TL;DR: Microsoft retired AZ-500 (Azure Security Engineer Associate) on August 31, 2026, and the current exam for this role is SC-500, which leads to Microsoft Certified: Cloud and AI Security Engineer Associate. SC-500 keeps the Azure security core (identity, storage, databases, networking, compute, posture) and adds AI security: Entra Agent ID, Copilot Studio agent protection, Foundry guardrails, AI Gateway in API Management and Defender for AI. Microsoft’s pages give 120 minutes and a 700 passing score, and list no formal prerequisites. They do not state a price or question count on the pages we read. Third-party sites report US$165. If you hold AZ-500, nothing in the sources we read gives you a bridge exam or discount: the credential stays on your transcript until it expires, it can no longer be renewed, and getting the new credential means passing SC-500. If you are starting now, skip AZ-500 entirely and study SC-500.
Quick Facts
| Item | SC-500 | AZ-500 |
| Credential | Microsoft Certified: Cloud and AI Security Engineer Associate | Microsoft Certified: Azure Security Engineer Associate |
| Exam name | Implementing End-to-End Security Controls for Cloud and AI Workloads | Not covered by the pages we read |
| Status on October 21, 2026 | Current | Retired August 31, 2026 (51 days ago) |
| Level | Intermediate | Associate |
| Duration | 120 minutes (Microsoft’s certification page) | Conflicting third-party figures, see below |
| Passing score | 700 or greater (Microsoft’s study guide) | 700 reported |
| Exam price | Not stated by Microsoft; US$165 reported by third parties, varies by country | Not applicable |
| Question count | Not published | Not applicable |
| Prerequisites | None formal. Microsoft expects practical Azure and hybrid administration, strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration | Not applicable |
| Domains | Four: identity, access and governance 20 to 25%; storage, databases and networking 25 to 30%; compute 20 to 25%; posture and monitoring 20 to 25% | Not verified |
| Languages | English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Italian, Portuguese (Brazil), Spanish | Not applicable |
| Retake | 24 hours after the first attempt; later waits vary (Microsoft) | Not applicable |
| Practice assessment | Not available when we read Microsoft’s page | Not applicable |
| Salary figures | Omitted: no source separates SC-500 holders from the wider security workforce | Omitted |
Timeline: From Beta to Retirement
| Date | Event | Source type |
| May 13, 2026 | “Last updated” date in the body of Microsoft’s SC-500 study guide (page metadata shows other dates) | Microsoft |
| May 14, 2026 | Microsoft Skills Hub post announces the new certification and the SC-500 beta | Microsoft (title and description only readable) |
| May 15, 2026 | SC-500 beta begins | Reported (Training Camp, Vlad Talks Tech) |
| July 21, 2026 | SC-500 reaches general availability, 67 days after the beta start | Reported (Training Camp) |
| July 24, 2026 | Microsoft Learn exam page updated and beta label removed | Reported (Open Exam Prep) |
| August 31, 2026 | AZ-500 and the Azure Security Engineer Associate certification retire | Microsoft’s retired-exams page |
| October 21, 2026 | 51 days after the AZ-500 retirement, 92 days after reported GA | Our count |
Two things to note. First, the GA date of July 21 and the beta label removal on July 24 come from different third-party sites and are close but not identical, so we treat “late July” as the safe statement. Second, Microsoft’s study guide shows a body date of May 13, 2026, while its page metadata shows April 26 and July 31, and the page does not say which one is the effective date. Check the study guide’s current version before you build a plan on the percentages.
What Changed From AZ-500
Microsoft has not published a side-by-side comparison in the pages we could read. What follows is what Microsoft’s SC-500 study guide contains, plus what third-party guides say was added. The guides do not agree on how much changed.
