Microsoft Certified: Information Protection and Compliance Administrator Associate (SC-400) was the Associate-level certification for administrators handling information protection, data classification, DLP (Data Loss Prevention), and compliance management centered on Microsoft Purview. It retired on May 31, 2025, and the retirement covered the entire certification, not just the exam. Its successor is the certification Microsoft Certified: Information Security Administrator Associate, earned via Exam SC-401: Administering Information Security in Microsoft 365. You can no longer book or sit SC-400. This article is kept as a record of what SC-400 covered, and as a pointer for anyone arriving here while planning work in this area today.
This article covers the scope of the retirement and what it means for people who already hold the badge, what SC-400's four domains contained, the key Microsoft Purview features, hands-on practice via the Microsoft 365 Developer Program, and the options left for anyone entering this area today. The character of the exam — aimed at technical staff who implement compliance requirements such as GDPR, HIPAA, and APPI (Japan's Personal Information Protection Act) using Microsoft products — carries over to its successor, SC-401.
SC-400 retired on May 31, 2025, and the retirement covered the whole certification — Microsoft Certified: Information Protection and Compliance Administrator Associate — not just the exam, so the credential itself is gone from the active catalog. The replacement is the certification Microsoft Certified: Information Security Administrator Associate, earned via Exam SC-401: Administering Information Security in Microsoft 365. Note that the certification name changed too: "Information Protection and Compliance Administrator" is no longer the name of anything you can earn.
If you already hold SC-400: a retirement means the exam can no longer be taken; it is not a revocation of badges already earned, and the certification stays on your Microsoft transcript as a record. It is not automatically converted into SC-401, and because SC-400 was a 12-month credential renewed through a renewal assessment, that renewal path ends with the retirement — check the official Microsoft retired-certifications page for the current handling of credentials you already hold. Practically: keep it on your résumé as a dated credential, and if you need a current credential in this area, that means SC-401.
What follows is a record of what SC-400 tested as of its retirement. You cannot sit the exam, but the outline still works as a table of contents for the Microsoft Purview compliance feature set. SC-401's price, question count, exam length, and domain weightings are not necessarily the same — do not read the figures below as SC-401 figures.
SC-400 followed the standard Associate-tier specification: 100 minutes, 40-60 questions, pass mark 700 / 1000, 165 USD / 21,103 JPY, valid for 12 months (renewable via the renewal assessment). It was delivered via Pearson VUE either as an OnVUE online proctored exam or at a test center, in multiple languages including Japanese. In addition to multiple-choice questions, it included scenario questions on the Microsoft Purview Portal UI, questions on the behavior of DLP and Retention policies, and case studies. The majority of questions followed the real-world compliance administrator workflow: requirement gathering → policy design → application → monitoring. These are the figures as of retirement; they no longer describe anything you can book.
The three Microsoft security Associate certifications (SC-200 / SC-300 / SC-400) had clearly distinct scopes. SC-200 and SC-300 remain current and bookable; SC-400 is retired, and its slot is now filled by its successor, SC-401.
| Certification | Scope | Primary Products |
|---|---|---|
| SC-200 | SOC operations / threat detection and response | Microsoft Sentinel / Defender XDR |
| SC-300 | Identity, authentication, and access control | Microsoft Entra ID |
| SC-400 (retired → SC-401) | Data protection, compliance, and eDiscovery | Microsoft Purview |
Overlap between the three was small (10-20%), and each mapped to an independent operational area. The combination that covers the full Microsoft security stack today is SC-200 + SC-300 + SC-401. It remains a strong differentiator for senior security engineer and security architect roles.
This was the highest-weighted core domain and had the largest impact on whether you passed. The focus is on Sensitivity Labels — designing and applying them (the standard pattern is a 5-tier hierarchy: Personal / Public / Internal / Confidential / Highly Confidential), Auto-labeling (machine-learning-driven automatic labeling), Trainable Classifiers (training on document types specific to your organization), Sensitive Information Types (SIT) (200+ built-in patterns including credit card numbers, SSN, Japan's My Number, etc.), Exact Data Match (EDM) (matching against organization-specific databases), Document Fingerprint (detecting template-based documents), encryption and rights management (DRM via Microsoft Information Protection, MIP), and Information Rights Management (IRM). The classic pitfall in this domain is Sensitivity Label inheritance behavior — you need to understand label inheritance from parent folders/mails to child files/mails, plus how Container Labels behave for SharePoint Sites and Teams.
