Guide
SC-500 vs AZ-500: what changed when Microsoft retired AZ-500
AZ-500 retired on 31 August 2026. See exactly what SC-500 kept, what it added, and what happens to an AZ-500 credential you already hold.
Quick answer
SC-500 or AZ-500: the short version
This isn't really a choice any more. AZ-500 retired on 31 August 2026, so SC-500 is the only cloud-security Associate exam you can currently book. What's worth understanding is what changed, and what an existing AZ-500 credential is still worth.
New to cloud security? Sit SC-500
SC-500 (Microsoft Certified: Cloud and AI Security Engineer Associate) is the current, bookable exam for anyone starting a cloud security career today. It keeps the core Azure security-engineering content AZ-500 tested and adds a full domain of AI-workload security that AZ-500 never covered.
Already hold AZ-500? It stays on your transcript
Passing AZ-500 before its retirement date remains valid — Microsoft does not revoke certifications when the underlying exam retires. What it does mean is that AZ-500 itself can no longer be renewed. See "If you hold AZ-500" below for what that means in practice and how much of your existing knowledge carries straight over.
Both exams lead to a "Microsoft Certified" Associate credential in cloud security; the difference below is entirely about scope and timing, not prestige.
Side by side
SC-500 vs AZ-500 at a glance
AZ-500's figures below describe the exam as it stood before it retired; they're kept here for comparison, not as a live booking option.
| Category | SC-500 | AZ-500 (retired) |
|---|---|---|
| Credential | Microsoft Certified: Cloud and AI Security Engineer Associate | Microsoft Certified: Azure Security Engineer Associate |
| Best for | Anyone starting a cloud-and-AI security career today — the only current bookable option | Historical reference only — credential holders keep it, but it can no longer be booked or renewed |
| Domains | 4: identity, access & governance; storage, databases & networking; compute (incl. AI security); posture management | 4: identity & access; networking; compute, storage & databases; Defender for Cloud & Sentinel |
| Format | 40–60 questions, 100 minutes (120-minute seat) | 40–60 questions, 100 minutes (120-minute seat) |
| Question style | Multiple choice and multi-select scenario questions, often a config snippet or an attack signal to interpret | Multiple choice and multi-select scenario questions, the same config-and-signal format SC-500 inherited |
| Pass score | 700 / 1000 | 700 / 1000 |
| Typical prep time | Four to six weeks with AZ-104-level Azure experience; add time for the AI-security skill group if that's new to you | Four to six weeks with hands-on Azure security experience, while the exam was still active |
| Renewal | Renew annually, free online assessment | Was annual while active — no longer renewable now the exam has retired |
| Skills outline | Outline effective 13 May 2026 | Outline effective 22 January 2026 (final version before retirement) |
Exam fees vary by country. Read the official Microsoft outlines: the SC-500 study guide covers current registration and pricing, and the AZ-500 study guide is kept online as a reference even though the exam itself has retired.
What SC-500 actually tests
What SC-500 actually tests
SC-500 covers the same operational ground AZ-500 did — identity, networking, compute, storage, and Defender for Cloud — and folds AI-workload security into the compute domain rather than treating it as an afterthought.
| Domain | Weight |
|---|---|
| Manage identity, access & governance | 20–25% |
| Secure storage, databases & networking | 25–30% |
| Secure compute | 20–25% |
| Manage & monitor security posture | 20–25% |
- Identity and governance covers Privileged Identity Management, Conditional Access, and Key Vault, alongside Azure Policy and RBAC remediation.
- Storage/databases/networking, the largest domain, is largely continuous with AZ-500's networking and storage material: NSGs, Private Link, Azure Firewall, Defender for Storage and Databases.
- Secure compute diverges hardest from AZ-500: alongside disk encryption, Bastion, and Defender for Servers and Containers, it adds a dedicated AI-security skill group — Entra Agent ID, Defender for AI Services, Foundry guardrails, AI Gateway in API Management, Purview DSPM for Copilot.
- Posture management rolls up Defender CSPM, multicloud connectors, Microsoft Sentinel ingestion, and Microsoft Security Copilot into one domain rather than one oversized 30–35% block.
What AZ-500 tested
What AZ-500 tested (retired 31 August 2026)
Kept here as a reference for anyone comparing what they already studied against SC-500's current outline, not as an active exam guide.
| Domain | Weight |
|---|---|
| Secure identity & access | 15–20% |
| Secure networking | 20–25% |
| Secure compute, storage & databases | 20–25% |
| Secure Azure using Defender for Cloud & Sentinel | 30–35% |
- Identity and access covered role assignments, PIM, Conditional Access, and Microsoft Entra app registrations and managed identities.
- Networking covered NSGs, Virtual Network Manager, Virtual WAN, private access patterns, and Azure Firewall.
- Compute, storage, and databases covered VM and AKS security, storage access control, and Azure SQL protections including Transparent Data Encryption.
- Defender for Cloud and Sentinel, the largest domain by far, covered governance policy, Secure Score remediation, threat protection plans, and hands-on Sentinel configuration including data connectors and analytics rules.
- Three of these four domains map closely onto SC-500's current outline; the fourth is where SC-500 now spends part of its weight on AI security instead.
Prerequisite question
Is there a prerequisite for SC-500?
No formal one. SC-500 doesn't require another certification before you can book it, in the same way AZ-500 never did.
