SC-401 · PowerShell 101 · All skill areas

PowerShell for SC-401: read it, pick it, order it

The exam never asks you to type PowerShell. It shows you a command with gaps. You pick the cmdlet, the parameter or the value from a drop-down. Or you drag commands into order.

So you need three skills. Read a cmdlet name. Know which shell runs it. Know which look-alike is the trap.

Tags: EXAM = tested, learn it. SKIM = context, read once. Every question tests EXAM parts only.

The idea that holds the whole page

The noun tells you the product. The verb tells you the action.

Example: Set-RetentionCompliancePolicy. The verb is Set: change something that exists. The noun is RetentionCompliancePolicy: a Purview retention policy.

Most drop-down traps keep the verb and swap the noun. Set-RetentionPolicy looks the same. It is a different product: Exchange messaging records management (MRM).

EXAMThe verbs you meet

Verb	Means	Exam example
Get	Read. Changes nothing.	`Get-RetentionCompliancePolicy`
New	Create a new object.	`New-OMEConfiguration`
Set	Change an object that exists.	`Set-IRMConfiguration`
Remove	Delete an object.	`Remove-OMEConfiguration`
Test	Check that a setup works.	`Test-IRMConfiguration`
Enable	Turn on a feature. Often one time only.	`Enable-ComplianceTagStorage`
Connect / Import	Open a session / load a module.	`Connect-IPPSSession`, `Import-Module`
Start / Install / Update	Run, install or upgrade (scanner).	`Start-Scan`, `Install-Scanner`
Execute	Rare verb. Runs a one-off job.	`Execute-AzureADLabelSync`

Decision rule. The stem says the object "already exists" → Set (or Update). The stem says "create" → New. The stem says "verify" or "find" → Get or Test.

EXAMParameters and values

A parameter starts with a dash. Its value follows it.

Set-Mailbox "Jane Doe" -RetentionHoldEnabled $true
            ^ who      ^ parameter            ^ value

You see	It means
`-Identity "Locked Policy"`	Which object to change. Often you can leave the word `-Identity` out and just give the name.
`$true` / `$false`	Yes / no. Always with a `$`.
`-AzureRMSLicensingEnabled:$True`	Same as `-AzureRMSLicensingEnabled $true`. The colon form is just another way to write it. Case does not matter.
`-UserIds a@x.com,b@x.com`	A list. Commas between values.
`@{Name="Credit Card Number"; minCount="1"}`	A hashtable: name = value pairs in `@{ }`. Used for SIT conditions and advanced settings.
`-AdvancedSettings @{color="#FF0000"}`	A setting that has no box in the portal. Sent as a hashtable.

EXAMVariables, pipeline and files

You see	It means
`$Cred = Get-Credential`	Ask for a user name and password. Keep them in the variable `$Cred`. Then `-Credential $Cred` uses them. Works for accounts without multifactor authentication (MFA).
`$x = Get-Mailbox ...` then `$x.DistinguishedName`	Keep the object. Then read one property from it with a dot.
`Get-IRMConfiguration \| fl AzureRMSLicensingEnabled`	The pipe `\|` sends the output to the next command. `fl` is Format-List: show that property as a list. It changes nothing.
`\| Where-Object { $_.DisplayName -eq "Group.Unified" }`	Keep only the items that match. `$_` is "the current item".
`[System.IO.File]::ReadAllBytes('C:\form.docx')`	Read a file as bytes. Cmdlets with `-FileData` want the bytes, not the path.
`ConvertTo-SecureString 'P@ss' -AsPlainText -Force`	Turn a typed password into the secure type that `-Password` needs.

Check yourself

Which shell runs which cmdlet

Five places. Each cmdlet lives in exactly one.

A drop-down for the connect line is very common. Run the cmdlet in the wrong shell and it is "not recognized". Or worse: it runs and shows a misleading value.

EXAMThe five places

Security & Compliance PowerShell

Connect-IPPSSessionModule: ExchangeOnlineManagementPurview objects: labels, label policies, DLP, retention policies and labels, SITs, audit retention policies, label sync.