This domain covers designing and operating Data Loss Prevention (DLP) policies. Key topics: Exchange / SharePoint / OneDrive / Teams / Endpoint DLP policy design (the customization options available at each location), custom DLP rules (conditions: Content contains, Document Property, Sensitive Information Type; actions: Block, Notify, Encrypt, Allow with Justification), DLP incident management (Alert, Activity Explorer, Endpoint DLP Activity Explorer), Adaptive Protection (the Insider Risk + DLP integration that dynamically applies DLP to at-risk users), integration with Microsoft Purview Data Lifecycle Management, and Communication DLP (monitoring conversations in Teams and Exchange).
This domain covers document retention and disposition strategy. Key topics: Retention Policies and Labels (organization-wide blanket retention vs. per-label application), Records Management (immutable retention for regulated documents, declaring Regulatory Records), Disposition Review (review and disposition workflow when retention periods elapse), Adaptive Scope (dynamic targeting based on attributes such as Department or Country), conflict resolution between Retention Policies and Labels (Retain wins over delete, Longer retention wins, Explicit wins), Inactive Mailbox management, Litigation Hold / In-place Hold strategy, and regulatory compliance for Records Management (SEC 17a-4, FINRA, GDPR Right to be Forgotten).
This domain covers insider threats and auditing. Key topics: Insider Risk Management (built-in policy templates such as data leak, departing-employee risk, IP protection, security policy violations, priority user protection, and healthcare data leak; plus Triage, Investigation, and Forensic Evidence), Communication Compliance (detecting inappropriate communication in Teams / Exchange / Yammer via keywords or ML), eDiscovery (Standard / Premium, Case creation, Hold, Search, Review, Export), advanced eDiscovery Premium features (Custodian Management, Computed Custodian Volume, Review Set, Analytics), Audit (Standard / Premium) (Activity Log, Search-MailboxAuditLog, long-term retention up to 10 years), and Customer Lockbox (approval gating for Microsoft support engineer access to customer data).
Microsoft Purview is Microsoft's unified data governance and compliance platform, rebranded in 2022 by merging the former Azure Purview (data catalog) and the Microsoft 365 Compliance Center. The Purview features SC-400 tested were primarily the Microsoft 365 context (Information Protection, DLP, Insider Risk, Communication Compliance, eDiscovery, Audit). The data catalog functions for Azure data platforms (Purview Data Catalog, Data Map) were out of scope for SC-400.Although both sit under the same Purview brand, their features are split for historical reasons. Purview itself is a live product that outlived the exam, and fluency with the Microsoft Purview Portal (formerly Microsoft 365 Compliance Center) UI is still the practical skill this area is built on.
This is what standard SC-400 preparation looked like — kept here as a record of how the material was usually sequenced, not as a plan you can execute toward an exam. It assumed 1-3 years of Microsoft 365 administration experience and that you already held SC-900.Month 1: Review SC-900, work through the Information Protection portion of the Microsoft Learn SC-400 learning path, obtain a free tenant via the Microsoft 365 Developer Program, create 3-5 Sensitivity Labels, and configure Auto-labeling.Month 2: Study the DLP and Retention domains, build DLP policies for each location, and configure a complete document retention strategy with Retention Labels plus Retention Policies.Month 3: Tackle the Insider Risk and eDiscovery domains plus final review. Deploy an Insider Risk Management policy, configure Communication Compliance, run one eDiscovery Case end to end, and iterate on the official Practice Assessment until you consistently score 80%+. The hands-on sequence still works as a way to learn Purview, but the SC-400 learning path and Practice Assessment were tied to the retired exam. If you are studying toward SC-401, take its scope and resources from the official page rather than from this outline.
The direct successor is SC-401 — the certification Microsoft Certified: Information Security Administrator Associate, earned via Exam SC-401: Administering Information Security in Microsoft 365. It is the current credential for the Microsoft Purview information protection and compliance area. Confirm its scope, price, and format on the official Microsoft page; do not assume they match SC-400's. To cover the security space, stack it with SC-200 (Security Operations Analyst) and SC-300 (Identity Admin), both of which are still current.SC-100 (Cybersecurity Architect Expert) is the step up to the strategy/architecture layer — SC-400 was one of its prerequisites, so check the official certification page for whether SC-401 is accepted in that role. For broad Microsoft 365 administration, MS-102 (Microsoft 365 Administrator Expert) is still bookable, but it is itself scheduled to retire as a whole certification on November 30, 2026, with Microsoft 365 Certified: AI Services Administrator Associate (Exam AB-650) announced as its successor. For compliance specialists, pairing with ISACA CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or OneTrust / TrustArc privacy / GRC certifications is well-received for in-house compliance and internal audit roles. SC-400 spent years listed as a preferred requirement on senior compliance engineer and information security administrator postings in the 7-12 million JPY salary band; the demand for the skill set has not gone anywhere, only the exam that certified it.
