Microsoft SC-400 Is Retired: Move to SC-401

SC-400, Microsoft Information Protection and Compliance Administrator, retired on May 31, 2025. Microsoft replaced the old Information Protection and Compliance Administrator Associate path with the current Information Security Administrator Associate certification and SC-401, Administering Information Security in Microsoft 365.

The replacement is broader than a new exam code. The retired SC-400 focused heavily on Microsoft Purview information protection, data loss prevention, retention, records management, and compliance. SC-401 preserves those foundations but frames them around a clearer information-security role that also includes insider risk, alerts, activities, AI data protection, and incident participation.

Professionals who already studied SC-400 therefore have a strong base. The transition is mainly about updating terminology, learning the current Microsoft Purview experience, and expanding from compliance administration toward active information-security operations.

SC-401 is the current information-security certification

The Information Security Administrator Associate credential is the current Microsoft role for protecting sensitive data in Microsoft 365 by using Microsoft Purview and related services.

The exam covers three large areas: information protection, data loss prevention and retention, and management of risks, alerts, and activities.

Microsoft has announced another English-language update for October 28, 2026. Candidates testing after that date should use the revised skills outline rather than relying only on the July version.

Data classification remains the starting point

You cannot protect information consistently if you do not know what the information is. SC-401 expects candidates to identify sensitive-information requirements and implement classification methods in Microsoft Purview.

Built-in sensitive information types can recognize common regulated data. Custom sensitive information types, exact data match, document fingerprinting, trainable classifiers, and optical character recognition can extend detection to organization-specific content.

The general information-classification framework is useful because technology only works well when the organization has clear categories and handling expectations.

Sensitivity labels translate classification into handling controls

Sensitivity labels can identify content as public, internal, confidential, highly confidential, or another organization-defined category and then apply protection or usage controls.

Labels can influence encryption, markings, access restrictions, container settings, meetings, sites, groups, and other Microsoft 365 experiences depending on configuration.

The administrator’s job is not to create as many labels as possible. A small, understandable taxonomy that employees can apply correctly is usually more effective than a complicated hierarchy nobody remembers.

Automatic and recommended labeling require careful testing

Microsoft Purview can apply or recommend labels based on sensitive information, classifiers, or other detection logic.

Automation reduces reliance on users recognizing every sensitive record manually, but false positives can create friction or over-protect ordinary work. False negatives can leave important content exposed.

Administrators should test policies against representative data before broad rollout and monitor label activity after deployment.

Data loss prevention protects information in use

DLP policies can detect sensitive information and apply controls when users attempt to share, copy, upload, or otherwise handle data in ways that violate policy.

Microsoft 365 DLP can apply across locations such as Exchange, SharePoint, OneDrive, Teams, endpoints, and supported applications. The exact policy behavior depends on the workload and licensing.

Strong DLP design begins with a specific risk: for example, preventing payment-card data from leaving approved channels or warning users before sharing highly confidential documents externally.

DLP policy tips should help users make better decisions

Blocking every questionable action can make users work around security. Policy tips and justified overrides can provide a safer balance in lower-risk scenarios.

High-risk data may require hard blocking. Lower-risk situations may be better served by a warning, business justification, or user education.

The administrator should decide which actions are prohibited, which require explanation, and which merely need visibility.

Endpoint DLP extends protection beyond cloud collaboration

Sensitive information can leave Microsoft 365 through local devices, removable media, browsers, printing, clipboard activity, or unsupported applications.

Endpoint DLP helps apply data-protection controls on managed devices so policy follows information beyond the document library or mailbox.

This is an important information-security skill because many real data-loss events involve legitimate users moving information through ordinary endpoint actions rather than an external attacker breaking into a server.

Retention is about lifecycle, not only storage duration

Retention policies and labels help organizations keep information for required periods and dispose of it when it no longer needs to be retained.

Business, legal, regulatory, and privacy requirements can all influence retention. Keeping everything forever can be as problematic as deleting information too early.

SC-401 candidates should understand the difference between retaining content, deleting content, record management, and the rules that determine what happens when policies overlap.

Records management adds stronger lifecycle controls

Some information must be treated as a formal record because it provides evidence of a business activity, legal decision, transaction, or regulated process.