Exchange Online PowerShell

Connect-ExchangeOnlineModule: ExchangeOnlineManagementMailboxes and mail: Set-Mailbox, holds, inactive mailboxes, IRM and OME, mail flow rules, turning audit on, audit search.

SharePoint Online Management Shell

Connect-SPOService -Url https://contoso-admin.sharepoint.comModule: Microsoft.Online.SharePoint.PowerShellSet-SPOTenant, Set-SPOSite: labels for files in SharePoint, PDF labels, site labels, Restricted Content Discovery.

Microsoft Graph PowerShell

Connect-MgGraphModule: Microsoft.Graph (Beta cmdlets)Directory settings: EnableMIPLabels for groups.

PurviewInformationProtection

No connect cmdlet. Installed with the Purview Information Protection client on a Windows computer.Set-FileLabel, Get-FileStatus, Set-Authentication, all scanner cmdlets.

Not PowerShell

EdmUploadAgent.exeA command-line tool for Exact Data Match (EDM). Commands start with a slash: /CreateHash.

Sources: Connect to Security & Compliance PowerShell, Connect to Exchange Online PowerShell, Connect-SPOService, Entra group label settings, PurviewInformationProtection module (all in Sources).

EXAMConnect-IPPSSession vs Connect-ExchangeOnline

They overlap but are not interchangeable. Same module. Same sign-in style. Different cmdlets behind them.

Pick Connect-IPPSSession when	Pick Connect-ExchangeOnline when
The noun has Compliance, Label, Dlp or ComplianceTag in it	The noun is Mailbox, InboxRule, TransportRule, OrganizationConfig
`Set-RegulatoryComplianceUI`, `Execute-AzureADLabelSync`	`-IRMConfiguration`, `-OMEConfiguration`, `-OMEMessage`
`New-UnifiedAuditLogRetentionPolicy` (how long audit is kept)	`Set-AdminAuditLogConfig` (turn audit on), `Search-UnifiedAuditLog`

TRAPGet-AdminAuditLogConfig also runs in Security & Compliance PowerShell. There UnifiedAuditLogIngestionEnabled always shows False, even when audit is on. Check and set it in Exchange Online PowerShell.

TRAPOld connect cmdlets in drop-downs: Connect-AadrmService, Connect-AzureAD, Connect-AzureRMAccount. None of them opens Security & Compliance PowerShell.

SKIM Two extras. eDiscovery and auto-labeling simulation need Connect-IPPSSession -EnableSearchOnlySession. Import-Module ExchangeOnlineManagement is often optional, but build-list items keep it as step 1.

Check yourself

Sensitive information types and EDM

Every SIT cmdlet takes a file as bytes. The noun says what the file is.

All in Security & Compliance PowerShell. Exact Data Match (EDM) hashing is the exception: it uses EdmUploadAgent.exe.

EXAMWhich file, which cmdlet

You have	Cmdlet	Key parameters
A form (for example a patent form). You want a document fingerprint.	`New-DlpSensitiveInformationType`	`-FileData` (bytes of the form), `-ThresholdConfig @{low=40;medium=60;high=80}`, `-IsExact`
An XML rule package with your own SITs	`New-DlpSensitiveInformationTypeRulePackage`	`-FileData` (bytes of a Unicode XML file)
A changed version of that rule package	`Set-DlpSensitiveInformationTypeRulePackage`	`-FileData`
A word list for a keyword dictionary	`New-DlpKeywordDictionary`	`-Name`, `-Description`, `-FileData`
A table of real values (EDM)	`EdmUploadAgent.exe`	See B

TRAPNew-Fingerprint and New-DataClassification are the old Exchange Server way to fingerprint. New-DlpFingerprint is an older two-step way in Purview. The current one-step Purview way is New-DlpSensitiveInformationType -FileData.

TRAPFingerprinting does not support the Word template type .dotx. "Template" in the docs means a standard form. Save it as .docx. Also not detected: password-protected files, image-only files, files over 4 MB.

