Guide
SC-500 vs AZ-500: what changed when Microsoft retired AZ-500
AZ-500 retired on 31 August 2026. See exactly what SC-500 kept, what it added, and what happens to an AZ-500 credential you already hold.
Quick answer
SC-500 or AZ-500: the short version
This isn't really a choice any more. AZ-500 retired on 31 August 2026, so SC-500 is the only cloud-security Associate exam you can currently book. What's worth understanding is what changed, and what an existing AZ-500 credential is still worth.
New to cloud security? Sit SC-500
SC-500 (Microsoft Certified: Cloud and AI Security Engineer Associate) is the current, bookable exam for anyone starting a cloud security career today. It keeps the core Azure security-engineering content AZ-500 tested and adds a full domain of AI-workload security that AZ-500 never covered.
Already hold AZ-500? It stays on your transcript
An Azure Security Engineer Associate credential earned before retirement remains active until its existing expiration date, then stays on your transcript as historical evidence. What it does mean is that AZ-500 itself can no longer be renewed. See "If you hold AZ-500" below for what that means in practice and how much of your existing knowledge carries straight over.
Both exams lead to a "Microsoft Certified" Associate credential in cloud security; the difference below is entirely about scope and timing, not prestige.
Side by side
SC-500 vs AZ-500 at a glance
AZ-500's figures below describe the exam as it stood before it retired; they're kept here for comparison, not as a live booking option.
| Category | SC-500 | AZ-500 (retired) |
|---|---|---|
| Credential | Microsoft Certified: Cloud and AI Security Engineer Associate | Microsoft Certified: Azure Security Engineer Associate |
| Best for | Anyone starting a cloud-and-AI security career today — the only current bookable option | Historical reference only — credential holders keep it, but it can no longer be booked or renewed |
| Domains | 4: identity, access & governance; storage, databases & networking; compute (incl. AI security); posture management | 4: identity & access; networking; compute, storage & databases; Defender for Cloud & Sentinel |
| Format | 40–60 questions, 120 minutes | Typically 40–60 questions, 100 minutes; confirm booking time |
| Question style | Multiple choice and multi-select scenario questions, often a config snippet or an attack signal to interpret | Multiple choice and multi-select scenario questions, the same config-and-signal format SC-500 inherited |
| Pass score | 700 / 1000 | 700 / 1000 |
| Typical prep time | Four to six weeks with AZ-104-level Azure experience; add time for the AI-security skill group if that's new to you | Four to six weeks with hands-on Azure security experience, while the exam was still active |
| Renewal | Renew annually, free online assessment | Was annual while active — no longer renewable now the exam has retired |
| Skills outline | Outline effective 13 May 2026 | Outline effective 22 January 2026 (final version before retirement) |
Exam fees vary by country. Read the official Microsoft outlines: the SC-500 study guide covers current registration and pricing, and the AZ-500 study guide is kept online as a reference even though the exam itself has retired.
What SC-500 actually tests
What SC-500 actually tests
SC-500 covers the same operational ground AZ-500 did — identity, networking, compute, storage, and Defender for Cloud — and folds AI-workload security into the compute domain rather than treating it as an afterthought.
| Domain | Weight |
|---|---|
| Manage identity, access & governance | 20–25% |
| Secure storage, databases & networking | 25–30% |
| Secure compute | 20–25% |
| Manage & monitor security posture | 20–25% |
- Identity and governance covers Privileged Identity Management, Conditional Access, and Key Vault, alongside Azure Policy and RBAC remediation.
- Storage/databases/networking, the largest domain, is largely continuous with AZ-500's networking and storage material: NSGs, Private Link, Azure Firewall, Defender for Storage and Databases.
- Secure compute diverges hardest from AZ-500: alongside disk encryption, Bastion, and Defender for Servers and Containers, it adds a dedicated AI-security skill group — Entra Agent ID, Defender for AI Services, Foundry guardrails, AI Gateway in API Management, Purview DSPM for Copilot.
- Posture management rolls up Defender CSPM, multicloud connectors, Microsoft Sentinel ingestion, and Microsoft Security Copilot into one domain rather than one oversized 30–35% block.
What AZ-500 tested
What AZ-500 tested (retired 31 August 2026)
Kept here as a reference for anyone comparing what they already studied against SC-500's current outline, not as an active exam guide.
| Domain | Weight |
|---|---|
| Secure identity & access | 15–20% |
| Secure networking | 20–25% |
| Secure compute, storage & databases | 20–25% |
| Secure Azure using Defender for Cloud & Sentinel | 30–35% |
- Identity and access covered role assignments, PIM, Conditional Access, and Microsoft Entra app registrations and managed identities.
- Networking covered NSGs, Virtual Network Manager, Virtual WAN, private access patterns, and Azure Firewall.
- Compute, storage, and databases covered VM and AKS security, storage access control, and Azure SQL protections including Transparent Data Encryption.
- Defender for Cloud and Sentinel, the largest domain by far, covered governance policy, Secure Score remediation, threat protection plans, and hands-on Sentinel configuration including data connectors and analytics rules.
- Three of these four domains map closely onto SC-500's current outline; the fourth is where SC-500 now spends part of its weight on AI security instead.
Prerequisite question
Is there a prerequisite for SC-500?
No formal one. SC-500 doesn't require another certification before you can book it, in the same way AZ-500 never did.