Can I still take SC-400?
No. Microsoft Certified: Information Protection and Compliance Administrator Associate (SC-400) retired on May 31, 2025, and the retirement covered the whole certification, not just the exam. Its successor is the certification Microsoft Certified: Information Security Administrator Associate, earned via Exam SC-401: Administering Information Security in Microsoft 365 — the subject area itself (information protection, data classification, DLP, and compliance management centered on Microsoft Purview) carries over to SC-401. Before it retired, SC-400 was an Associate-level certification: 100 minutes, 40-60 questions, 165 USD, pass at 700/1000, valid for 12 months, available in multiple languages including Japanese, covering Sensitivity Labels, DLP policies, Insider Risk Management, Communication Compliance, eDiscovery, Retention Policies, and Records Management. Those are all SC-400 figures as of its retirement; SC-401's price, question count, exam length, and weightings are not necessarily the same, so check the official Microsoft certification page.
How does it differ from other SC certifications?
The scopes were clearly distinct. SC-200 (Security Operations Analyst) covers SOC operations and threat detection/response, SC-300 (Identity and Access Administrator) covers identity, authentication, and access control, while SC-400 (Information Protection) covered data protection, compliance, and eDiscovery. Overlap between the three is small (10-20%), and each maps to an independent operational area. SC-400 in particular involved close collaboration with legal and compliance departments, targeting technical staff who implement compliance requirements such as GDPR, HIPAA, PCI DSS, SOX, GLBA, and APPI (Japan's Personal Information Protection Act) using Microsoft Purview. SC-200 and SC-300 are still current, bookable certifications; SC-400 retired at the certification level on May 31, 2025, so anyone entering this area now targets its successor, SC-401 (Microsoft Certified: Information Security Administrator Associate). SC-400 used to be one of the prerequisite certifications for SC-100 (Cybersecurity Architect Expert) — check the official Microsoft certification page for whether SC-401 is accepted in its place.
What were the exam domains and their weights?
As of its retirement the exam had 4 domains. Implement information protection (30-35%, the most important) covers creating and applying Sensitivity Labels, Auto-labeling, Trainable Classifiers, Sensitive Information Types (SIT), Exact Data Match (EDM), Document Fingerprint, and the broader Microsoft Purview Information Protection feature set. Implement DLP (15-20%) covers Exchange / SharePoint / OneDrive / Teams / Endpoint DLP policies, custom DLP rules, DLP incident management, and Adaptive Protection (the Insider Risk + DLP integration). Implement and manage information governance and retention (20-25%) covers Retention Policies/Labels, Records Management, Disposition Review, Adaptive Scope, Communication Compliance, and Insider Risk Management. Manage and investigate insider risk and compliance (20-25%) covers Insider Risk Management policy design, triage, Forensic Evidence, Communication Compliance, eDiscovery (Standard / Premium / Cases / Hold / Search / Export), and Audit (Standard / Premium).
What is Microsoft Purview?
Microsoft Purview is Microsoft's unified data governance and compliance platform, rebranded in 2022 by merging the former Azure Purview (data catalog) and the Microsoft 365 Compliance Center. The Purview features SC-400 tested were primarily the Microsoft 365 context (Information Protection, DLP, Insider Risk, Communication Compliance, eDiscovery, Audit); the data catalog functions for Azure data platforms (Purview Data Catalog, Data Map) were out of scope. Although both sit under the same Purview brand, their features are split for historical reasons. Purview itself is very much a live product after SC-400's retirement, and its documentation and Microsoft Learn training remain free and maintained, so the material can be learned without an exam attached.
How do you set up hands-on practice with Microsoft Purview?
SC-400 is retired, but Purview is a live product, so the hands-on routine still applies. The free Microsoft 365 Developer Program tenant (90 days plus auto-renewal) is effectively the required practice environment. It exposes the full Microsoft 365 E5 feature set (all Microsoft Purview Compliance capabilities), so every topic SC-400 used to cover can still be exercised hands-on. Concrete hands-on tasks: 1) Create 3-5 Sensitivity Labels (Personal / Public / Internal / Confidential / Highly Confidential) and configure Auto-labeling, 2) Create one DLP policy for each of Exchange / SharePoint / OneDrive / Teams / Endpoint, 3) Configure one full document-retention strategy with Retention Labels and Retention Policies, 4) Deploy one policy from an Insider Risk Management template, 5) Set up sample keyword detection in a Communication Compliance policy, and 6) Create an eDiscovery Case and walk through Hold + Search + Export end to end.
How much study time did it take, and what was the pass roadmap?
