SC-401: Administering Information Security in Microsoft 365 just became generally available. This will exam and the certification it provides replace SC-400 which retires at the end of this month. Unfortunately it’s being treated as a different exam and certification, so this is another exam you will need to sit as opposed to being automatically assigned the new certification. My views on this are included in this post, after the analysis of the changes.

If we start by taking a look at the domain objectives, these have been simplified for SC-401, with three equally weighted sections. My initial thought was that this was mostly consolidation, but that’s not really true.

SC-401 Skills at a glance

  • Implement information protection (30–35%)
  • Implement data loss prevention and retention (30–35%)
  • Manage risks, alerts, and activities (30–35%)

SC-400 Skills at a glance

  • Implement information protection (25–30%)
  • Implement DLP (15–20%)
  • Implement data lifecycle and records management (10–15%)
  • Monitor and investigate data and activities by using Microsoft Purview (15–20%)
  • Manage insider and privacy risk in Microsoft 365 (15–20%)

Let’s take a look at what has been added to the exam

  • Configure optical character recognition (OCR) support for sensitive info types
  • Microsoft Purview Information Protection client
  • Configure data loss prevention policies for Adaptive Protection
  • Just-in-time protection
  • Assign Microsoft Purview Audit (Premium) user licenses
  • Implement and manage Microsoft Purview Insider Risk Management (multiple additions to section)
  • Protect data used by AI services (new section)

Digging in further, let’s take a look at what’s been removed. This where we see the majority of changes, and the topics that seem to have been removed. These are all exam sections, not individual items, so quite a few things have been removed.

  • Records Management
  • Compliance Manager
  • eDiscovery
  • Communication Compliance
  • Information Barriers
  • Microsoft Priva

Now that we see this list, it definitely starts to make more sense why this isn’t just an update to SC-401, there is definitely a change in focus moving forward. That said, I still think it would have been appropriate to move the SC-400 earned Microsoft Certified: Information Protection and Compliance Administrator Associate credential earners over to SC-401’s Administering Information Security in Microsoft 365.

Why do I think this? For now I see the new exam being more focused, so in reality, SC-400’s breadth would have made it much more difficult for many people. While SC-401 may expect deeper knowledge of fewer technologies, the renewal assessments could have been used to check those skills. The reality of the situation is that I don’t think this is going to impact all that many people compared to other SC-xxx and quite a few other Microsoft exams. That doesn’t make it any easier to accept for those of you who are not happy with the “this is a new exam” decision that has been made.

Implement information protection (30–35%)

Implement and manage data classification

Implement and manage sensitivity labels in Microsoft Purview

Implement information protection for Windows, file shares, and Exchange

Implement data loss prevention and retention (30–35%)

Create and configure data loss prevention policies

Implement and monitor Microsoft Purview Endpoint DLP

Implement and manage retention

Manage risks, alerts, and activities (30–35%)

Implement and manage Microsoft Purview Insider Risk Management

Manage information security alerts and activities

Protect data used by AI services