EXAMEDM Upload Agent commands

Command	Does
`/Authorize`	Signs the agent in. The account must be in the EDM_DataUploaders security group.
`/SaveSchema /DataStoreName /OutputDir`	Downloads the schema file.
`/ValidateData /DataFile /Schema`	Checks the table before upload.
`/UploadData`	One computer: hashes and uploads in one run. That computer holds clear text and needs internet.
`/CreateHash /DataFile /HashLocation /Schema`	Two computers, step 1: hash on the secure computer. Gives .EdmHash and .EdmSalt files.
`/UploadHash /DataStoreName /HashFile`	Two computers, step 2: upload the hash from the internet computer.
`/GetDataStore`, `/GetSession`	Check the data store and the upload status.

Pick /UploadData when one computer may hold clear text and reach the internet. Pick /CreateHash then /UploadHash when clear text must never touch an internet computer. The same agent version must be on both computers.

Check yourself

Sensitivity labels, policies and containers

Label = what it does. Label policy = who gets it. Advanced settings = what the portal has no box for.

EXAMLabel cmdlets (Security & Compliance PowerShell)

Cmdlet	Does	Look-alike
`New-Label` / `Set-Label`	Create / change a label. `-AdvancedSettings` for label-level settings (for example `color`, `DefaultSubLabelId`).	`Set-LabelPolicy`
`New-LabelPolicy` / `Set-LabelPolicy`	Publish labels to users. `-AdvancedSettings` for policy-level settings (for example `powerbidefaultlabelid`).	`Set-Label`
`Get-Label \| ft Name, Guid`	List labels and their GUIDs (globally unique identifiers). Other cmdlets want the GUID.	`Get-LabelPolicy`
`New-AutoSensitivityLabelPolicy` + `New-AutoSensitivityLabelRule`	Service-side auto-labeling. The policy holds locations, label and `-Mode`. The rule holds the condition (`-ContentContainsSensitiveInformation`).	`New-DlpComplianceRule`
`Execute-AzureADLabelSync`	Syncs labels to Microsoft Entra ID so groups and sites can use them.	`Set-LabelPolicy`

Pick Set-Label when the setting belongs to the label wherever it is used. Pick Set-LabelPolicy when the setting belongs to a group of users (default label, justification text, Power BI default).

TRAPStarting an auto-labeling simulation from PowerShell needs Connect-IPPSSession -EnableSearchOnlySession. Without it, the simulation can stay "in progress".

EXAMLabels for groups, teams and sites: three shells, one order

Microsoft Graph PowerShellConnect-MgGraph, then set EnableMIPLabels to True in the Group.Unified directory setting. Update-MgBetaDirectorySetting if the setting object exists. New-MgBetaDirectorySetting if it does not.

Security & Compliance PowerShellConnect-IPPSSession, then Execute-AzureADLabelSync. Allow up to 24 hours.

Purview portalCreate labels with the Groups & sites scope and publish them.

ApplyUsers at team creation, admins in the admin centers, or many sites at once with Set-SPOSite -SensitivityLabel <GUID>.

CORRECTIONSome vendor explanations say step 1 is Set-SPOTenant. It is not. Container support is the Graph setting EnableMIPLabels.

EXAMSharePoint switches (SharePoint Online Management Shell)

You need	Command
Labels for Office files in SharePoint and OneDrive (co-authoring, search, eDiscovery on encrypted files)	`Set-SPOTenant -EnableAIPIntegration $true`
Labels for PDF files in SharePoint and OneDrive	`Set-SPOTenant -EnableSensitivityLabelforPDF $true`
A label on one site	`Set-SPOSite -Identity <URL> -SensitivityLabel "<label GUID>"`
Hide one site from Copilot and org-wide search, keep permissions (Restricted Content Discovery)	`Set-SPOSite -Identity <URL> -RestrictContentOrgWideSearch $true`

Docs oddity: the Purview sample for many sites pipes into Set-SPOTenant $_.url -SensitivityLabel. The per-site cmdlet is Set-SPOSite. Both cmdlets list a -SensitivityLabel parameter.

Check yourself

Data loss prevention (DLP)

Policy = where. Rule = what and then what.

No vendor item in the banks tests DLP PowerShell. Learn the split. It is the same split as retention and auto-labeling.