What the SC-500 guide adds
The study guide places a new block called “Implement security for AI” under the compute domain. It lists 11 topics:
- Identify overexposure of data in SharePoint
- Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management
- Enable and configure real-time protection for Microsoft Copilot Studio agents
- Implement conditional access for Microsoft Entra Agent ID
- Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR
- Manage Entra Agent ID access
- Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry
- Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud
- Configure guardrails for agent security in Foundry
- Monitor AI security by using the Data and AI security dashboard in Defender for Cloud
- Manage agents in the Microsoft 365 admin center
The posture domain also lists a new Microsoft Security Copilot block (configure workspaces, manage permissions and roles, enable plugins, and enable Microsoft agents and Security Store agents), and connecting Amazon Web Services and Google Cloud Platform environments to Defender for Cloud. Third-party guides describe these as additions, and one says Security Copilot administration appears on a Microsoft certification for the first time. We could not confirm “first time” from Microsoft.
What carried over
The rest of the guide reads like the Azure security role most candidates already know:
- Privileged Identity Management, conditional access, MFA and passwordless authentication, managed identities and Key Vault
- Azure Policy, Defender for Cloud compliance, resource locks and RBAC
- Storage firewall rules, Defender for Storage, Azure SQL security and auditing
- Network security groups, Azure Firewall, private endpoints, Private Link, Virtual WAN and VPN
- Disk encryption, Bastion, just-in-time VM access, Defender for Servers and Azure Arc
- Defender for Containers, AKS, Container Registry, Functions, Logic Apps, App Service and Web Application Firewall
- Microsoft Sentinel data collection, connectors, automation rules and playbooks
Microsoft does not mark which of these were on the old AZ-500, so we do not claim a percentage overlap. One vendor guesses a strong AZ-500 background covers “roughly three quarters” of SC-500, with no source. Treat that as a guess.
The Four Domains in Detail
| Domain | Weight | What it tests | Where candidates struggle |
| Manage identity, access and governance | 20 to 25% | Entra ID (PIM, conditional access, MFA, app identities, OAuth consent, managed identities), Key Vault, Azure Policy, RBAC, locks, backup protection, infrastructure as code controls | Telling apart Azure roles from Entra roles, and knowing which tool evaluates overprivileged access |
| Secure storage, databases and networking | 25 to 30% | Storage accounts, Azure SQL, Defender for Databases, NSGs and ASGs, Virtual Network Manager, Virtual WAN, VPN, Entra Private Access, private endpoints, Private Link, Azure Firewall, Network Watcher | Choosing between private endpoints, service endpoints and firewall rules |
| Secure compute | 20 to 25% | AI security (11 topics), servers and VMs, containers, Functions, Logic Apps, App Service, WAF, API Management | The AI block is brand new to most candidates, and the container topics are wide |
| Manage and monitor security posture | 20 to 25% | Defender CSPM, compliance frameworks, workload protection plans, AWS and GCP connectors, Defender Vulnerability Management, EASM, Sentinel, Purview Audit queries, Security Copilot | Sentinel configuration detail and knowing which Defender plan covers what |
Microsoft gives only ranges, not exact weights per topic. It also says the bullets illustrate how skills are assessed and that related topics may be covered, so do not treat the lists as a full syllabus.
Microsoft states that most questions cover generally available features, and the exam may include preview features if they are commonly used.
If You Hold AZ-500
This is the situation most readers searched for. Here is what the sources say.
| Question | What we found | Source |
| When did AZ-500 retire? | August 31, 2026 | Microsoft’s retired-exams page |
| Can I still take or renew it? | No. The exam and its renewal assessment retired together | Training Camp, Readynez (vendor) |
| Does my credential disappear? | It stays on your Microsoft Learn profile until it expires, then moves to historical certifications | Training Camp (vendor) |
| How long does it stay valid? | One year after your last pass or renewal, according to one guide | Vlad Talks Tech (MVP blog) |
| Is there an upgrade exam or discount? | None found. Several guides say there is no automatic transition, free upgrade, voucher or discount | Training Camp, Readynez, Vlad Talks Tech (vendor and MVP) |
| Do I need SC-500 for anything? | Only if you want the new credential or need an active associate-level security credential | Our reading |
| Does AZ-500 still count as a prerequisite for expert certifications? | Microsoft’s FAQ reportedly says retiring certifications used as prerequisites will be updated. We could not confirm details for AZ-500 | Vlad Talks Tech citing Microsoft |
A practical decision table
| You are | What to do |
| Holding AZ-500, expiry more than 6 months away | Plan SC-500 before expiry. You cannot renew, so the expiry date is your deadline |
| Holding AZ-500, expiry soon | Check your expiry date on your Microsoft Learn profile now. Booking SC-500 before it lapses keeps you continuous |
| Lapsed AZ-500 | You are in the same position as a new candidate. SC-500 is the only path |
| Mid-study for AZ-500 | Stop. AZ-500 material alone no longer matches the exam. Switch to the SC-500 guide and add the AI topics |
| Holding SC-200 or SC-300 | Your credential is a different role. SC-500 is an Azure and AI engineering path, not an upgrade of those |
| Starting from zero | Read the Microsoft expectation (Azure and hybrid administration, Entra ID, Microsoft 365) and decide whether you need a foundation first |
Because Microsoft does not publish a bridge, the cost to move is a full exam fee. Third-party sites say US$165 in the United States, and we could not confirm that on Microsoft’s page.
