If you started building an AZ-500 prep plan for 2026, the ground shifted under you. Microsoft retired the Azure Security Engineer Associate certification and its renewal assessments on August 31, 2026, and no new candidate can earn the credential after that date. The underlying skills did not vanish, and neither did the demand for people who hold them. Microsoft folded the Azure security engineering body of knowledge into a wider credential, the Cloud and AI Security Engineer Associate, delivered through exam SC-500. This SC-500 prep guide lays out what changed, what the new exam expects, how the two tracks compare, and how to organize your study weeks so the transition costs you as little momentum as possible.
Why AZ-500 disappeared
The retirement is part of a portfolio reshuffle, not a verdict that Azure security skills matter less. As Microsoft rolled out a wave of certifications aimed at AI-era roles, it retired a batch of existing exams, and the Azure security engineer track was on that list. The official guidance for candidates caught mid-preparation was blunt: anyone who had already registered could sit the exam while it remained available, but once the retirement date passed, a failed attempt could not be retaken and the credential could not be renewed. Candidates who had not yet registered were told in plain terms to prepare for the replacement exam instead.
Two points soften the blow for people who already passed. First, an earned certification remains valid and visible on your transcript until it expires; retirement does not revoke anything you earned. Second, your AZ-500 study effort was not wasted. The old exam assessed four domains: secure identity and access, secure networking, secure compute, storage and databases, and securing Azure using Microsoft Defender for Cloud and Microsoft Sentinel. Every one of those areas reappears inside the replacement credential with additions layered on top rather than substitutions carved out.
If you are earlier in your security career and weighing whether an associate-level cloud security exam makes sense at all, our comparison of three entry-level cybersecurity certifications is a useful reality check before you commit study hours to any single vendor track.
What SC-500 covers
The Cloud and AI Security Engineer Associate certification expands the Azure security engineer role to include cloud and AI model protection. That single sentence is the heart of the transition. The certification page describes a security engineer who implements end-to-end security controls across Azure, hybrid, and AI-enabled environments, protecting identities, data, applications, and infrastructure while maintaining regulatory compliance.
The published responsibilities read like the AZ-500 role description with one significant addition. You are expected to secure access to resources using Microsoft Entra ID and Azure Key Vault, enforce security and regulatory compliance, secure storage, databases and networking, secure compute, and manage and monitor security posture. Beyond all of that, you must also secure AI solutions. That final item is the delta between the old and new credentials: the platforms, data, identities, and infrastructure used by AI workloads have to be implemented and monitored with the same rigor as any traditional cloud resource.
Prerequisites are close to what AZ-500 demanded. Microsoft recommends practical experience administering Azure and hybrid environments across compute, network, and storage, strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration as well. If you were mid-preparation on identity, networking, and Defender for Cloud content when the retirement announcement landed, most of your notes still apply. What you need to add is the AI security layer: securing the pipelines, model hosting, and data flows that generative workloads introduce into an estate.
SC-500 exam format and facts
Candidates have 120 minutes to complete the proctored certification exam assessment, and Microsoft warns that the session may include interactive components rather than multiple-choice items only. The company also publishes an exam sandbox that lets you rehearse the interface, the question types, and the navigation before test day, which is worth thirty minutes of anyone’s preparation time if you have never taken a Microsoft role-based exam.
| Credential | Exam | Status | Focus |
|---|---|---|---|
| Azure Security Engineer Associate | AZ-500 | Retired August 31, 2026 | Identity, network, compute, storage and database security in Azure |
| Cloud and AI Security Engineer Associate | SC-500 | Generally available after a beta that opened in May 2026 | Azure security plus securing AI solutions and models |
| Cybersecurity Architect Expert | SC-100 | Active; English version updated July 28, 2026 | Zero Trust design across identity, data, AI, applications and operations |
One caveat for planners: when the certification page was published, the free Practice Assessment for SC-500 was not yet available. Microsoft notes that these practice assessments usually appear within eight weeks of an exam leaving beta, so check the official page before paying a third party for question banks that may not reflect the live exam blueprint.
Study plan that works
A structured sequence beats random video watching, and the domain-by-domain approach we used in our CKA prep guide and study plan transfers well to Microsoft exams. Follow this order:
- Read the official study guide first. Download it from the certification page and let its skills-measured list drive everything else you do. Every study hour should map to a line in that document.
- Work the free Microsoft Learn paths. Microsoft pairs every certification with free learning paths organized by domain. Complete them in order, and treat the built-in knowledge checks as diagnostics rather than celebrations.
- Build hands-on muscle in a sandbox. Stand up a free or sponsored Azure subscription and practice the tasks the role description names: conditional access policies in Entra ID, Key Vault secret and key management, network security groups, storage encryption, and Defender for Cloud recommendations.
- Add the AI security layer deliberately. This is the content AZ-500 never tested. Study how AI workloads consume identities, data, and compute, and how governance controls extend to model hosting and generative pipelines.
- Rehearse the exam experience. Spend time in the exam sandbox so question formats and on-screen tools hold no surprises.
- Schedule the exam and work backwards. Book a date roughly eight weeks out, then divide the study guide domains across those weeks with the last ten days reserved for review and timed practice.
A short readiness checklist before you book: you can configure conditional access and privileged identity management without documentation; you can explain what Defender for Cloud secure score changes do before clicking them; you can secure a storage account at rest and in transit; you can describe how an AI workload’s identity and data paths are protected end to end. If any item feels shaky, that domain owns your next study block.
The SC-100 expert alternative
If your goal is a durable expert badge rather than another associate credential, look one level up. The expert-level SC-100 exam requires a passing score of 700 to earn the Cybersecurity Architect Expert certification, and it assesses the design of security solutions aligned with Zero Trust principles across identity, devices, data, AI, applications, network, infrastructure, and DevOps. The English version was updated on July 28, 2026, and no retirement date is listed, which matters if you are planning a multi-year certification ladder rather than a single exam.
The trade-off is scope. SC-100 is a design exam that rewards breadth and experience across the whole Microsoft security stack, while SC-500 is an implementation exam closer to what working Azure security engineers do weekly. Many candidates take the associate exam first and treat the architect exam as the capstone a year or two later, once they have shipped real security controls in production. If you held an active AZ-500 when it retired, your transcript keeps that history, and layering SC-500 on top signals to employers that your knowledge includes the AI security workloads that were outside the old exam’s reach.
Sources
- Microsoft Learn — Azure Security Engineer Associate certification page
- Microsoft Learn — Cloud and AI Security Engineer Associate certification page
- Microsoft Learn — Exam SC-100: Microsoft Cybersecurity Architect
- Microsoft Tech Community — new certifications and 2026 retirements announcement