EXAMPolicy and rule

Cmdlet	Holds	Example parameters
`New-DlpCompliancePolicy`	Name, locations, mode	`-ExchangeLocation All`, `-SharePointLocation`, `-OneDriveLocation`, `-Mode Enable`
`New-DlpComplianceRule`	Conditions and actions	`-Policy`, `-ContentContainsSensitiveInformation @{Name="..."; minCount="1"}`, `-BlockAccess $true`, `-NotifyUser`

-Mode value	Means
`Enable`	Policy is on and enforces.
`TestWithNotifications`	Simulation. Users see policy tips.
`TestWithoutNotifications`	Simulation. Users see nothing.
`Disable`	Off.

The cmdlet reference also lists PendingDeletion. The same five values apply to auto-labeling policies.

TRAPNew-DlpPolicy is retired from the cloud service. It works only in on-premises Exchange. Use New-DlpCompliancePolicy and New-DlpComplianceRule.

Check yourself

Retention, records and mailbox holds

Purview retention lives in Security & Compliance PowerShell. Anything on one mailbox lives in Exchange Online PowerShell.

This area has the most bank PowerShell items. Learn it first.

EXAMPurview retention (Security & Compliance PowerShell)

Cmdlet	Does	Look-alike
`New-RetentionCompliancePolicy`	Creates the policy with its locations. Not valid until a rule is added.	`New-RetentionPolicy` (Exchange MRM)
`New-RetentionComplianceRule`	Adds the settings: `-RetentionDuration`, `-RetentionComplianceAction Keep \| Delete \| KeepAndDelete`. One rule per policy.	`New-RetentionCompliancePolicy`
`Set-RetentionCompliancePolicy -Identity "X" -RestrictiveRetention $true`	Preservation Lock. Asks you to confirm with Y.	`Set-RetentionComplianceRule`, `-Enabled`
`Set-RegulatoryComplianceUI -Enabled $true`	Shows "Mark items as a regulatory record" in the label wizard. No prompt. Works at once.	`Set-RetentionCompliancePolicy`
`New-ComplianceTag`	Creates a retention label.	`New-Label` (sensitivity)
`Enable-ComplianceTagStorage`	One-time setup of retention label policy storage.	`New-ComplianceTag`

Preservation Lock: after the lock	Allowed?
Disable or delete the policy	No. Not even a Global Administrator.
Add locations / remove locations	Add yes. Remove no.
Make retention longer / shorter	Longer yes. Shorter no.
Lock a policy with an adaptive scope	Not supported.
Lock a retention label policy	Only if all its labels mark regulatory records.

Two "lock" cmdlets, two jobs. Set-RegulatoryComplianceUI only shows an option in the portal. -RestrictiveRetention $true locks a policy for good.

EXAMMailbox holds (Exchange Online PowerShell)

Three Set-Mailbox switches look alike. They are not interchangeable.

Parameter	Does	Pick it when
`-RetentionHoldEnabled $true`	Pauses MRM retention processing for the mailbox. Nothing is moved or deleted by policy.	A user goes on leave
`-LitigationHoldEnabled $true`	Keeps all content, even items the user deletes. Optional `-LitigationHoldDuration` in days.	Nothing may be lost (legal case, "prevent deletion of all content")
`-RetentionPolicy "Name"`	Assigns an MRM retention policy.	Apply retention tags

-StartDateForRetentionHold and -EndDateForRetentionHold only set dates for a retention hold. They do not turn it on.

EXAMInactive mailboxes: recover vs restore

Recover: New-Mailbox -InactiveMailbox

Turns the inactive mailbox into a new active mailbox for a new or returning user.The inactive mailbox stops existing.

$m = Get-Mailbox -InactiveMailboxOnly -Identity john
New-Mailbox -InactiveMailbox $m.DistinguishedName -Name Julia
 -MicrosoftOnlineServicesID julia@contoso.com
 -Password (ConvertTo-SecureString 'x' -AsPlainText -Force)
 -ResetPasswordOnNextLogon $true

Restore: New-MailboxRestoreRequest

Copies the contents into an existing mailbox.The inactive mailbox is kept.