Cost and Logistics
| Item | Detail | Source |
| Price | “Based on the country or region in which the exam is proctored” | Microsoft |
| US price | US$165 | Reported by three third-party sites |
| Delivery | Proctored through Pearson VUE, online or test center | Microsoft’s certification page and Open Exam Prep |
| Interactive components | The exam may include them | Microsoft |
| Account | Microsoft recommends registering with a personal Microsoft account rather than an organizational one | Microsoft |
| Extra time | If the exam is not in your language, you can request an extra 30 minutes | Microsoft’s study guide |
| Retake policy | 24 hours after the first attempt; later waits vary. One third-party guide says 14 days between later attempts and a maximum of five attempts in 12 months | Microsoft for the first point; third party for the rest |
| Renewal | Third-party guides say annual and free through an online assessment. Microsoft’s SC-500 pages we read do not describe it | Reported |
| Sandbox | Exam sandbox available | Microsoft |
| Practice assessment | Not available when we read the page. Microsoft says practice assessments are usually available within 8 weeks after an exam is out of beta | Microsoft |
For how Microsoft renewal works in general, see our guide on whether Microsoft certifications expire.
We checked one number. The practice assessment normally appears within eight weeks of general availability, and reported GA was July 21. That is 92 days ago, so the timeline has passed and the practice assessment is overdue by Microsoft’s own usual standard. Check Microsoft’s page again before you rely on it.
Where Sources Disagree
| Question | Version A | Version B | Our read |
| AZ-500 duration | One guide says 100 minutes | Another says both exams are 120 minutes | Unverified. It does not affect SC-500’s 120 minutes, which Microsoft states |
| Question count | One site gives a 40 to 60 planning range | The same site says Microsoft does not publish SC-500’s count | No published count |
| GA date | July 21, 2026 (Training Camp) | Beta label removed July 24 (Open Exam Prep) | Late July |
| Domain weight shift | One guide says the largest area moved from Defender and Sentinel (30 to 35%) to storage, databases and networking | The same guide says Defender and Sentinel now carry 20 to 25%, and cites no source for the old weights | Internally inconsistent. We do not quote old weights |
| Overlap with AZ-500 | “Roughly three quarters” (one vendor, no source) | No other source gives a number | Unknown |
| Renewal window | “Six months before expiry” (one guide) | Microsoft’s SC-500 pages do not say | Check your own profile |
| Cybersecurity Architect Expert prerequisite | One page says SC-500 qualifies | No Microsoft source quoted | Unverified. Check Microsoft’s current requirements |
| Whether Microsoft changed the role because it stopped being Azure-only | Stated by a vendor as fact | No Microsoft statement found | Opinion |
We also found no salary data that isolates SC-500 holders, and one guide that compares salary uses figures for a different exam.
How to Study for SC-500
Our approach is built around Microsoft’s four domains and the biggest new block.
- Read the study guide first. Print the four domains and mark each bullet as known, partly known or unknown. That becomes your plan.
- Start with the AI block if you came from AZ-500. It is the least familiar and sits under the compute domain. Learn what Entra Agent ID is before the conditional access items.
- Give networking time. Storage, databases and networking carry up to 30%, the heaviest range. Private endpoints versus Private Link versus firewall rules show up in many scenarios.
