If you booked SC-400, half-finished a study plan for it, or added it to a training budget for this year, you have probably just discovered the exam no longer exists. The short version of SC-400 vs SC-401 is that Microsoft retired SC-400 on 30 May 2025 and replaced it with SC-401, and the two exams are not the same test under a new number.
Microsoft's own certification page for SC-400 now carries a retirement notice and a retirement date of 30 May 2025. The exam, the Microsoft Certified: Information Protection and Compliance Administrator Associate certification and the renewal assessment were all retired together. There is no grace period left and no way to book it.
SC-400 Is Retired: The Short Answer
Three things are true at once, and candidates keep conflating them.
- The exam is gone. SC-400 cannot be scheduled through Pearson VUE.
- The certification is gone. Microsoft Certified: Information Protection and Compliance Administrator Associate is no longer awarded, and its renewal assessment was retired with it.
- SC-401 is the successor, not a rename. It covers a narrower role with a different domain structure and a large block of content that did not exist on SC-400 at all.
Exam Tip: Microsoft retired SC-400 because the credential bundled two separate jobs into one badge. Information protection and compliance were split, and SC-401 kept only the information security half. If your reason for sitting SC-400 was the compliance and records management content, SC-401 is not the exam you wanted.
What Microsoft Replaced SC-400 With
The replacement is Exam SC-401: Administering Information Security in Microsoft 365, which earns the Microsoft Certified: Information Security Administrator Associate certification.
The role Microsoft describes for SC-401 is tighter than the old one. You plan and implement information security for sensitive data using Microsoft Purview and related services, protect data inside Microsoft 365 collaboration environments from internal and external threats, and protect data used by AI services. Microsoft expects familiarity with Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal and Microsoft Defender for Cloud Apps.
That last item in the role description is the one worth reading twice. Protecting data consumed by AI services is now a first-class part of the job description, and it is examined.
SC-400 vs SC-401: What Actually Changed
SC-400 finished its life with five skill areas. SC-401 has three, weighted almost evenly. That flattening is the clearest signal that this is a different exam rather than a refresh.
| SC-400 (retired 30 May 2025) | SC-401 (current) | |
|---|---|---|
| Certification | Information Protection and Compliance Administrator Associate | Information Security Administrator Associate |
| Skill areas | Five | Three |
| Weightings | Implement information protection 25-30%, Implement DLP 15-20%, Implement data lifecycle and records management 10-15%, Monitor and investigate data and activities 15-20%, Manage insider and privacy risk 15-20% | Implement information protection 30-35%, Implement data loss prevention and retention 30-35%, Manage risks, alerts and activities 30-35% |
| AI data protection | Not a listed skill area | Examined under Manage risks, alerts and activities |
| Records management | Its own skill area | Absorbed, retention only |
| Status | Retired, cannot be booked or renewed | Live, skills measured updated 28 July 2026 |
Three practical consequences follow from that table.
Retention survived, records management did not. SC-400 gave data lifecycle and records management a dedicated 10-15% slice. On SC-401, retention labels, retention policies, adaptive policy scopes and content recovery sit inside the data loss prevention domain. The disposition and records declaration depth is gone.
Insider Risk Management got promoted. On SC-400 it shared a 15-20% area with privacy risk. On SC-401 it anchors a domain worth up to 35%, alongside Purview Audit, Activity explorer, alert response in Microsoft Defender XDR and eDiscovery searches.
AI data protection is entirely new. SC-401 examines Data Security Posture Management for AI: its prerequisites, roles and permissions, policies and monitoring, plus Purview and Microsoft 365 controls for environments running AI services. No amount of 2023 SC-400 revision prepares you for that section, and it is the section most likely to catch out anyone treating SC-401 as a re-sit.
SC-401 Exam Format, Cost and Pass Mark
These come from Microsoft's official exam page and study guide, both updated in 2026.
- Duration: 100 minutes.
- Pass mark: 700 on a scale where 700 or greater is required to pass.
- Price: 165 US dollars in the United States, with pricing set by the country or region where the exam is proctored.
- Delivery: proctored through Pearson VUE, with possible interactive components.
- Languages: English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified) and Spanish.
- Renewal: annually, free, through an online assessment on Microsoft Learn.
- Skills measured version: 28 July 2026.
Microsoft does not publish a question count for SC-401, so treat any specific number you see quoted elsewhere as an estimate rather than a fact.
