six weeks of evening study with weekend labs is realistic. The key is lab time: build real sensitivity labels, DLP policies, retention labels and an insider risk policy in a test tenant, rather than only reading about them. Allow longer if Microsoft 365 administration is new to you.

SC-401 Exam Guide for India: Information Security Administrator

Q: Do I need SC-900 before SC-401?

No. Microsoft lists no prerequisite certification for SC-401. The audience profile expects familiarity with Microsoft 365 services, PowerShell, Microsoft Entra, the Defender portal and Defender for Cloud Apps. If those are new to you, SC-900 is a quick way to learn the vocabulary first, but it is optional.

Q: Can Microsoft Purview detect Aadhaar and PAN numbers?

Yes. Purview includes built-in sensitive information types for India Unique Identification (Aadhaar) Number, India Permanent Account Number (PAN), India GST Number, India Voter Id Card and India Driver's License Number. You can use them in DLP policies, auto-labelling and retention, and combine them with custom types for your own identifiers.

SC-401, Administering Information Security in Microsoft 365, earns Microsoft Certified: Information Security Administrator Associate. It replaced SC-400, whose certification and exam retired on 31 May 2025. The exam tests Microsoft Purview in three equal areas: information protection, data loss prevention and retention, and managing risks, alerts and activities, which now includes protecting data used by AI services such as Copilot. You need 700 to pass.

At a glance

Exam: SC-401, Administering Information Security in Microsoft 365
Certification: Information Security Administrator Associate, intermediate level
Replaced: SC-400 and Information Protection and Compliance Administrator Associate, retired 31 May 2025
Skills measured: the study guide shows the version effective 28 October 2026, a minor update to the sensitivity labels section
Weighting: three areas, each 30 to 35%
Exam time: 100 minutes for role-based exams, or 120 if the exam contains labs
Practice: free official practice assessment, linked from the study guide
Renewal: free online assessment every year

From SC-400 to SC-401: what changed

SC-400 was a broad information protection and compliance exam. Its certification covered classification, DLP, sensitivity labels, retention, records management, privacy, risk and compliance. SC-401 narrows the role to information security and adds newer controls:

Protecting data used by AI services, including Data Security Posture Management (DSPM) for AI.
Adaptive Protection, which links insider risk levels to DLP policies so that riskier users get stricter controls automatically.
Endpoint DLP in depth, including just-in-time protection and advanced device rules.
Microsoft Defender for Cloud Apps for labelling and file policies, and Defender XDR for responding to Purview alerts.

If you hold the old certification, note that it cannot be renewed; SC-401 is the current exam. One more planning point: Information Security Administrator Associate is one of the associate certifications that qualify you for Microsoft 365 Administrator Expert, but that expert certification and its MS-102 exam retire on 30 November 2026, according to the Microsoft 365 Administrator Expert page. Do not plan SC-401 as a stepping stone to it unless you can finish MS-102 before that date.

The three skill areas and what to practise

The SC-401 study guide expects you to be familiar with all Microsoft 365 services, PowerShell, Microsoft Entra, the Defender portal and Defender for Cloud Apps. Here is how to turn each area into lab work.

Implement information protection (30 to 35%)

Data classification (built-in and custom sensitive information types, document fingerprinting, exact data match, trainable classifiers, OCR), sensitivity labels for files, emails, containers and Power BI items, auto-labelling, the Purview Information Protection client and scanner, and Message Encryption.

This is where Indian learners have an advantage, because Purview ships with India-specific sensitive information types: India Unique Identification (Aadhaar) Number, India Permanent Account Number (PAN), India GST Number, India Voter Id Card and India Driver's License Number. Microsoft's definition of the Aadhaar type checks a 12-digit pattern, a checksum and nearby keywords, which include आधार as well as "aadhaar" and "uid".

Practise: create a "Confidential: Customer KYC" label, then an auto-labelling policy that applies it when a file contains Aadhaar or PAN numbers. Use synthetic test data only, never real customer records. Because the Aadhaar type validates a checksum, random 12-digit numbers often will not match at high confidence, which is a useful lesson in how confidence levels and keywords work.

Implement data loss prevention and retention (30 to 35%)

Designing DLP policies from requirements, roles, rule precedence, Adaptive Protection, Defender for Cloud Apps file policies, Endpoint DLP (device requirements, advanced rules, just-in-time protection, monitoring), and retention: labels, label policies, adaptive scopes, policy lookup, retention policies and recovering retained content.

