If you were planning AZ-500 prep, change course: Microsoft retired Exam AZ-500 on August 31, 2026, at 11:59 PM Central Standard Time, and the Azure Security Engineer Associate credential can no longer be earned or renewed. The replacement is Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, and passing it earns the Microsoft Certified: Cloud and AI Security Engineer Associate certification. Effective SC-500 prep starts from the published blueprint rather than recycled AZ-500 material, because the new exam adds a full AI-security dimension the old exam never tested.
SC-500 has left beta and is bookable through Pearson VUE at full price. Most of the Azure security body of knowledge transfers, but the new exam is longer than AZ-500, reaches into Microsoft 365 as well as Azure, and weights its four domains differently. Here is what the official study guide says, how the format compares, and a week-by-week plan that reuses the Azure security knowledge you already have.
What changed when AZ-500 retired
The retirement closed two doors at once: the exam itself and the free annual renewal assessment that kept the credential active. Anyone whose Azure Security Engineer Associate expiration fell after the retirement date has no renewal path left. There is no transition exam, no equivalency credit for existing AZ-500 holders, and no discounted upgrade; the only forward route to a current Microsoft security-engineer credential is SC-500 at full price.
SC-500 opened as a beta with a deep discount aimed at early takers: Microsoft offered the first 300 beta candidates 80% off Exam SC-500 for sittings on or before June 8, 2026. That window has closed, so budget the standard exam fee instead of hunting for voucher codes. The exam is now generally available, is scored like any live Microsoft role-based exam, and follows the standard free renewal assessment on Microsoft Learn cycle that associate certifications use.
The SC-500 blueprint
Four functional domains carry the exam, and unlike AZ-500, no single domain dominates. The published blueprint splits the exam into four weighted domains: Manage identity, access, and governance (20–25%), Secure storage, databases, and networking (25–30%), Secure compute (20–25%), and Manage and monitor security posture (20–25%). Storage, databases, and networking is the heaviest area, so allocate study time accordingly instead of defaulting to the Defender-heavy routine AZ-500 candidates used.
| Domain | Weight | Core skills |
|---|---|---|
| Manage identity, access, and governance | 20–25% | Entra ID, Key Vault, role assignments, governance |
| Secure storage, databases, and networking | 25–30% | Storage controls, Azure SQL, network security |
| Secure compute | 20–25% | Servers, VMs, containers, AI workload security |
| Manage and monitor security posture | 20–25% | Defender for Cloud, Sentinel, Security Copilot |
The biggest novelty sits inside Secure compute: securing AI solutions. The study guide names SharePoint data overexposure, risks in Microsoft Copilot and AI apps identified with Purview Data Security Posture Management, real-time protection for Copilot Studio agents, Conditional Access for Microsoft Entra Agent ID, blast-radius analysis in Defender XDR, an AI Gateway in Azure API Management for Microsoft Foundry, and Defender for AI Service. If your day job has not touched these tools yet, this is where most of your new study hours belong.
Exam format, cost, retakes
You have 120 minutes to complete the SC-500 assessment, twenty minutes more than AZ-500 allowed, which reflects the wider scope. The bar on scoring is unchanged: a scaled score of 700 or greater is required to pass. The exam is proctored through Pearson VUE, online or at a test center, currently in English only, and priced at $165 USD in the United States with regional variation. If English is not your preferred language and the exam has not been localized yet, Microsoft grants an additional 30 minutes on request. If you fail, the retake policy lets you sit again 24 hours after the first attempt, with longer waits for subsequent attempts. The credential stays valid for one year and renews free online.
A six-week study plan
- Week 1 — Identity and governance: work through the Entra ID and Key Vault learning paths; drill role assignments, Privileged Identity Management, and Conditional Access until configuration is muscle memory.
- Week 2 — Storage and data: lock down storage accounts, Azure SQL auditing, dynamic data masking, and Transparent Data Encryption; this domain carries the top weight on the exam.
- Week 3 — Networking: network security groups, Private Endpoints, Private Link, firewall policies, and Web Application Firewall placement; diagram each scenario before configuring it.
- Week 4 — Compute: Azure Bastion and just-in-time VM access, AKS network isolation, container registry hardening, and the disk encryption options.
- Week 5 — AI security: Purview DSPM for AI, Entra Agent ID, Defender for AI Service, and AI Gateway; this week is the differentiator on exam day.
- Week 6 — Posture and operations: Defender for Cloud secure score, Sentinel analytics rules, and Security Copilot; finish with timed practice sets and apply how a fixed pass mark should shape your practice routine.
Treat the official Microsoft Learn course SC-500T00 as the spine of the plan: its learning paths map directly to the four domains, and every module ends with checkpoints you can use as progress gates before moving on.
What carries over
Most AZ-500-era Azure security knowledge remains examinable: Entra ID, Key Vault, network security groups, Private Endpoints, storage controls, Azure SQL protections, and Defender for Cloud posture management all reappear under the new blueprint. What does not carry over is the scope: AZ-500 lived almost entirely inside Azure, while SC-500 assumes familiarity with Microsoft 365 administration on top of Azure and hybrid experience. If you are earlier in your security career, sequencing matters more than speed, so compare entry-level cybersecurity certifications first and build toward the associate level instead of sprinting into an AI-heavy blueprint unprepared.
The strategic read: AZ-500 holders should not mourn a credential they cannot renew but should bank the transferable syllabus and add the AI and Microsoft 365 layers SC-500 demands. Newcomers should finish Azure administration fundamentals first, then commit to the six-week plan above. Either way, the exam number changed; the work of securing identity, data, networks, and operations did not.
Sources
- Study guide for Exam AZ-500: Microsoft Azure Security Technologies — Microsoft Learn
- Study guide for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads — Microsoft Learn
- Microsoft Certified: Cloud and AI Security Engineer Associate — Microsoft Learn
- Exam SC-500 beta announcement — Microsoft Community Hub