- Microsoft's own guidance recommends practical experience administering Azure and hybrid environments and strong familiarity with Microsoft Entra ID before attempting it.
- Azure Mastery's certification pathing lists AZ-104 as a recommended, not required, lead-in — exactly as it did for AZ-500.
- SC-500 is one of three qualifying Associate certifications for SC-100, alongside SC-200 or SC-300. Hold an active qualifying credential and pass SC-100 to earn Cybersecurity Architect Expert; see Microsoft's current requirements.
- Deciding whether SC-900 (Security, Compliance, and Identity Fundamentals) is worth sitting first? It's optional conceptual groundwork, exactly as it was for AZ-500, mainly useful if security terminology itself is new to you.
Career value
How SC-500 changes what the credential signals
SC-500 signals everything AZ-500 did, plus a claim AZ-500 never made.
- AZ-500 signalled "Cloud Security Engineer" or "Azure Security Specialist" — someone who could lock down identity, networking, compute, and storage, and run day-to-day operations in Defender for Cloud and Sentinel.
- SC-500 signals that same operational competence, plus the ability to extend those controls to the AI systems now running inside the organisation, from Copilot agents to Foundry-hosted models.
- That AI-security scope is the reason SC-500 exists rather than a straight AZ-500 renewal cycle: "who governs what an AI agent can access" became a real operational question AZ-500's outline had no domain to answer.
- Hiring managers posting "Cloud Security Engineer" or "Cloud and AI Security" roles in 2026 increasingly ask for that AI-specific coverage explicitly.
- Neither guarantees a role or a pay rise; what SC-500 does is keep the credential current and renewable, which AZ-500 can no longer do.
If you hold AZ-500
What happens to an AZ-500 credential you already hold
Your certification stays on your Microsoft transcript exactly as it is.
- Microsoft does not retroactively remove or downgrade a credential because the exam that produced it has since retired — the "Microsoft Certified: Azure Security Engineer Associate" line is permanent proof of what you passed and when.
- What changes is renewal: Azure Security Engineer Associate itself retired on 31 August 2026; check your Microsoft Learn profile for any final renewal deadline and the credential's expiration date.
- The entry stays on your transcript as a record, but there's no mechanism left to formally refresh it against a current skills outline.
- The practical route for staying current is SC-500. Three of AZ-500's four domains — identity and access, networking, and compute/storage/databases — map closely onto SC-500's identity, storage/database/networking, and compute domains, so a holder isn't starting from zero.
- The genuinely new material sits in two places: the AI-security skill group inside Secure Compute, and Microsoft Security Copilot inside posture management. Everything else is a change of emphasis and consolidation, not new content to learn from scratch.
Bring AZ-500 knowledge into SC-500 practice
Azure Mastery's SC-500 question bank is mapped to the current outline domain by domain, so you can see exactly which questions cover ground you already know from AZ-500 and which cover the new AI-security material. It has its own on-device Exam IQ readiness score and a full-length exam simulator, and works offline with no account required to start.
Download Azure Mastery — freeFrequently asked
SC-500 vs AZ-500 FAQs
Is AZ-500 still a valid certification?
Yes. If you passed AZ-500 before it retired, the certification remains active until its existing expiration date, then becomes a historical entry on your Microsoft transcript. Retiring an exam does not erase an earned credential or extend its expiration date. What changes is that you can no longer renew it through AZ-500 itself, because renewal eligibility is governed by certification retirement and the renewal deadline shown in your Microsoft Learn profile.
Can I still book the AZ-500 exam?
No. AZ-500 retired on 31 August 2026 and is no longer available to schedule. If you are starting a cloud security career now, SC-500 is the current path; there is no way to sit AZ-500 as a new candidate.
What's actually new in SC-500 that wasn't in AZ-500?
AI security. SC-500's Secure Compute domain adds a full skill group on securing Microsoft Copilot and AI agents: Entra Agent ID conditional access, Defender for AI Services, Foundry guardrails, AI Gateway in API Management, and Purview DSPM for Copilot. None of that existed in AZ-500. SC-500 also adds Security Copilot workspace and plugin management to posture monitoring.
Do I need to retake anything if I already have AZ-500?
There is no requirement to retake anything; your AZ-500 credential remains on your transcript, active until its existing expiration date and historical after that. But because AZ-500 can no longer be renewed, if you want a current, renewable Associate-level cloud security credential going forward, SC-500 is the exam that does that job now.
Is SC-500 harder than AZ-500 was?
They are comparably demanding overall, but the difficulty is distributed differently. AZ-500 concentrated 30 to 35% of its weight in Defender for Cloud and Sentinel, including hands-on KQL query writing. SC-500 spreads that content more evenly across four domains and trades some Sentinel depth for breadth into AI-specific security controls — unfamiliar territory for most administrators moving across from AZ-500.
Does SC-500 count as a prerequisite for SC-100?
Yes. Microsoft's current Cybersecurity Architect Expert requirements accept an active Cloud and AI Security Engineer Associate credential (SC-500), or SC-200 or SC-300, alongside passing SC-100.
Ready to start on SC-500?
Practise with the SC-500 question bank in Azure Mastery, with an on-device readiness score, an adaptive study plan, and a full-length simulator. Free to start, works offline.
Download Azure Mastery — free iPhone & iPad · Free to start · No account required