Build one DLP policy in the portal, then repeat it in Security and Compliance PowerShell, because the exam profile expects PowerShell. Start in test mode so nothing is blocked while you check matches:

Connect-IPPSSession

New-DlpCompliancePolicy -Name "India ID numbers" -ExchangeLocation All `
  -SharePointLocation All -OneDriveLocation All -Mode TestWithNotifications

$ids = @(
  @{Name = "India Unique Identification (Aadhaar) Number"},
  @{Name = "India Permanent Account Number (PAN)"}
)

New-DlpComplianceRule -Name "Aadhaar or PAN shared outside" -Policy "India ID numbers" `
  -ContentContainsSensitiveInformation $ids -AccessScope NotInOrganization `
  -BlockAccess $true -NotifyUser Owner

Then create a retention label for "KYC records" with a disposition review, and use Policy lookup to see which retention policies apply to one mailbox.

Manage risks, alerts, and activities (30 to 35%)

Insider Risk Management (roles, connectors, Defender for Endpoint integration, indicators, templates, forensic evidence, risk levels for Adaptive Protection, alerts, cases and notice templates), Audit (Premium licences, investigations, audit retention), Activity explorer, responding to DLP alerts in Purview and Purview alerts in Defender XDR, Defender for Cloud Apps alerts, eDiscovery searches, and protecting data used by AI services.

Practise: create a data leaks policy from an Insider Risk Management template, generate matching activity with test files, and follow the alert to a case once it appears; insider risk alerts are not instant, so plan this over two sessions. Then search the audit log for the same activity and compare what each tool shows you.

Protecting data used by AI: the newest part

The AI objectives ask you to implement Purview and Microsoft 365 controls that protect content where AI services are used, set up the prerequisites, roles and policies for DSPM for AI, and monitor its activity. In plain words: before Copilot or another AI app can surface a salary sheet to the wrong person, you find where sensitive data is overshared, label it, and apply policies that limit what AI tools can use.

This is the question Indian companies ask first when they roll out Microsoft 365 Copilot. Our Copilot rollout guide covers the business side; SC-401 is the technical side of the same job.

The DPDP Act: where SC-401 skills fit

This section is general information, not legal advice. India's Digital Personal Data Protection Act, 2023 now has its Rules, notified on 14 November 2025 with an eighteen-month period for phased compliance, according to the Government's PIB explainer. The same explainer says organisations must inform affected individuals of a personal data breach without delay, and that failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore.

Purview does not make an organisation compliant by itself, but SC-401 skills are the practical tools behind several obligations:

Obligation in practice	SC-401 skill
Know where personal data is	Sensitive information types, Content explorer
Stop it leaving inappropriately	DLP across email, files, endpoints and cloud apps
Keep it only as long as needed	Retention labels and disposition
Investigate what happened	Audit, Activity explorer, eDiscovery
Reduce insider misuse	Insider Risk Management, Adaptive Protection

Our guide to the DPDP Act and AI tools for Indian companies goes deeper on the law.

Getting a lab tenant

Many SC-401 features need advanced licensing, such as Microsoft 365 E5 or compliance add-ons; the study guide itself includes assigning Audit (Premium) licences. Your options:

Microsoft 365 Developer Program: if you qualify, for example through a Visual Studio Professional or Enterprise subscription or an eligible partner employer, the E5 developer sandbox includes 25 user licences and lasts up to 90 days, renewing with active development use.
A non-production tenant at work: ask your Microsoft 365 team, as some organisations keep one for testing policies.
A course with lab access, if neither is available to you.

Never test DLP or insider risk policies on a production tenant without approval. A test-mode policy with notifications still shows policy tips and sends emails to real users.

A six-week plan for Microsoft 365 admins

Week	Focus	Output
1	Classification: SITs, EDM, fingerprinting, classifiers	Custom SIT for your organisation's employee ID format
2	Sensitivity labels and auto-labelling	KYC label applied automatically in SharePoint
3	DLP, including PowerShell and Endpoint DLP	India ID policy in test mode, then enforced
4	Retention and disposition	Retention label with disposition review
5	Insider risk, Adaptive Protection, audit, eDiscovery	Alert followed through to a case
6	AI data protection, practice assessment	DSPM for AI configured; two timed practice runs

How CertTulen Academy can help

CertTulen Academy, a Microsoft Training Services Partner, runs the SC-401 Information Security Administrator course as live, MCT-led online training with hands-on Purview labs. Professional certification courses include an exam voucher, mock practice tests and lab access; the course page lists details and INR pricing. New to security? Start with SC-900. Teams can book a private corporate cohort. Message us on WhatsApp at +91 93618 83583 or use our contact page.