Why SC-400 matters more in 2026 than it did two years ago

Microsoft renamed and restructured the exam formerly known as “Microsoft Information Protection Administrator” into SC-400 as part of the Purview brand consolidation in 2023. The rename reflected something real: what was once primarily a compliance admin credential became a platform-level skill as Microsoft Purview absorbed the Information Protection, Data Loss Prevention, Insider Risk Management, Records Management, and eDiscovery surfaces under a single unified console. By 2026, Purview governs data across Microsoft 365, Azure, multicloud sources through Purview Data Map, and — critically — Microsoft 365 Copilot outputs.

The AI-data governance angle has materially changed SC-400’s relevance. When Copilot for Microsoft 365 generates a document, emails a summary, or produces a Teams meeting transcript, those outputs inherit sensitivity label inheritance rules defined in Purview. If a user generates a Copilot-assisted document from source material labelled Confidential\All Employees, the output label policy determines whether that output is automatically labelled, whether it can be emailed externally, and whether it is captured by DLP policy. SC-400 now explicitly tests Copilot integration scenarios in the information protection and DLP domains. Organisations deploying Copilot without configured sensitivity label and DLP policies are creating ungoverned AI output at scale — and regulators in financial services, healthcare, and government contracting are catching up. The compliance engineer who can configure those guardrails is in high demand.

GDPR, HIPAA, and US state privacy laws have also continued to tighten enforcement. The 2025 EU AI Act imposed new data-governance obligations on organisations using AI systems in high-risk categories. Microsoft Purview’s compliance manager now includes assessment templates aligned to the AI Act’s Article 10 data-governance requirements. SC-400-certified administrators are the people configuring those assessments, maintaining evidence trails, and operating the remediation workflows — a role that did not formally exist in most organisations three years ago.

Exam format and logistics

SC-400 is administered through Pearson VUE, either at a test centre or via online proctoring. The exam contains approximately 40–60 questions, predominantly multiple-choice with some case studies that present a scenario description followed by a series of questions about the optimal Purview configuration. Total time is 100–120 minutes depending on the number of case studies. The passing score is 700/1000. The exam costs $165 USD globally, with local currency equivalents in most regions. There are no formal prerequisites, though Microsoft recommends familiarity with Microsoft 365 administration and a working knowledge of information protection concepts before attempting.

Exam at a glance

Credential: Microsoft Certified: Information Protection and Compliance Administrator Associate  ·  Questions: 40–60 (MCQ + case studies)  ·  Duration: 100–120 minutes  ·  Passing score: 700/1000  ·  Cost: $165 USD  ·  Prerequisites: None (M365 admin experience recommended)  ·  Renewal: Annual free online assessment  ·  Complements: SC-300, SC-200, AZ-500, MS-102

The exam divides into four domains, with weighting updated in the 2025 objective revision: Implement information protection (35–40%), Implement data loss prevention (25–30%), Implement information governance (25–30%), and Monitor and investigate data and activities (5–10%). The information protection domain received the largest expansion in the 2025 update, adding sensitivity label auto-labelling for Copilot outputs and trainable classifiers based on large language models — the exam’s acknowledgement that Purview’s classification engine has moved well beyond regex-based sensitive information types.

Microsoft provides free preparation content through Microsoft Learn, including the SC-400 learning path, which maps directly to exam objectives. The official practice assessment (free on Microsoft Learn) is a reliable readiness signal — candidates who score 80%+ on the practice assessment consistently pass the live exam. The Microsoft Applied Skills credential for “Secure and govern data using Microsoft Purview” covers overlapping content and is a useful intermediate milestone before sitting SC-400.

Domain 1: Implement information protection (35–40%)

Sensitivity labels and label policies

Sensitivity labels are the foundational control in Purview information protection. The exam tests the full label lifecycle from creation to enforcement.

