AZ-500 retired on 31 August 2026, and SC-500 is the exam that replaced it. If you are choosing a Microsoft security engineering exam today, there is no longer a choice to make: you book SC-500. The questions that still matter are what happens to an AZ-500 you already hold, how much of your AZ-500 study carries over, and what SC-500 tests that AZ-500 never did.
What happened to AZ-500
Microsoft retired the Azure Security Engineer Associate certification, the AZ-500 exam and the AZ-500 renewal assessment on 31 August 2026. The certification page on Microsoft Learn now states that you can no longer earn or renew it after that date.
That second point catches people out. With most Microsoft retirements, the exam goes but you can keep renewing the certification you already hold. Not here. The renewal assessment went at the same time as the exam.
- You cannot sit AZ-500. New candidates take SC-500 instead.
- You cannot renew an existing AZ-500. Your Azure Security Engineer Associate stays valid until its current expiry date, then lapses.
- There is no conversion. Microsoft offers no transition exam and no automatic upgrade. SC-500 is a separate certification, the Microsoft Certified: Cloud and AI Security Engineer Associate, earned by passing the SC-500 exam.
Microsoft's Solutions Partner for Security programme confirms the timing. It accepts either certification during the changeover and notes that an AZ-500 earned before retirement remains valid for one year.
Exam Tip: Check the expiry date on your AZ-500 in your Microsoft Learn profile now. That date is your deadline for passing SC-500 if you want to hold a current Microsoft security engineering certification without a gap.
If you already hold AZ-500
Your certification still counts until it expires, so nothing breaks today. Plan for two things.
Your CV and employer. Many job adverts still ask for AZ-500 because they were written before the retirement. Once your AZ-500 expires it stops being a current certification, and SC-500 is what replaces it on your transcript.
The architect route. Microsoft's Cybersecurity Architect Expert requires the SC-100 exam plus at least one of three associate certifications: Identity and Access Administrator (SC-300), Security Operations Analyst (SC-200), or Cloud and AI Security Engineer (SC-500). The Microsoft Learn page no longer lists the Azure Security Engineer Associate. If you were counting on AZ-500 as your SC-100 prerequisite, check how it shows in your own Learn profile before you book SC-100, because Microsoft's public page does not say how existing AZ-500 holders are treated.
The SC-100 exam itself is also changing. Microsoft updates the English version on 21 October 2026, so check the SC-100 study guide for the new skills before you start preparing.
If you were part-way through AZ-500 preparation
Most of that study is not wasted. SC-500 keeps the core of AZ-500: Entra ID, Key Vault, network security, compute security, Defender for Cloud and Microsoft Sentinel. The Microsoft Learn study guide for SC-500 lists every one of those areas.
What you need to add:
- The AI security objectives. These sit inside the Secure compute domain and are new to almost every candidate.
- Microsoft Security Copilot. Configuring workspaces, roles, plugins and agents is now a tested objective under security posture.
- Microsoft 365 familiarity. The SC-500 audience profile asks for familiarity with Microsoft 365 administration alongside Azure and Entra ID, which AZ-500 did not.
Our 8-week SC-500 study plan sets out how to fit the new material around what you already know.
AZ-500 vs SC-500: side-by-side comparison
| Feature | AZ-500 (Azure Security Engineer Associate) | SC-500 (Cloud and AI Security Engineer Associate) |
|---|---|---|
| Status | Retired 31 August 2026, including renewal | Current |
| Level | Intermediate | Intermediate |
| Focus | Azure infrastructure security | Azure, hybrid and AI workload security |
| Passing score | 700 out of 1000 | 700 out of 1000 |
| Exam time | No longer bookable | 120 minutes |
| AI security | Not covered | Tested within the Secure compute domain |
| Security Copilot | Not covered | Tested objective |
| Microsoft practice assessment | Retired with the exam | Not yet available |
Microsoft prices the exam by the country or region where it is proctored, and shows the price when you schedule through Pearson VUE. At the time of writing Microsoft Learn offers SC-500 in English only.