- Microsoft's own guidance recommends practical experience administering Azure and hybrid environments and strong familiarity with Microsoft Entra ID before attempting it.
- Azure Mastery's certification pathing lists AZ-104 as a recommended, not required, lead-in — exactly as it did for AZ-500.
- SC-500 doesn't currently unlock anything further up the security track on its own; Microsoft's published prerequisite guidance for SC-100 (Cybersecurity Architect Expert) doesn't list SC-500 as an accepted route as of this guide's last update — check the official SC-100 requirements directly, since Microsoft updates prerequisite lists independently of exam retirements.
- Deciding whether SC-900 (Security, Compliance, and Identity Fundamentals) is worth sitting first? It's optional conceptual groundwork, exactly as it was for AZ-500, mainly useful if security terminology itself is new to you.
Career value
How SC-500 changes what the credential signals
SC-500 signals everything AZ-500 did, plus a claim AZ-500 never made.
- AZ-500 signalled "Cloud Security Engineer" or "Azure Security Specialist" — someone who could lock down identity, networking, compute, and storage, and run day-to-day operations in Defender for Cloud and Sentinel.
- SC-500 signals that same operational competence, plus the ability to extend those controls to the AI systems now running inside the organisation, from Copilot agents to Foundry-hosted models.
- That AI-security scope is the reason SC-500 exists rather than a straight AZ-500 renewal cycle: "who governs what an AI agent can access" became a real operational question AZ-500's outline had no domain to answer.
- Hiring managers posting "Cloud Security Engineer" or "Cloud and AI Security" roles in 2026 increasingly ask for that AI-specific coverage explicitly.
- Neither guarantees a role or a pay rise; what SC-500 does is keep the credential current and renewable, which AZ-500 can no longer do.
If you hold AZ-500
What happens to an AZ-500 credential you already hold
Your certification stays on your Microsoft transcript exactly as it is.
- Microsoft does not retroactively remove or downgrade a credential because the exam that produced it has since retired — the "Microsoft Certified: Azure Security Engineer Associate" line is permanent proof of what you passed and when.
- What changes is renewal: assessments are no longer available once a certification's exam has retired, so AZ-500 has no ongoing free annual renewal path.
- The entry stays on your transcript as a record, but there's no mechanism left to formally refresh it against a current skills outline.
- The practical route for staying current is SC-500. Three of AZ-500's four domains — identity and access, networking, and compute/storage/databases — map closely onto SC-500's identity, storage/database/networking, and compute domains, so a holder isn't starting from zero.
- The genuinely new material sits in two places: the AI-security skill group inside Secure Compute, and Microsoft Security Copilot inside posture management. Everything else is a change of emphasis and consolidation, not new content to learn from scratch.
Bring AZ-500 knowledge into SC-500 practice
Azure Mastery's SC-500 question bank is mapped to the current outline domain by domain, so you can see exactly which questions cover ground you already know from AZ-500 and which cover the new AI-security material. It has its own on-device Exam IQ readiness score and a full-length exam simulator, and works offline with no account required to start.
Download Azure Mastery — freeFrequently asked
SC-500 vs AZ-500 FAQs
Is AZ-500 still a valid certification?
Yes. If you passed AZ-500 before it retired, the certification stays on your Microsoft transcript. Microsoft does not revoke or downgrade a credential because the exam behind it has retired. What changes is that you can no longer renew it through AZ-500 itself, because renewal assessments stop being offered once an exam retires.
Can I still book the AZ-500 exam?
No. AZ-500 retired on 31 August 2026 and is no longer available to schedule. If you are starting a cloud security career now, SC-500 is the current path; there is no way to sit AZ-500 as a new candidate.
What's actually new in SC-500 that wasn't in AZ-500?
AI security. SC-500's Secure Compute domain adds a full skill group on securing Microsoft Copilot and AI agents: Entra Agent ID conditional access, Defender for AI Services, Foundry guardrails, AI Gateway in API Management, and Purview DSPM for Copilot. None of that existed in AZ-500. SC-500 also adds Security Copilot workspace and plugin management to posture monitoring.
Do I need to retake anything if I already have AZ-500?
There is no requirement to retake anything; your AZ-500 credential remains on your transcript as evidence of what you passed. But because AZ-500 can no longer be renewed, if you want a current, renewable Associate-level cloud security credential going forward, SC-500 is the exam that does that job now.
Is SC-500 harder than AZ-500 was?
They are comparably demanding overall, but the difficulty is distributed differently. AZ-500 concentrated 30 to 35% of its weight in Defender for Cloud and Sentinel, including hands-on KQL query writing. SC-500 spreads that content more evenly across four domains and trades some Sentinel depth for breadth into AI-specific security controls — unfamiliar territory for most administrators moving across from AZ-500.
Does SC-500 count as a prerequisite for SC-100?
Not currently. Microsoft's published prerequisite guidance for SC-100 (Cybersecurity Architect Expert) does not list SC-500 as an accepted route as of this guide's last update. Check the official SC-100 requirements before assuming SC-500 alone will satisfy them.
Ready to start on SC-500?
Practise with the SC-500 question bank in Azure Mastery, with an on-device readiness score, an adaptive study plan, and a full-length simulator. Free to start, works offline.
Download Azure Mastery — free iPhone & iPad · Free to start · No account required