SC-300 & SC-401: Identity & Information Security Bootcamp

SC-300 and SC-401 Bootcamp Overview

This Microsoft security bootcamp is a six-day, instructor-led path to two associate certifications: SC-300 for Microsoft Certified: Identity and Access Administrator Associate and SC-401 for Microsoft Certified: Information Security Administrator Associate. Both exams are taken while you attend, and both are administered onsite by Pearson VUE.

The pairing reflects how the work actually splits. SC-300 is the identity half: designing and operating identity and access management in Microsoft Entra ID, managing users, groups, external and hybrid identities, authentication methods and Conditional Access, workload identities and enterprise app integration, and identity governance through entitlement management, access reviews and Privileged Identity Management. SC-401 is the data half: protecting sensitive information with Microsoft Purview through classification and sensitivity labels, data loss prevention across endpoints and services, retention and recovery, insider risk management, and the newer discipline of protecting data used by AI services.

The camp is taught using two Microsoft Official Courseware courses, SC-300T00 and SC-401T00, delivered by Microsoft Certified Trainers. Passing both leaves you with the two credentials that together cover who can get in and what they can do with the data once they are there, which is the combination most security administrator roles actually ask for.

Who This Microsoft Security Course Is For

Microsoft writes SC-300 for the identity and access administrator: the person who designs, implements and operates identity and access management with Microsoft Entra, manages identities through their lifecycle for users, devices, Azure resources and applications, and is accountable for applying Zero Trust principles to identity. That is a role built around enabling access without giving away more than intended, and around troubleshooting, monitoring and reporting on it afterwards.

SC-401 is written for the information security administrator: the person who plans and implements protection for sensitive data using Microsoft Purview, mitigates risk inside Microsoft 365 collaboration environments from both internal and external threats, and now also protects the data flowing through AI services. It covers information protection, data loss prevention, retention and insider risk management, and it includes responding to information security incidents.

Taken together the camp suits security administrators and Microsoft 365 administrators whose remit spans both identity and data, identity engineers who keep being handed Purview work, compliance and governance staff who need the technical implementation behind the policy, and consultants who have to deliver both halves for a client. It also fits anyone whose organisation is standing up Zero Trust, since identity and data protection are the two pillars that programme lands on first.

What You'll Learn in SC-300 (Identity and Access Administrator)

SC-300 is scored across four skill areas, in Microsoft's own weightings, measured as of April 27, 2026:

• Implement authentication and access management (25-30%): the largest area, covering authentication methods including certificate-based authentication, Temporary Access Pass, Microsoft Authenticator and passkeys, tenant-wide multifactor authentication, self-service password reset, Windows Hello for Business, Conditional Access policy design and troubleshooting, continuous access evaluation, risk management with Microsoft Entra ID Protection, and Global Secure Access.
• Implement and manage user identities (20-25%): configuring the Microsoft Entra tenant and its roles and administrative units, creating and managing users, groups and licences, managing external users and cross-tenant access, and implementing hybrid identity with Entra Connect Sync, Cloud Sync, password hash synchronisation, pass-through authentication and seamless single sign-on.
• Plan and implement workload identities (20-25%): selecting and creating managed identities and service principals for applications and Azure workloads, integrating enterprise and SaaS applications, app registrations and API permissions, and managing app access with Microsoft Defender for Cloud Apps.
• Plan and automate identity governance (20-25%): entitlement management with catalogs and access packages, access reviews, privileged access through Privileged Identity Management including break-glass accounts, and monitoring identity activity with logs, KQL queries, workbooks and Identity Secure Score.

What You'll Learn in SC-401 (Information Security Administrator)

SC-401 is scored across three evenly weighted skill areas, measured as of July 28, 2026:

• Implement information protection (30-35%): data classification including custom sensitive info types, document fingerprinting, exact data match and trainable classifiers, sensitivity labels for items and containers with protection settings, publishing and auto-labeling policies, and information protection for Windows, file shares and Exchange including Purview Message Encryption.
• Implement data loss prevention and retention (30-35%): designing and managing data loss prevention policies including Adaptive Protection and rule precedence, Endpoint DLP with device requirements and just-in-time protection, and retention through labels, policies, adaptive scopes and recovery of retained content.
• Manage risks, alerts, and activities (30-35%): Purview Insider Risk Management from connectors and policy indicators through to alerts, cases and forensic evidence, investigating with Purview Audit, Activity explorer and eDiscovery, responding to alerts in the Purview portal and Microsoft Defender XDR, and protecting data used by AI services with Data Security Posture Management for AI.

Why Choose This Microsoft Security Camp

Identity and data protection are usually learned years apart, one incident at a time. Doing both in one week with a Microsoft Certified Trainer, official courseware and both exams booked before you leave is a far better outcome than passing SC-300 and leaving the Purview half to a future that never arrives. The two halves also reinforce each other: Conditional Access and sensitivity labels are the same argument about trust, approached from opposite ends.

• 6-day accelerated format: two courses, two exams, two certifications, one trip.
• Taught by Microsoft Certified Trainers (MCTs), not generalists.
• 95% first-attempt pass rate, with a retake voucher for each exam if you need it.
• Two Microsoft exam vouchers included for SC-300 and SC-401, with no hidden exam fees.
• Two Microsoft Official Courseware courses, SC-300T00 and SC-401T00, plus Microsoft study labs and simulations.
• Onsite Pearson VUE testing, with both exams administered while you attend.
• 90 days of extended lab access after the camp ends.
• Classroom live in Sarasota, FL, or remote classroom live, the same instructor-led class either way.
• Classes run as scheduled, with no cancellations, so you can book travel with confidence.