Exam Tip: Microsoft's free practice assessment for SC-500 is not published yet. Microsoft says practice assessments usually appear within eight weeks of an exam leaving beta, so do not wait for it before you start practising.
What SC-500 adds on top of AZ-500
The four SC-500 domains, as published in the Microsoft Learn study guide:
| Domain | Weighting |
|---|---|
| Manage identity, access, and governance | 20 to 25% |
| Secure storage, databases, and networking | 25 to 30% |
| Secure compute | 20 to 25% |
| Manage and monitor security posture | 20 to 25% |
The genuinely new material is the Implement security for AI section inside Secure compute. It covers:
- Identifying overexposed SharePoint data and Copilot risk with Microsoft Purview Data Security Posture Management.
- Real-time protection for Microsoft Copilot Studio agents.
- Conditional access for Microsoft Entra Agent ID, and managing agent access.
- Blast-radius analysis for Entra Agent ID risks in Defender XDR.
- AI Gateway in Azure API Management for Microsoft Foundry, and guardrails for agent security in Foundry.
- Defender for AI Services, and the Data and AI security dashboard in Defender for Cloud.
- Managing agents in the Microsoft 365 admin center.
AZ-500 assumed a security engineer protected virtual machines, storage accounts and networks. SC-500 assumes the same engineer also protects the Copilot deployments and AI agents running on top of them. For how that shift plays across the wider market, see AI certifications are exploding, but which ones actually get you hired.
The full objective list, and where the AI questions actually sit, is in our guide to SC-500 exam topics and domain weightings.
Where SC-500 sits in the Microsoft security path
- SC-500 is the engineer-level credential for cloud and AI security.
- SC-200 (Security Operations Analyst) and SC-300 (Identity and Access Administrator) sit beside it at the same level. Our SC-200 vs SC-300 comparison covers the difference between those two, and our SC-500 vs SC-200 guide covers which of SC-500 and SC-200 to take first.
- SC-100 (Cybersecurity Architect) sits above all three, and any one of them meets the prerequisite.
If SC-500 is your first Microsoft security certification, our guide to what to take after SC-500 sets out the order that makes sense from there. If you are unsure whether you are ready for it, start with is SC-500 difficult, and who it is for.
Frequently Asked Questions
Can I still take AZ-500?
No. Microsoft retired the AZ-500 exam on 31 August 2026. SC-500 is the replacement exam for Azure and cloud security engineers.
Can I renew my AZ-500 certification?
No. Microsoft retired the AZ-500 renewal assessment on the same date as the exam. Your Azure Security Engineer Associate stays valid until its current expiry date and then lapses. To hold a current Microsoft security engineering certification after that, pass SC-500.
Does AZ-500 convert to SC-500?
No. There is no automatic conversion and no transition exam. SC-500 is a separate certification that you earn by passing the SC-500 exam.
Is SC-500 harder than AZ-500?
Both are Intermediate exams with a 700 pass mark. SC-500 covers most of the AZ-500 ground and adds AI security, Security Copilot and some Microsoft 365 administration, so there is more to learn even for someone who passed AZ-500. Our SC-500 difficulty guide goes into the detail.
Does AZ-500 still count towards the Cybersecurity Architect Expert?
Microsoft's public page now lists SC-500, SC-200 and SC-300 as the qualifying certifications and does not name AZ-500. If you hold AZ-500 and plan to take SC-100, check your own Microsoft Learn profile before booking.
Start practising for SC-500
Most of your AZ-500 knowledge carries straight over. What trips people up on SC-500 is the AI security material and the scenario wording, where two answers look right and only one fits the requirement. Practising against realistic questions is the quickest way to find the gaps.
The CertCrush SC-500 course has scenario-based practice questions across all four domains, with explanations for every answer. Create your free CertCrush account to start.