$m = Get-Mailbox -InactiveMailboxOnly -Identity john
New-MailboxRestoreRequest -SourceMailbox $m.DistinguishedName
 -TargetMailbox julia@contoso.com

If the user account was deleted less than 30 days ago, restore the user account instead. Before a restore, the docs add the inactive mailbox's LegacyExchangeDN to the target as an X500 proxy address.

EXAMRegulatory record: what users can still do

Action	Record (locked)	Regulatory record
Edit contents	Blocked	Blocked
Edit properties, rename	Allowed (tenant setting can block)	Blocked
Delete	Blocked	Blocked
Move within the same site	Allowed	Allowed
Move to another site	Allowed if never unlocked	Blocked
Remove the label	Container admin only	Blocked for everyone

Check yourself

Message encryption: IRM and OME

IRMConfiguration = the engine. OMEConfiguration = the paint.

All in Exchange Online PowerShell. Microsoft Purview Message Encryption was called Office 365 Message Encryption (OME). The cmdlets keep the old names. IRM is Information Rights Management.

EXAMEngine vs paint

They overlap but are not interchangeable.

You need	Command
Check if encryption is on	`Get-IRMConfiguration \| fl AzureRMSLicensingEnabled`
Turn encryption on	`Set-IRMConfiguration -AzureRMSLicensingEnabled $true`
Test it end to end (result PASS)	`Test-IRMConfiguration -Sender admin@contoso.com` (add `-Recipient` to test a recipient)
Show the Encrypt button in Outlook on the web	`Set-IRMConfiguration -SimplifiedClientAccessEnabled $true`
Change the default branding (logo, text, colour)	`Set-OMEConfiguration -Identity "OME Configuration" ...`
Add another branded template	`New-OMEConfiguration -Identity "Legal"` (needs Advanced Message Encryption)
Use a template on mail	Mail flow rule: "Apply custom branding to OME messages". In PowerShell: `New-TransportRule ... -ApplyRightsProtectionCustomizationTemplate "Legal"`

TRAPTest- and Set-M365DataAtRestEncryptionPolicy are Customer Key for data at rest. They have nothing to do with message encryption.

EXAMExpiry and revocation (Advanced Message Encryption)

Feature	Command	Rule to remember
Mail expires	`New-OMEConfiguration -Identity "7 days" -ExternalMailExpiryInDays 7`	Only for external recipients. Not on the default template: make a custom one. Cmdlet reference: 0–730 (0 = never). Branding page: 1–730.
Check a sent message	`Get-OMEMessageStatus -MessageId "<id>"`	Look at `IsRevocable`.
Revoke a sent message	`Set-OMEMessageRevocation -MessageId "<id>" -Revoke $true`	Only mail read in the encrypted message portal (link-based). Not the inline Outlook experience.

Check yourself

Information protection scanner and client

Portal first, then install, then token, then enforce.

These cmdlets run on the Windows computer in the PurviewInformationProtection module. No connect cmdlet. Open PowerShell with Run as Administrator.

EXAMScanner cmdlets

You need	Cmdlet
Install the scanner service and its database	`Install-Scanner -SqlServerInstance SRV\SQLEXPRESS -Cluster Europe` (the cluster must exist in the portal first)
Give the scanner a Microsoft Entra token	`Set-Authentication -AppId -AppSecret -TenantId -DelegatedUser -OnBehalfOf $pscreds`
Make the scan job label files, not only report	`Set-ScannerContentScan -Enforce On` (portal: Enforce sensitivity labeling policy)
Scan all the time	`Set-ScannerContentScan -Schedule Always`
Turn on DLP for on-premises repositories	`Set-ScannerContentScan -EnableDLP On` (+ `-RepositoryOwner`)
Start / stop / check a scan	`Start-Scan`, `Stop-Scan`, `Get-ScanStatus`
Collect diagnostics	`Start-ScannerDiagnostics`
After upgrading the scanner	`Update-ScannerDatabase`
No access to the portal (offline set-up only)	`Set-ScannerConfiguration -OnlineConfiguration Off`, then `Import-ScannerConfiguration`

EXAMClient cmdlets and unattended labeling

Cmdlet	Does
`Set-FileLabel -Path -LabelId`	Applies one label you name.
`Set-FileLabel -Path -AutoLabel`	Applies labels from the label's own conditions.
`Get-FileStatus`	Shows the label and protection on a file.
`Remove-FileLabel`	Removes the label (and with `-RemoveProtection`, the encryption).

