SC-401 Microsoft Information Security Administrator Course

The Microsoft Certified: Information Security Administrator Associate credential proves you can protect an organisation’s sensitive data across Microsoft 365 using Microsoft Purview, which is a skill in steady demand as Australian organisations tighten data protection and prepare for the security questions that come with AI adoption. It validates practical work that employers hire for, including information protection, data loss prevention, retention and insider risk, rather than theory alone. Because it is the current replacement for the retired SC-400, holding it shows your skills are up to date.

With Logitrain the official SC-401 exam fee is included in the course price, so there is no separate voucher to buy later, unlike many providers who charge for the exam on top. You keep the digital course material, full time courses include mock tests to check your readiness, and the price beat guarantee means we will beat any competitor’s advertised price for the same course. Logitrain is an authorised Pearson VUE test centre, so you can sit the exam with us, at another Pearson VUE centre, or online through Pearson VUE online proctoring. You can train in person in Melbourne, Sydney and Brisbane, in person on request in Adelaide, Perth and Canberra, or live online in real time anywhere in Australia, with the same trainer and material either way.

There is no formal prerequisite for the SC-401 exam, so you can attend without holding another certification first. Microsoft does expect a working familiarity with the Microsoft 365 environment, and the course assumes you bring the following.

• A working knowledge of Microsoft 365 services and their security and compliance features
• Familiarity with Microsoft Purview, the Microsoft Defender portal and Microsoft Defender for Cloud Apps
• Some experience with Microsoft Entra and with PowerShell
• A general understanding of information security concepts

If you are new to Microsoft security, the SC-900 Security, Compliance and Identity Fundamentals course is the recommended starting point before this one.

Candidates can achieve this certification by passing the following exam.

• SC-401: Administering Information Security in Microsoft 365, leading to the Microsoft Certified: Information Security Administrator Associate certification

You can book and sit the exam within three months of finishing your course. Sit it at the Logitrain test centre, at any other Pearson VUE test centre, or online through Pearson VUE online proctoring from a private space.

Exam format: between 40 and 60 questions in a mix of multiple choice, case study and drag and drop formats. The exam runs for about 100 minutes, and the passing score is 700 on a scale of 100 to 1000. SC-401 is the current exam, introduced in 2025 to replace the retired SC-400, and the certification renews each year through a free online assessment on Microsoft Learn.

You receive the Logitrain course material for the Microsoft SC-401 Administering Information Security in Microsoft 365 course, provided in digital format for flexibility and ease of use. Practise questions are included to help you prepare for the official exam.

• Implement and manage sensitive information types, including custom types, exact data match and trainable classifiers
• Create and manage sensitivity labels and label policies to classify and protect content
• Configure Microsoft Purview Message Encryption and the Information Protection scanner for on premises data
• Design and implement data loss prevention policies across Microsoft 365 workloads
• Configure DLP for adaptive protection and interpret policy and rule precedence
• Plan and implement retention labels, retention policies and data lifecycle management
• Implement and investigate insider risk management policies, cases and alerts
• Manage information security alerts, activities and audit across Microsoft Purview
• Implement controls to protect content in Microsoft 365 environments that use AI services

• Information security administrators who protect sensitive data across Microsoft 365
• Microsoft 365 administrators taking on data protection and information security responsibilities
• Compliance, governance and risk professionals working with Microsoft Purview
• Security analysts and engineers who manage data loss prevention, retention and insider risk
• IT professionals who previously held or studied for SC-400 and need the current certification
• Consultants and administrators who design secure Microsoft 365 environments for clients

This is an associate level certification, so it suits people who already work with Microsoft 365 and have some security or administration background rather than complete beginners.

• Introduction to information security and Microsoft Purview in Microsoft 365
• Classify data for protection and governance, including sensitive information types and classifiers
• Create and manage sensitivity labels and label policies
• Apply and manage encryption with Microsoft Purview Message Encryption and Advanced Message Encryption
• Deploy the Microsoft Purview Information Protection client and scanner for on premises data
• Prevent data loss in Microsoft 365 with data loss prevention policies
• Configure DLP for adaptive protection and manage DLP alerts and activities
• Implement and manage retention labels, retention policies and adaptive scopes
• Manage the data lifecycle and records management
• Implement and investigate insider risk management
• Manage information security alerts, activities and audit
• Protect data used by AI services using Data Security Posture Management and Microsoft 365 controls

SC-900 Security, Compliance and Identity Fundamentals course is the recommended starting point for anyone newer to Microsoft security, and the natural first step before SC-401.

SC-300 Identity and Access Administrator course is a closely related associate certification for professionals managing identity and access in Microsoft 365.

SC-200 Security Operations Analyst course suits people who want to detect and respond to threats using Microsoft Sentinel and Microsoft Defender, complementing the data protection focus of SC-401.

SC-100 Microsoft Cybersecurity Architect course is the expert level next step for those who go on to design an organisation’s security strategy.

AZ-500 Azure Security Engineer course extends your skills into securing Azure workloads, identity and network security.

Browse the full Microsoft courses range to compare certifications, or if a job is your goal, the cyber security job ready program adds an internship, career counselling and job placement support on top of the training and certifications.

Got a team to train? Logitrain can deliver the SC-401 Information Security Administrator course in house at your premises anywhere in Australia, with the same features as the public courses, including a skilled trainer, the digital course material, mock tests and the official exam fee included. In house delivery suits teams who want everyone trained together on dates that suit the business, and the content can lean into the Microsoft Purview policies and data protection challenges your organisation actually faces.

What is the SC-401 certification?

SC-401 is the Microsoft exam Administering Information Security in Microsoft 365. Passing it earns the Microsoft Certified: Information Security Administrator Associate certification, which proves you can protect sensitive data across Microsoft 365 using Microsoft Purview.

Did SC-401 replace SC-400?

Yes. Microsoft retired the SC-400 exam and the Information Protection and Compliance Administrator Associate certification on 31 May 2025, and SC-401 is the direct replacement. New candidates now certify through SC-401, which shifts the focus from compliance towards information security and data protection with Microsoft Purview.

Is the exam fee included in the course?

Yes. The official SC-401 exam fee is included in your Logitrain course fee, so there is no separate voucher to buy later. You can sit the exam within three months of finishing the course at our Pearson VUE test centre, at another Pearson VUE centre, or online.

What are the prerequisites for SC-401?

There is no formal prerequisite, so you can attend without another certification first. Microsoft expects familiarity with Microsoft 365 services, Microsoft Purview, the Microsoft Defender portal, Microsoft Entra and PowerShell. If you are new to security, start with SC-900.

What does the SC-401 exam involve?

The exam has between 40 and 60 questions in a mix of multiple choice, case study and drag and drop formats. It runs for about 100 minutes, and you need a score of 700 out of 1000 to pass. It covers information protection, data loss prevention and retention, and managing risks, alerts and activities.

How long is the course and where can I train?

The course runs over four days full time, or four weeks part time if you study one day a week. You can train in person in Melbourne, Sydney and Brisbane, in person on request in Adelaide, Perth and Canberra, or live online in real time anywhere in Australia.

Does the certification expire?

The Information Security Administrator Associate certification renews each year. Microsoft lets you renew for free through a short online assessment on Microsoft Learn during the six month window before it expires, so keeping it current does not cost another exam fee.

I already hold SC-400. What should I do now?

Your SC-400 certification stays on your Microsoft Learn transcript, but it can no longer be renewed and is no longer offered to new candidates. If you want a current credential in this area, SC-401 is the certification to pursue.