  • Label taxonomy design: Creating parent and sublabel hierarchies (e.g. Confidential / Recipients Only, Confidential / All Employees). Understanding mandatory labelling policy — requiring users to apply a label before saving or sending — and the default label setting that pre-applies a label to unlabelled content. The exam tests when mandatory labelling is appropriate vs. when it creates operational friction without compliance benefit.
  • Label protections: Sensitivity labels can apply encryption (using Azure Rights Management), content marking (headers, footers, watermarks), and automatic application rules. Encryption settings include restricting decryption to specific users or groups, setting use rights (View, Edit, Print, Forward, Copy, Full Control), and configuring offline access expiry. The exam tests the interaction between label-applied encryption and external sharing — encrypted content sent externally requires the recipient’s organisation to have Azure AD or Microsoft Account access to decrypt.
  • Auto-labelling policies: Server-side auto-labelling scans content at rest in Exchange, SharePoint, and OneDrive and applies labels based on sensitive information type (SIT) matches or trainable classifiers, without user involvement. The exam distinguishes server-side auto-labelling (Purview portal policy, asynchronous) from client-side auto-labelling (recommends or auto-applies labels as users create or edit content in Office apps). Simulation mode — running an auto-label policy in read-only preview before enabling enforcement — is a frequently tested feature.
  • Copilot label inheritance: When Microsoft 365 Copilot generates content referencing labelled source material, Purview can enforce label inheritance policies that require the output to carry at least the highest label present in the referenced sources. The 2025 exam update tests how to configure Copilot label inheritance in the Purview portal and what happens when Copilot references content labelled with encryption — the output inherits the encryption, and users without RMS access to that label cannot open the generated document.
  • Trainable classifiers: Pre-built classifiers (Resume, Source Code, Finance, Healthcare) and custom classifiers trained on sample content. Custom classifier training requires at least 50 positive examples and 50 negative examples. The exam tests the classifier training workflow, the seeded vs. trained content distinction, and when to use a trainable classifier vs. a sensitive information type — classifiers work on semantic content patterns rather than regex patterns, making them appropriate for unstructured content like contracts or HR documents where the sensitive data does not follow a fixed format.

Sensitive information types (SITs)

Sensitive information types are the pattern-matching layer beneath labels and DLP. The exam tests both built-in SIT configuration and custom SIT creation.

  • Built-in SITs: Microsoft Purview includes 300+ built-in sensitive information types covering financial identifiers (credit card numbers, SWIFT codes, IBAN), national identifiers (Social Security Numbers, passport numbers, national ID cards by country), and healthcare data (ICD codes, drug enforcement administration numbers). The exam tests how to identify which built-in SIT covers a specific scenario and how to adjust the confidence level threshold (low/medium/high confidence instances) in DLP and auto-label policies.
  • Custom SITs: Creating custom sensitive information types using keyword lists, keyword dictionaries (for large term sets loaded from a file), regular expressions, and supporting element patterns. The exam tests the difference between primary elements (the core pattern that must match) and supporting elements (corroborating keywords or proximity patterns that increase confidence). Exact data match (EDM) SITs allow pattern matching against a custom dataset — a list of employee IDs, customer account numbers, or other organisation-specific values — and the exam tests the EDM upload and schema-mapping workflow.

Domain 2: Implement data loss prevention (25–30%)

DLP policies across M365 and endpoints

Data loss prevention policies prevent the exfiltration of sensitive content through detection rules and enforcement actions across Exchange, SharePoint, OneDrive, Teams, and endpoint devices.

  • Policy structure: DLP policies contain rules; each rule combines conditions (sensitive information types, sensitivity labels, document properties, recipient domains) with actions (block, allow with override, notify user, generate alert, restrict access) and exception conditions. The exam tests how conditions combine within a rule (all conditions must match, or any condition) vs. how rules combine within a policy (first matching rule applies, or all matching rules apply based on policy priority).
  • Enforcement modes: Test mode runs policies in simulation with no user-visible impact, generating alerts but taking no action — used to assess false-positive rate before enabling enforcement. Test mode with policy tips shows users a notification but does not block the action. Enforcement mode (Turn it on right away) blocks or restricts the action. The exam tests the appropriate rollout sequence and how to interpret test-mode activity reports to calibrate rule thresholds before full enforcement.
  • Endpoint DLP: Extends DLP coverage to Windows 10/11 devices onboarded to Microsoft Defender for Endpoint. Endpoint DLP can detect sensitive content in local file operations, USB copy, printing, clipboard, screensharing, and browser uploads (Chrome and Edge with the compliance extension). The exam tests the onboarding prerequisites (Defender for Endpoint MDE integration, the Microsoft Purview compliance extension for browsers), the sensitive activities that endpoint DLP can restrict, and how endpoint DLP policy precedence interacts with standard M365 DLP policies when the same content triggers both.
  • Microsoft Teams DLP: Protects messages sent in Teams channels and chats. Sensitive content shared in Teams messages (credit card numbers in a chat, for example) triggers the DLP rule. The exam tests the Teams-specific limitation that DLP policies only apply to messages, not to files shared in Teams (file sharing is covered by SharePoint/OneDrive DLP rules applied to the Teams-connected SharePoint site).
  • Alerts and investigation: DLP policy matches generate alerts viewable in the Purview compliance portal under DLP → Alerts. The exam tests how to configure alert volume thresholds (single event vs. aggregate threshold over a time window), how to triage alerts by severity and location, and how Activity Explorer and Content Explorer provide complementary views of DLP-matched content without requiring the administrator to open the underlying documents.

