SC-400 Study Guide

Exam Quick Facts

Study Resources

Who is this exam for?

This Microsoft Security certification covers security, compliance, and identity topics. It tests your ability to implement and manage security solutions across Microsoft’s cloud platforms. This is an associate-level exam that expects hands-on experience. You should have practical knowledge of the technologies covered.

Skills Measured

Implement information protection (25–30%)

This domain covers the skills needed to work with the topics described below. Study each objective carefully and use the linked resources to deepen your understanding.

Create and manage sensitive info types

• Identify sensitive information requirements for an organization’s data
• Translate sensitive information requirements into built-in or custom sensitive info types
• Create and manage custom sensitive info types
• Create and manage exact data match (EDM) classifiers
• Implement document fingerprinting
• Identify sensitive information requirements for an organization’s data
• Translate sensitive information requirements into built-in or custom sensitive info types
• Create and manage custom sensitive info types
• Create and manage exact data match (EDM) classifiers
• Implement document fingerprinting

Create and manage trainable classifiers

• Identify when to use trainable classifiers
• Design and create a trainable classifier
• Test a trainable classifier
• Retrain a trainable classifier
• Identify when to use trainable classifiers
• Design and create a trainable classifier
• Test a trainable classifier
• Retrain a trainable classifier

Implement and manage sensitivity labels

• Implement roles and permissions for administering sensitivity labels
• Define and create sensitivity labels
• Configure and manage sensitivity label policies
• Configure auto-labeling policies for sensitivity labels
• Monitor data classification and label usage by using Content explorer, Activity explorer, and audit search
• Apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner
• Manage protection settings and marking for applied sensitivity labels
• Implement roles and permissions for administering sensitivity labels
• Define and create sensitivity labels
• Configure and manage sensitivity label policies
• Configure auto-labeling policies for sensitivity labels
• Monitor data classification and label usage by using Content explorer, Activity explorer, and audit search
• Apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner
• Manage protection settings and marking for applied sensitivity labels

Design and implement encryption for email messages

• Design an email encryption solution based on methods available in Microsoft 365
• Implement Microsoft Purview Message Encryption
• Implement Microsoft Purview Advanced Message Encryption
• Design an email encryption solution based on methods available in Microsoft 365
• Implement Microsoft Purview Message Encryption
• Implement Microsoft Purview Advanced Message Encryption

Implement DLP (15–20%)

This domain covers the skills needed to work with the topics described below. Study each objective carefully and use the linked resources to deepen your understanding.

Create and configure DLP policies

• Design DLP policies based on an organization’s requirements
• Configure permissions for DLP
• Create and manage DLP policies
• Interpret policy and rule precedence in DLP
• Configure a Microsoft Defender for Cloud Apps file policy to use DLP policies
• Design DLP policies based on an organization’s requirements
• Configure permissions for DLP
• Create and manage DLP policies
• Interpret policy and rule precedence in DLP
• Configure a Microsoft Defender for Cloud Apps file policy to use DLP policies

Implement and monitor Endpoint DLP

• Configure advanced DLP rules for devices in DLP policies
• Configure Endpoint DLP settings
• Recommend a deployment method for device onboarding
• Identify endpoint requirements for device onboarding
• Monitor endpoint activities
• Implement the Microsoft Purview Extension
• Configure advanced DLP rules for devices in DLP policies
• Configure Endpoint DLP settings
• Recommend a deployment method for device onboarding
• Identify endpoint requirements for device onboarding
• Monitor endpoint activities
• Implement the Microsoft Purview Extension

Monitor and manage DLP activities

• Analyze DLP reports
• Analyze DLP activities by using Activity explorer
• Remediate DLP alerts in the Microsoft Purview compliance portal
• Remediate DLP alerts generated by Defender for Cloud Apps
• Analyze DLP reports
• Analyze DLP activities by using Activity explorer
• Remediate DLP alerts in the Microsoft Purview compliance portal
• Remediate DLP alerts generated by Defender for Cloud Apps

Implement data lifecycle and records management (10–15%)

This domain covers the skills needed to work with the topics described below. Study each objective carefully and use the linked resources to deepen your understanding.

Retain and delete data by using retention labels

• Plan for information retention and disposition by using retention labels
• Create retention labels for data lifecycle management
• Configure and manage adaptive scopes
• Configure a retention label policy to publish labels
• Configure a retention label policy to auto-apply labels
• Interpret the results of policy precedence, including using Policy lookup
• Plan for information retention and disposition by using retention labels
• Create retention labels for data lifecycle management
• Configure and manage adaptive scopes
• Configure a retention label policy to publish labels
• Configure a retention label policy to auto-apply labels
• Interpret the results of policy precedence, including using Policy lookup

Manage data retention in Microsoft 365 workloads

• Create and apply retention policies for SharePoint and OneDrive
• Create and apply retention policies for Microsoft 365 groups
• Create and apply retention policies for Teams
• Create and apply retention policies for Yammer
• Create and apply retention policies for Exchange Online
• Apply mailbox holds in Exchange Online
• Implement Exchange Online archiving policies
• Configure preservation locks for retention policies and retention label policies
• Recover retained content in Microsoft 365
• Create and apply retention policies for SharePoint Online and OneDrive
• Create and apply retention policies for Microsoft 365 groups
• Create and apply retention policies for Teams
• Create and apply retention policies for Yammer
• Create and apply retention policies for Exchange Online
• Apply mailbox holds in Exchange Online
• Implement Exchange Online archiving policies
• Configure preservation locks for retention policies and retention label policies
• Recover retained content in Microsoft 365