These are the figures reported for SC-400 before it retired: 80-120 hours with 1-3 years of Microsoft 365 administration experience, 150-200 hours if you knew Microsoft 365 but not Purview, and 250-300 hours from scratch, with a 3-4 month focused sprint as the norm. The proven path was the Microsoft Learn SC-400 learning path, the official Practice Assessment, hands-on lab work in a Microsoft 365 Developer Program tenant, and fluency with every section of the Microsoft Purview Portal; people with compliance background knowledge (GDPR, HIPAA, APPI, etc.) tended to move faster. Since the certification retired on May 31, 2025 this is no longer a plan you can execute. Study time, learning paths, and Practice Assessment availability for the successor SC-401 are not verified here — check the official Microsoft certification page.
What did the exam cost, and how could you get a free voucher?
As of retirement it was 165 USD / 21,103 JPY (incl. tax), paid by credit card via Pearson VUE. The Associate tier did not offer Virtual Training Day vouchers directly; the main free routes were Microsoft Reactor compliance/Purview hands-on events, completion vouchers from Cloud Skills Challenge Purview/Compliance tracks, Microsoft Ignite event perks, and enterprise certification subsidy programs. All of that predates the May 31, 2025 retirement — there is no way to book SC-400 now, and SC-401's price is not necessarily the same, so check the official Microsoft page. What has not changed is that Microsoft security certifications (SC-100 / SC-200 / SC-300 / SC-401 / SC-500) see relatively frequent campaigns, and regularly checking the Microsoft Learn Cloud Skills Challenge remains the most reliable route.
With SC-400 gone, what should you target in the information protection and compliance space?
The direct successor in this space is SC-401 (certification: Microsoft Certified: Information Security Administrator Associate; exam: SC-401: Administering Information Security in Microsoft 365). To cover the Microsoft security space, pair it with the current SC-200 (Security Operations Analyst) and SC-300 (Identity Admin). Moving up to the strategy/architecture layer with SC-100 (Cybersecurity Architect Expert) is also an option — SC-400 was one of its prerequisites, but check the official Microsoft certification page for whether SC-401 is accepted in that role. For broad Microsoft 365 administration, MS-102 (Microsoft 365 Administrator Expert) is still bookable, though MS-102 itself is scheduled to retire as a whole certification on November 30, 2026, with Microsoft 365 Certified: AI Services Administrator Associate (Exam AB-650) announced as its successor. For compliance specialists, pairing with ISACA CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or privacy/GRC certifications such as OneTrust or TrustArc is well-received for in-house compliance and internal audit roles. SC-400 spent years listed as a preferred requirement on senior compliance engineer and information security administrator postings in the 7-12 million JPY salary band; expect those listings to shift to SC-401 over time.
Related Articles and Exam Information
MS-900 Microsoft 365 Fundamentals: Retired March 31, 2026
MS-900 retired as a whole certification on March 31, 2026 and Microsoft plans no successor. What it covered, and what is left.
MS-102 Microsoft 365 Administrator: Complete Guide (2026)
Pass MS-102 before it retires on Nov 30, 2026 — tenant management, identity sync, Exchange, Teams. Successor: AB-650.
SC-900 Security, Compliance, Identity Fundamentals: Guide (2026)
Pass SC-900 — Entra ID, Defender, Sentinel, Purview, compliance. The starter security cert.
Microsoft Purview DLP Design Patterns (2026)
Purview DLP — sensitive info types, policies, endpoint DLP. Compliance-driven data protection patterns.
The exam information in this article is based on the official Microsoft Learn SC-400 page and the Microsoft Purview Documentation. This article is not an official Microsoft Corporation product and is not affiliated with or endorsed by Microsoft in any way. Microsoft, Azure, Microsoft Purview, and Microsoft Entra are trademarks of the Microsoft group of companies. Information is based on official publicly available materials as of May 24, 2026. Always check the official pages for the latest information.
Practice with certification-focused question sets
Visit the Azure Exam Prep PageNicheeLab Editorial Team
NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.
AZ-900 Azure Fundamentals: Complete Exam Guide (2026)
Pass AZ-900 — cloud concepts, Azure architecture, management...
Azure Certification Roadmap: Which Cert to Take Next (2026)
Choose your Azure certification path — Fundamentals, Associa...
AI-901 Azure AI Fundamentals: Complete Guide (2026)
Pass AI-901 — Microsoft Foundry, generative AI, responsible ...
Microsoft Entra ID Fundamentals for Azure Certs (2026)
Entra ID basics every cert candidate needs — tenants, identi...
DP-900 Azure Data Fundamentals: Complete Guide (2026)
Pass DP-900 — relational, non-relational, analytics, Power B...