Domain 3: Implement information governance (25–30%)

Retention policies and retention labels

Information governance in Purview manages content lifetime — how long content is kept, when it is deleted, and how certain content is promoted to records requiring formal disposition review.

  • Retention policies vs. retention labels: Retention policies apply uniformly to a location (an entire mailbox, an entire SharePoint site, all OneDrive accounts). Retention labels apply per item and can trigger based on the date the label was applied, the date content was last modified, or an event (such as an employee termination triggering a 7-year retention on that employee’s HR records). The exam tests which mechanism is appropriate for each governance requirement — retention policies for broad baseline governance, labels for item-level control and record declaration.
  • Records management: Declaring content as a record in Purview locks the item against modification or deletion until the retention period expires. Regulatory records (the highest protection tier) cannot be unlocked even by administrators and require proof of final disposition before deletion. Disposition review routes expired records to a reviewer for a manual deletion decision before Purview permanently removes the content. The exam tests the full records management lifecycle, including multi-stage disposition review chains and the event-based retention that starts the retention clock when a business event is recorded in Purview Events.
  • Adaptive policy scopes: Instead of statically specifying locations (individual mailboxes, specific SharePoint URLs), adaptive scopes use Azure AD attributes (department, country, job title) to dynamically determine which users and sites fall under a policy. When HR employees are moved to a new department, the adaptive scope automatically includes or excludes them from governance policies without requiring a policy update. The exam tests adaptive scope query syntax and the latency behaviour — adaptive scope membership updates within 24 hours of an AD attribute change, not immediately.

eDiscovery and Content Search

eDiscovery capabilities in Purview support legal hold, content collection, review, and export for litigation and regulatory investigation scenarios.

  • Content Search vs. eDiscovery Standard vs. eDiscovery Premium: Content Search is a standalone search across Exchange, SharePoint, Teams, and Viva Engage without case management. eDiscovery Standard adds case management and legal hold. eDiscovery Premium (formerly Advanced eDiscovery) adds custodian management, non-custodial data sources, machine learning-assisted review sets (near-duplicate detection, email threading, relevance scoring), and export in Relativity-compatible load file format. The exam tests which tier is appropriate for a described scenario and the licensing requirements for each tier (E3 for Standard, E5 or the Compliance add-on for Premium).
  • Legal holds: Preserving content under legal hold prevents users from permanently deleting items even after the retention policy has expired or the item has been manually deleted. The Recoverable Items folder holds preserved content transparently. The exam tests how holds interact with retention policies when they conflict (the most restrictive policy applies — content is preserved by the hold even if the retention policy would otherwise allow deletion) and how custodian holds differ from content location holds.

Domain 4: Monitor and investigate data activities (5–10%)

The monitoring domain tests the Purview audit and activity reporting surfaces. Audit (Standard) retains audit log entries for 90 days and covers Exchange, SharePoint, OneDrive, Azure AD, and Teams. Audit (Premium) requires E5 licensing and extends retention to 10 years, adds high-value security events (MailItemsAccessed, Send, SearchQueryInitiatedExchange), and enables bandwidth throttling exemptions for high-volume retrieval. The exam tests how to search the audit log for specific user activity, how to export results, and how to run compliance searches programmatically via PowerShell (Search-UnifiedAuditLog). Activity Explorer provides a timeline view of labelling and DLP activity without requiring audit log searches — it is the preferred surface for compliance officers who need to see label changes and DLP matches across users without navigating raw audit records.

The exam does not test whether you can memorise Purview portal navigation. It tests whether you can reason through a compliance scenario — a multinational retail company needs to apply a five-year retention on EU customer orders without applying that retention globally — and identify which combination of adaptive scopes, retention labels, and event-based retention achieves the requirement. Scenario reasoning is the skill the exam measures.