Implement Microsoft Purview records management

• Create and configure retention labels for records management
• Manage retention labels by using a file plan, including file plan descriptors
• Classify records by using retention labels and retention label policies
• Manage event-based retention
• Manage the disposition of content in records management
• Configure records management settings, including retention label settings and disposition settings
• Create and configure retention labels for records management
• Manage retention labels by using a file plan, including file plan descriptors
• Classify records by using retention labels and retention label policies
• Manage event-based retention
• Manage the disposition of content in records management
• Configure records management settings, including retention label settings and disposition settings

Monitor and investigate data and activities by using Microsoft Purview (15–20%)

This domain covers monitoring and maintenance. You need to know how to use monitoring tools, configure alerts, and implement backup and recovery solutions.

Plan and manage regulatory requirements by using Microsoft Purview Compliance Manager

• Plan for regulatory compliance in Microsoft 365
• Create and manage assessments
• Create and modify custom templates
• Interpret and manage improvement actions
• Create and manage alert policies for assessments
• Plan for regulatory compliance in Microsoft 365
• Create and manage assessments
• Create and modify custom templates
• Interpret and manage improvement actions
• Create and manage alert policies for assessments

Plan and manage eDiscovery and Content search

• Choose between eDiscovery (Standard) and eDiscovery (Premium) based on an organization’s requirements
• Plan and implement eDiscovery
• Delegate permissions to use eDiscovery and Content search
• Perform searches and respond to results from eDiscovery
• Manage eDiscovery cases
• Perform searches by using Content search
• Choose between eDiscovery (Standard) and eDiscovery (Premium) based on an organization’s requirements
• Plan and implement eDiscovery
• Delegate permissions to use eDiscovery and Content search
• Perform searches and respond to results from eDiscovery
• Manage eDiscovery cases
• Perform searches by using Content search

Manage and analyze audit logs and reports in Microsoft Purview

• Choose between Audit (Standard) and Audit (Premium) based on an organization’s requirements
• Plan for and configure auditing
• Investigate activities by using the unified audit log
• Review and interpret compliance reports and dashboards
• Configure alert policies
• Configure audit retention policies
• Choose between Audit (Standard) and Audit (Premium) based on an organization’s requirements
• Plan for and configure auditing
• Investigate activities by using the unified audit log
• Review and interpret compliance reports and dashboards
• Configure alert policies
• Configure audit retention policies

Manage insider and privacy risk in Microsoft 365 (15–20%)

This domain covers the skills needed to work with the topics described below. Study each objective carefully and use the linked resources to deepen your understanding.

Implement and manage Microsoft Purview Communication Compliance

• Plan for communication compliance
• Create and manage communication compliance policies
• Investigate and remediate communication compliance alerts and reports
• Plan for communication compliance
• Create and manage communication compliance policies
• Investigate and remediate communication compliance alerts and reports

Implement and manage Microsoft Purview Insider Risk Management

• Plan for insider risk management
• Create and manage insider risk management policies
• Investigate and remediate insider risk activities, alerts, and reports
• Manage insider risk cases
• Manage forensic evidence settings
• Manage notice templates
• Plan for insider risk management
• Create and manage insider risk management policies
• Investigate and remediate insider risk activities, alerts, and reports
• Manage insider risk cases
• Manage forensic evidence settings
• Manage notice templates

Implement and manage Microsoft Purview Information Barriers (IBs)

• Plan for IBs
• Create and manage IB segments and policies
• Configure Teams, SharePoint, and OneDrive to enforce IBs, including setting barrier modes
• Investigate issues with IB policies
• Plan for IBs
• Create and manage IB segments and policies
• Configure Teams, SharePoint Online, and OneDrive to enforce IBs, including setting barrier modes
• Investigate issues with IB policies

Implement and manage privacy requirements by using Microsoft Priva

• Configure and maintain privacy risk management
• Create and manage Privacy Risk Management policies
• Identify and monitor potential risks involving personal data
• Evaluate and remediate alerts and issues
• Implement and manage subject rights requests
• Configure and maintain privacy risk management
• Create and manage Privacy Risk Management policies
• Identify and monitor potential risks involving personal data
• Evaluate and remediate alerts and issues
• Implement and manage subject rights requests

Audience profile

• Implement information protection (25–30%)
• Implement DLP (15–20%)
• Implement data lifecycle and records management (10–15%)
• Monitor and investigate data and activities by using Microsoft Purview (15–20%)
• Manage insider and privacy risk in Microsoft 365 (15–20%)

What to Study Next

Based on this exam, here are related certifications to consider:

• SC-300: Microsoft Identity and Access Administrator — Associate
• MS-102: Microsoft 365 Administrator — Associate
• SC-200: Microsoft Security Operations Analyst — Associate

Quick Links

• Official Exam Page
• Microsoft Study Guide
• Practice Assessment