SC-401 Administering Information Security in Microsoft 365

What's inside

SC-401 doesn't test whether you can find a page in the Microsoft Purview portal. It tests whether you can choose the right classifier, label setting, DLP condition, retention option or role for an information security requirement.

This independent study guide for the Microsoft Certified: Information Security Administrator Associate exam distils what SC-401 really expects you to understand into the comparisons, configuration choices and traps that Microsoft Purview decisions turn on, with short Security & Compliance PowerShell and Exchange Online PowerShell examples throughout.

Organised by technology

Fourteen chapters, each readable on its own and together covering all three SC-401 skill areas:

• Implement information protection: Purview roles and role groups, sensitive information types, keyword dictionaries, document fingerprinting, exact data match, OCR, trainable classifiers, Data explorer and Content explorer, sensitivity labels, encryption and content marking, label policies, client-side and service-side auto-labelling, labels for Teams, sites, Power BI and Defender for Cloud Apps, the Information Protection client and scanner, and Message Encryption.
• Implement data loss prevention and retention: DLP policy design, locations, conditions, actions and overrides, simulation mode, Adaptive Protection, Endpoint DLP onboarding, settings and just-in-time protection, Defender for Cloud Apps file policies, retention policies and adaptive scopes, the principles of retention, Preservation Lock, retention labels, records, event-based retention and disposition review.
• Manage risks, alerts and activities: Insider Risk Management policies, indicators and cases, Audit (Standard) and Audit (Premium), Activity explorer, responding to alerts in the Purview portal and Microsoft Defender XDR, eDiscovery cases, searches, holds, review sets and exports, and protecting the data used by Microsoft 365 Copilot and other AI apps with Data Security Posture Management.

Inside

• Comparison tables for every close call, such as which classifier, which label setting, which DLP location or which retention option fits a requirement.
• 166 Common trap callouts that name the answers that look right but aren't, and explain what's right instead.
• 14 diagrams, from the permissions model and exact data match to label priority, DLP policy states, the principles of retention, Insider Risk Management and the eDiscovery workflow.
• Key takeaways at the end of every chapter for fast revision.
• A glossary of more than 300 terms, each linked to Microsoft Learn, with a free online version for print readers.

Up to date

Microsoft Purview changes quickly. This edition reflects Microsoft's documentation as of October 2026 and the skills measured from 28 October 2026, including the Microsoft Purview portal, the new eDiscovery experience, label groups, Data Security Posture Management, Microsoft Purview Suite licensing and the retirement of Defender for Cloud Apps file policies.

Understanding, not memorising

This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and apply the same judgement to a real tenant.

Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.

Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.

Is this book for you?

• Yes, if you're preparing for SC-401 and want to understand why the right answer is right, or you work with these services and want a compact reference organised by technology.
• It isn't a question bank. The book contains no exam questions. Use it alongside Microsoft's free official SC-401 study guide and practice assessment, and some hands-on time in Azure.
• Leads to Microsoft Certified: Information Security Administrator Associate.
• Exam outline: Microsoft's skills measured as of October 28, 2026. We check for outline changes every month.

Which certification, which book?

Exam coverage

Every skill area in Microsoft's SC-401 outline (as of October 28, 2026), and the chapters that cover it.

See every objective and where the book covers it

Chapters

1. Microsoft Purview for information security administrators
2. Classifying data: sensitive information types, fingerprints, EDM and OCR
3. Trainable classifiers and monitoring classification
4. Sensitivity labels: design, protection and publishing
5. Applying labels automatically and to containers
6. Information protection for Windows, file shares and Exchange
7. Designing and managing DLP policies
8. Endpoint DLP and Defender for Cloud Apps file policies
9. Retention policies and the principles of retention
10. Retention labels, auto-apply and records management
11. Insider Risk Management
12. Audit, Activity explorer and responding to alerts
13. eDiscovery
14. Protecting data used by AI

Plus an appendix glossary of 300+ terms, each linked to Microsoft Learn, with the same terms explained free online for print readers.

Sample diagrams

Free study notes

Some sections of the book, free to read online:

• Exact data match (EDM) sensitive information types in Microsoft Purview

  How EDM SITs match your own records: schema, primary and supporting elements, new and classic experiences, and hashing and uploading data.

• Microsoft Purview sensitivity labels: scopes, priority and sublabels

  How to design sensitivity labels: the four label scopes, label priority and order, sublabels and label groups, and label limits.

• Microsoft Purview DLP policy states and simulation mode

  How to roll out a DLP policy safely with simulation mode and policy tips, and the four policy states with their PowerShell Mode values.

• Endpoint DLP device requirements and onboarding in Microsoft Purview

  Which Windows, Windows Server and macOS devices Endpoint DLP supports, the prerequisites, and how to onboard devices to Microsoft Purview.

• The principles of retention and Policy lookup in Microsoft Purview

  Which setting wins when several retention policies and labels apply to one item, with worked examples, and how to use Policy lookup.

• Choosing an Insider Risk Management policy template in Microsoft Purview

  Which Insider Risk Management policy template fits each scenario, with its triggering event, prerequisites and user limit.

• Microsoft Purview Audit (Standard) vs Audit (Premium): retention and licences

  What Audit (Premium) adds over Audit (Standard): default retention periods, 10-year retention, intelligent insights and the licences each needs.

• Building eDiscovery searches with the condition builder and KeyQL

  How to build Microsoft Purview eDiscovery searches with the condition builder and KeyQL, with example queries and the search limits to know.