SC-400 in the Microsoft security certification stack

Where SC-400 fits

  • SC-900 (Security Fundamentals): Entry-level concepts. SC-400 assumes you understand Purview exists and what it broadly does. SC-900 is useful for non-technical stakeholders; it is not a prerequisite or study tool for SC-400 beyond filling conceptual gaps.
  • SC-300 (Identity and Access Administrator): Covers Microsoft Entra ID, Conditional Access, Privileged Identity Management, and lifecycle workflows. SC-300 and SC-400 are natural complements — SC-300 governs who can access resources, SC-400 governs what happens to the data those users touch. Organisations deploying a zero-trust architecture typically need both credential profiles on the same team.
  • SC-200 (Security Operations Analyst): Covers Microsoft Sentinel, Defender for Cloud, and the M365 Defender XDR suite. SC-200 deals with threat detection and incident response; SC-400 deals with data governance and compliance. The overlap is Defender for Endpoint (shared in endpoint DLP context) and Purview audit logs (useful in both security investigations and compliance reviews).
  • AZ-500 (Azure Security Engineer): Covers Azure Key Vault, RBAC, Microsoft Defender for Cloud, network security, and Azure AD governance. AZ-500 and SC-400 share the Azure Rights Management and Azure AD-based sensitivity label encryption infrastructure. Engineers who hold both credentials can govern data across M365 and Azure end-to-end.
  • MS-102 (Microsoft 365 Administrator Expert): The Expert-tier M365 admin credential. SC-400 candidates who already hold MS-102 typically study only 4–6 weeks for SC-400, having covered the Purview portal basics in MS-102 prep. SC-400 goes substantially deeper into the individual Purview surfaces than MS-102 requires.

Salary context for SC-400 holders in 2026

Compliance and information governance roles have moved from cost-centre overhead to strategic hires as data regulation tightened and AI-generated data proliferated. SC-400 holders work across three overlapping job families: compliance engineering (configuring and maintaining Purview policies), GRC (governance, risk, and compliance) specialisation, and Microsoft 365 security administration with a compliance remit.

The certification’s salary impact is most pronounced in organisations actively deploying Copilot for Microsoft 365 — where SC-400-certified administrators are required to configure the Purview guardrails before Copilot is enabled for regulated-data users — and in organisations facing active regulatory scrutiny around AI data governance. In both contexts, SC-400 skills are blocking dependencies, not nice-to-haves, making certified candidates difficult to hire and well-compensated.

Who should pursue SC-400 in 2026

Microsoft 365 administrators managing regulated-industry tenants. If your organisation operates under HIPAA, GDPR, FINRA, SEC 17a-4, CMMC, or FedRAMP, you are almost certainly already using some Purview features — but not necessarily configured correctly. SC-400 provides the framework for auditing what is configured vs. what is required and the vocabulary to discuss compliance posture with internal compliance teams and external auditors. Study time is typically six to eight weeks for experienced M365 administrators.

Compliance officers transitioning from policy to technical implementation. Purview’s unified console and the shift from email-based evidence collection to automated retention and eDiscovery workflows have created a new hybrid role — the technical compliance specialist who can both read a regulatory requirement and configure a Purview policy to address it. SC-400 is the credentialing path for that role. Compliance officers without deep technical background typically take eight to twelve weeks and benefit from hands-on lab time in a Microsoft 365 E5 developer tenant (available free through the Microsoft Developer Program).

Security engineers adding data governance skills to an existing security stack. SC-400 holders who also hold AZ-500 or SC-200 cover the full arc from access governance (who can reach data) through content governance (what is done with data) — the combination required for a coherent zero-trust posture. For security engineers in organisations deploying Copilot, the Purview AI governance additions to SC-400 are immediately operationally relevant: configuring sensitivity label inheritance, testing DLP policies against Copilot prompt-and-response pairs, and setting up Copilot interaction capture for audit trail requirements.

Recommended study path

Start with the free Microsoft Learn SC-400 learning path, which covers all four domains in sequence. Supplement with hands-on labs in a Microsoft 365 E5 developer tenant — create a sensitivity label hierarchy with at least three parent labels and sublabels, enable auto-labelling for a credit card SIT, create a DLP policy in test mode for SharePoint and Exchange, observe the Activity Explorer results, then promote to enforcement. For information governance, create a retention label, publish it, apply it to test content, and run through the disposition review workflow. The case study questions (common in domain 3) reward scenario-reasoning practice more than memorisation — work through the Microsoft Learn scenario-based exercises before attempting mock exams. Budget six to eight weeks part-time for M365 administrators familiar with the Purview portal; eight to twelve weeks for candidates new to the compliance console.

Practice Microsoft SC-400 information protection concepts with free scenario-based questions on CertQuests.

Practice SC-400 Questions →