Unattended script needs	Why
A Windows account that can sign in interactively	The script runs as this account.
A Microsoft Entra account with a label policy assigned (`-DelegatedUser`)	Downloads the labels.
A Microsoft Entra access token from `Set-Authentication`	Lets the cmdlets run with no prompt.

Set-Authentication run	Token lasts
Without parameters	90 days, or until the password expires
With a registered app (`-AppId`, `-AppSecret`, `-TenantId`)	1 year, 2 years, or never, as set on the app

Check yourself

Audit

Turn on and search in Exchange Online. Keep longer in Security & Compliance.

EXAMAudit cmdlets

You need	Command	Shell
Turn audit on	`Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true` (up to 60 minutes)	Exchange Online
Check audit is on	`Get-AdminAuditLogConfig \| FL UnifiedAuditLogIngestionEnabled`	Exchange Online
Search the audit log	`Search-UnifiedAuditLog -StartDate -EndDate -Operations -UserIds -ResultSize` (max 5000 per call)	Exchange Online
Keep some records longer	`New-UnifiedAuditLogRetentionPolicy -Name -RecordTypes -Operations -UserIds -RetentionDuration -Priority`	Security & Compliance
Mailbox auditing on for the org	`Set-OrganizationConfig -AuditDisabled $false`	Exchange Online

New-UnifiedAuditLogRetentionPolicy	Rule
`-RetentionDuration`	Only ThreeMonths, SixMonths, NineMonths, TwelveMonths, TenYears. Mandatory.
`-Priority`	1 to 10000. Lower number wins. No two policies share a number. Mandatory.
TenYears	Needs the 10-Year Audit Log Retention add-on.

Find who set up forwarding. Search the operation Set-Mailbox. Forwarding is the parameter ForwardingSmtpAddress or DeliverToMailboxAndForward. A user's inbox rule shows as New-InboxRule or Set-InboxRule.

SKIMInsider risk and information barriers

No bank item tests insider risk management PowerShell. Skip it.

Information barriers (IB) are not in the SC-401 skills outline. One vendor item uses Set-UnifiedGroup -InformationBarrierMode Implicit (also Open, OwnerModerated). Know the name. Do not study further.

Check yourself

Review: one table, every cmdlet

Read down the Shell column. If you can say the shell before you look, you are ready.

Cmdlet	Shell	One line
`Connect-IPPSSession`	-	Opens Security & Compliance PowerShell
`Connect-ExchangeOnline`	-	Opens Exchange Online PowerShell
`New-/Set-RetentionCompliancePolicy`	S&C	Purview retention policy; `-RestrictiveRetention $true` = Preservation Lock
`New-RetentionComplianceRule`	S&C	Duration and action of a retention policy
`Set-RegulatoryComplianceUI`	S&C	Shows the regulatory record option
`New-ComplianceTag`	S&C	Creates a retention label
`New-/Set-Label`, `New-/Set-LabelPolicy`	S&C	Sensitivity labels and their publishing
`New-AutoSensitivityLabelPolicy/Rule`	S&C	Service-side auto-labeling
`Execute-AzureADLabelSync`	S&C	Syncs labels to Microsoft Entra ID
`New-DlpCompliancePolicy/Rule`	S&C	DLP policy (where) and rule (what)
`New-DlpSensitiveInformationType -FileData`	S&C	Document fingerprint SIT
`New-/Set-DlpSensitiveInformationTypeRulePackage`	S&C	Upload / update an XML rule package
`New-DlpKeywordDictionary`	S&C	Keyword dictionary from a file
`New-UnifiedAuditLogRetentionPolicy`	S&C	Keep chosen audit records longer
`Get-/Set-/Test-IRMConfiguration`	EXO	Check, turn on, test message encryption
`Get-/Set-/New-OMEConfiguration`	EXO	Branding templates; expiry on custom ones
`Get-OMEMessageStatus`, `Set-OMEMessageRevocation`	EXO	Check and revoke a sent message
`Set-Mailbox -RetentionHoldEnabled / -LitigationHoldEnabled`	EXO	Pause MRM / keep everything
`New-Mailbox -InactiveMailbox`	EXO	Recover an inactive mailbox
`New-MailboxRestoreRequest`	EXO	Copy an inactive mailbox into an existing one
`Set-AdminAuditLogConfig`, `Search-UnifiedAuditLog`	EXO	Turn audit on, search it
`Set-SPOTenant -EnableAIPIntegration`	SPO	Labels for Office files in SharePoint and OneDrive
`Set-SPOSite -SensitivityLabel / -RestrictContentOrgWideSearch`	SPO	Label a site / hide it from Copilot
`Update-/New-MgBetaDirectorySetting`	Graph	EnableMIPLabels for groups
`Install-Scanner`, `Set-ScannerContentScan`, `Start-Scan`	PIP module	Scanner set-up and runs
`Set-Authentication`, `Set-FileLabel`	PIP module	Token; label files from a script
`EdmUploadAgent.exe /CreateHash /UploadHash /UploadData`	Not PowerShell	Hash and upload EDM tables