The 28 July 2026 update was small. Microsoft's own change log records minor edits to Manage information security alerts and activities and to Protect data used by AI services, with the audience profile and the domain structure unchanged. Study material written against the earlier 2026 outline is still usable.
SC-400 vs SC-401: Does Your Old Study Material Still Count?
Partly, and the split is predictable once you know where the domains moved.
Still worth keeping:
- Sensitive information types, custom SITs, exact data match, document fingerprinting and trainable classifiers
- Sensitivity labels, publishing policies, auto-labelling, container labels and protection settings
- DLP policy design, rule precedence, Endpoint DLP and Defender for Cloud Apps file policies
- Purview Message Encryption and the Information Protection client and scanner
Safe to bin:
- Records management, disposition reviews and records declaration depth
- Compliance Manager and regulatory compliance assessments as exam content
- Anything framed around the old Microsoft 365 compliance portal rather than the Microsoft Purview portal
Must be learned from scratch:
- Data Security Posture Management for AI, end to end
- Purview and Microsoft 365 controls for protecting content in AI-enabled environments
- Insider Risk Management at the depth a 30-35% domain demands, including connectors, forensic evidence settings, Adaptive Protection risk levels and case workflow
A reasonable rule of thumb: expect to reuse roughly two thirds of solid SC-400 preparation and to add a genuinely new block of AI data security work on top. Our 8-week SC-401 study plan sequences it in that order.
What Happens to the SC-400 You Already Hold
Passing SC-400 before the retirement date was not wasted. Microsoft keeps retired certifications on your transcript and they stay verifiable, so the credential remains something you can evidence to an employer.
What you cannot do is renew it. Microsoft retired the SC-400 renewal assessment on the same date as the exam, so an SC-400 that reached its expiry has lapsed with no route back. If you need a current, renewable Microsoft credential for this role, SC-401 is the only one on offer.
Nothing migrates automatically. There is no upgrade exam, no discount and no partial credit. SC-401 is a full exam sitting at full price.
Is SC-401 the Right Next Exam for You?
Take SC-401 if you administer Microsoft Purview day to day: labels, DLP policies, retention, insider risk and the alerts that come out of them. It is the only Microsoft exam that goes deep on that stack.
Look elsewhere if your work sits next to it rather than in it. If you run the security operations side, SC-200 is the closer fit. If you are securing Azure and AI workloads more broadly, SC-500 replaced AZ-500 and covers that ground, and our AZ-500 vs SC-500 comparison explains where the line falls. If you are heading for architecture, SC-100 sits above all of them.
SC-400 is one of a long list of Microsoft credentials that have changed number or disappeared in this cycle. Our roundup of every Microsoft certification retiring in 2026 covers the rest of them.
Frequently Asked Questions
Is the SC-400 exam retired?
Yes. Microsoft's certification page lists a retirement date of 30 May 2025 for the Information Protection and Compliance Administrator Associate certification, and states that the certification and its renewal assessment are both retired. The exam cannot be scheduled.
Are SC-400 and SC-401 the same exam?
No. SC-401 replaced SC-400, but it dropped from five skill areas to three, removed records management and compliance as dedicated areas, expanded Insider Risk Management to a full third of the exam, and added protecting data used by AI services, which SC-400 never examined.
What is the difference between SC-400 and SC-401?
SC-400 certified an information protection and compliance administrator. SC-401 certifies an information security administrator only. Microsoft split the credential because it had bundled two distinct roles, and kept the data security half. The Purview labelling and DLP content carried across; the compliance and records content did not.
What is SC-401 certification?
SC-401 is Exam SC-401: Administering Information Security in Microsoft 365, which earns the Microsoft Certified: Information Security Administrator Associate certification. It covers information protection, data loss prevention and retention, and risk, alert and activity management across Microsoft Purview, including data protection for AI services.
How much does the SC-401 certification cost?
SC-401 costs 165 US dollars in the United States. Microsoft sets the price by the country or region in which the exam is proctored, so check the Pearson VUE booking page for your local fee. Renewal after that is free through an online assessment on Microsoft Learn.
Ready to Start Practising?
The SC-401 sections that catch people out are the ones with no SC-400 equivalent: DSPM for AI, Adaptive Protection risk levels and Insider Risk Management workflow. Reading about them is not the same as answering exam-style questions on them under time pressure.
CertCrush runs practice questions with full explanations across the Microsoft security track, so you can find the gaps before Pearson VUE does. Create a free account and start with the Purview and risk-management topics you have not touched since SC-400.