Record labels can restrict changes and support disposal review, event-based retention, and other controlled lifecycle behavior.

The strongest design connects records technology to an actual records schedule rather than asking administrators to invent retention periods from technical assumptions.

Insider risk is part of the modern information-security role

SC-401 expands beyond the old compliance-only framing by emphasizing risk signals and activities related to people who already have legitimate access.

Insider risk can involve intentional theft, negligent handling, policy violations, or unusual activity. Microsoft Purview Insider Risk Management combines signals and policies to help identify patterns that warrant investigation.

These programs require privacy and governance because employee monitoring itself can create legal and ethical concerns. Security teams should involve HR, legal, privacy, and compliance stakeholders in policy design.

AI makes information protection more urgent

Data readiness for AI should be treated as an information-security project. Before broad AI deployment, organizations should review overshared sites, stale permissions, unmanaged sensitive content, retention obligations, and whether existing labels reflect how information is actually used. An assistant does not create the underlying permission problem, but it can make that problem visible at much greater speed and scale.

This also changes incident investigation. Administrators may need to determine which information an AI service accessed, whether the requesting user was authorized to see it, and whether the activity represents expected productivity or risky data movement. Classification and auditing therefore become operational security controls, not only compliance documentation.

Modern AI assistants can summarize, search, and reason over large bodies of enterprise data. That can improve productivity while also making excessive permissions easier to exploit.

If a user can technically access thousands of overshared documents, an AI experience may surface sensitive information more efficiently than the user could find manually.

SC-401 therefore treats protecting data used by AI services as part of information security. Classification, permissions, DLP, retention, and data posture now directly affect AI risk.

Alerts and activities connect policy to response

Operational ownership matters here. A policy can generate technically correct alerts and still fail in practice if nobody knows who reviews them, how quickly they must be handled, or when an event should be escalated to security operations, legal, privacy, or human resources. Administrators should define severity, triage expectations, evidence handling, and closure criteria so information-protection controls produce an actionable response rather than an unattended queue.

Information-security administrators need to investigate alerts and review activity rather than only configure policies.

A DLP alert, unusual download pattern, insider-risk event, or policy match may require context before action. The administrator should determine what happened, which information was involved, who performed the activity, and whether escalation is required.

This incident-participation role is one of the clearest differences between a narrow compliance administrator and the current information-security administrator.

Microsoft Defender for Cloud Apps adds SaaS visibility

SC-401 expects familiarity with Microsoft Defender for Cloud Apps because sensitive information often moves through cloud applications beyond core Microsoft 365 workloads.

Conditional access app control, session policies, app discovery, and governance can complement Purview information controls in supported scenarios.

The architecture should keep data protection consistent as information moves between collaboration services, endpoints, browsers, and SaaS applications.

What to keep from an SC-400 study plan

Keep sensitive information types, sensitivity labels, DLP, retention, records management, data classification, Microsoft Purview fundamentals, and compliance concepts.

Discard any advice that presents SC-400 or Information Protection and Compliance Administrator Associate as an active certification.

Add current SC-401 topics around information-security alerts, activities, insider risk, AI data protection, Defender for Cloud Apps, and the modern Microsoft Purview administration experience.

A practical SC-400 to SC-401 transition lab

Create a small data-classification model with two or three sensitivity levels. Configure a sensitive-information type, sensitivity label, and a DLP policy for one realistic data-loss scenario.

Add a retention rule, test policy tips, and review the administrative activity and alert experience. If your environment supports it, include endpoint DLP or an insider-risk scenario.

Finally, consider an AI use case and ask whether the underlying permissions, labels, and DLP controls would still protect the information when users access it through an assistant rather than directly through SharePoint or Teams.

SC-401 reframes compliance controls as active information security

The move from SC-400 to SC-401 did not invalidate the old Purview skills. It changed the role around them.

Modern information-security administrators need to know what sensitive data exists, how it should be handled, how long it should live, which user activities create risk, and how AI changes the way information is discovered and used.

Prepare for SC-401 by connecting classification, protection, DLP, retention, risk, alerts, and response into one information-security lifecycle rather than studying each Microsoft Purview feature in isolation.