S&C = Security & Compliance PowerShell. EXO = Exchange Online PowerShell. SPO = SharePoint Online Management Shell. Graph = Microsoft Graph PowerShell. PIP = PurviewInformationProtection.

Your results

Paste the text back in the thread. I grade it, update the ledger and plan the re-tests.

Confidence and caveats

0.85. Every cmdlet, parameter and value was checked on Microsoft Learn on 11 November 2026. Not higher for these reasons.

Most bank PowerShell items are retention and encryption. SIT, DLP, scanner and audit items here are mostly new (PS-*) items written from the docs. They are not checked against real exam wording.
CORRECTION SC401-032: the vendor key B, D, E is wrong. The client PowerShell docs list a Windows account, a Microsoft Entra account and a Microsoft Entra access token. Key here: B, C, E.
CORRECTION SC401-022: the order is right, but the vendor explanation of step 2 is wrong. It is EnableMIPLabels in Microsoft Graph, not Set-SPOTenant.
OME expiry range: the cmdlet reference says 0–730, the branding page says 1–730. An exam item would not hinge on 0.
The Purview audit retention example pairs a "one year" description with TenYears. Trust the cmdlet reference: TwelveMonths = one year.
Not seen in tenant: everything on this page is from docs. The demo tenant was not used for PowerShell.

PowerShell for SC-401: read it, pick it, order it

The idea that holds the whole page

EXAMThe verbs you meet

EXAMParameters and values

EXAMVariables, pipeline and files

Check yourself

Which shell runs which cmdlet

EXAMThe five places

Security & Compliance PowerShell

Exchange Online PowerShell

SharePoint Online Management Shell

Microsoft Graph PowerShell

PurviewInformationProtection

Not PowerShell

EXAMConnect-IPPSSession vs Connect-ExchangeOnline

Check yourself

Sensitive information types and EDM

EXAMWhich file, which cmdlet

EXAMEDM Upload Agent commands

Check yourself

Sensitivity labels, policies and containers

EXAMLabel cmdlets (Security & Compliance PowerShell)

EXAMLabels for groups, teams and sites: three shells, one order

EXAMSharePoint switches (SharePoint Online Management Shell)

Check yourself

Data loss prevention (DLP)

EXAMPolicy and rule

Check yourself

Retention, records and mailbox holds

EXAMPurview retention (Security & Compliance PowerShell)

EXAMMailbox holds (Exchange Online PowerShell)

EXAMInactive mailboxes: recover vs restore

Recover: New-Mailbox -InactiveMailbox

Restore: New-MailboxRestoreRequest

EXAMRegulatory record: what users can still do

Check yourself

Message encryption: IRM and OME

EXAMEngine vs paint

EXAMExpiry and revocation (Advanced Message Encryption)

Check yourself

Information protection scanner and client

EXAMScanner cmdlets

EXAMClient cmdlets and unattended labeling

Check yourself

Audit

EXAMAudit cmdlets

SKIMInsider risk and information barriers

Check yourself

Review: one table, every cmdlet

Your results

Confidence and caveats

Sources (opened 11 November 2026)