- Do the labs. Microsoft says the exam may include interactive components, and the role is hands-on. Build a small tenant, enable Defender for Cloud plans and connect a Sentinel workspace.
- Cover the posture domain with real data. Connect an AWS or GCP account to Defender for Cloud if you can, since the guide names both.
- Use the sandbox. Microsoft’s exam sandbox lets you practice the interface.
- Check practice sources for the right exam. Anything labeled AZ-500 predates the AI content.
A sample plan assuming a working Azure background:
| Weeks | Focus |
| 1 to 2 | Identity, access and governance, plus Key Vault and Azure Policy |
| 3 to 4 | Storage, databases and networking, with labs |
| 5 to 6 | Compute, including the 11 AI topics and containers |
| 7 | Posture, Defender for Cloud and Sentinel |
| 8 | Timed practice, weak-area review and sandbox |
If you are earlier in your Azure journey, our AZ-104 exam page covers the administrator foundation Microsoft expects, and the AZ-802 exam page covers the Windows Server path that replaced AZ-800 and AZ-801. Practice material for this exam is on our SC-500 exam page, and the older AZ-500 page is for reference only now that the exam is retired.
Where SC-500 Fits Among Microsoft Security Credentials
| Credential | Focus | Compared with SC-500 |
| SC-500 | Cloud and AI security engineering across Azure | Implements controls in cloud and AI workloads |
| SC-200 | Security operations | Works inside Defender and Sentinel on detection and response |
| SC-300 | Identity and access administration | Focuses on Entra ID and identity governance |
All three touch Entra, Defender and Sentinel, but they sit in different roles. SC-500 is the engineering role. SC-200 is the analyst role. SC-300 is the identity role. We have not confirmed how Microsoft maps these into expert-level prerequisites, so check Microsoft’s current expert certification pages before you plan a ladder.
For vendor-neutral options and how they compare, see our best cybersecurity certifications guide and the overview of cybersecurity certification exams for audit and compliance.
FAQS
Is AZ-500 retired?
Yes. Microsoft’s retired-exams page lists AZ-500, Microsoft Certified: Azure Security Engineer Associate, as retiring August 31, 2026.
What replaces AZ-500?
SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads, which awards Microsoft Certified: Cloud and AI Security Engineer Associate. Microsoft’s pages we read do not use the word “replaces,” but third-party guides and Microsoft’s own retirement timing line up.
How long is the SC-500 exam and what is the passing score?
120 minutes per Microsoft’s certification page, and 700 or greater to pass per the study guide.
How much does SC-500 cost?
Microsoft says the price is based on your country or region. Three third-party sites report US$165 for the United States. Confirm at registration.
How many questions are on SC-500?
Microsoft does not publish it on the pages we read. One site gives a planning range of 40 to 60, which it says is general guidance, not SC-500-specific.
Are there prerequisites for SC-500?
No formal prerequisites. Microsoft expects practical experience with Azure and hybrid environments, strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration.
Can I still renew AZ-500?
No, according to third-party guides. The exam and its renewal assessment retired together on August 31, 2026. Your credential stays on your profile until it expires.
Do I get a discount or upgrade exam as an AZ-500 holder?
We found none. Several guides say there is no automatic transition, free upgrade, voucher or discount.
What AI topics are on SC-500?
Microsoft lists 11, including Entra Agent ID, Copilot Studio agent protection, Foundry guardrails, AI Gateway in API Management, Defender for AI Service and the Data and AI security dashboard in Defender for Cloud.
Does SC-500 cover AWS and Google Cloud?
The posture domain mentions connecting AWS and GCP environments to Defender for Cloud. SC-500 is an Azure-focused exam, so expect connector and monitoring tasks, not deep AWS or GCP administration.
Is SC-500 harder than AZ-500?
No source measures it. Vendors say it is wider rather than deeper, and that Azure-only engineers find the AI and multicloud topics hardest. That is opinion, not data.
How does SC-500 differ from SC-200 and SC-300?
SC-500 is for engineers who implement security controls across cloud and AI workloads. SC-200 is for security operations analysts, and SC-300 is for identity and access administrators.
