AZ-500 vs SC-500: Which Microsoft Security Certification Should You Take in 2026?

If you are studying Microsoft security right now, you have a real decision to make. The choice between AZ-500 vs SC-500 is no longer academic, because AZ-500 is retiring and SC-500 is the exam Microsoft wants you to take next. Pick wrong and you could pour weeks into an exam that disappears, or skip a credential you actually needed this quarter.

Here is the short answer first, then the detail. If you are mid-preparation and can sit the exam before late August 2026, finishing AZ-500 is still a sensible move. If you are starting fresh, or your work touches AI workloads, SC-500 is the smarter long-term bet. The rest of this guide explains exactly why, with the domains, cost, format and timing laid out side by side.

The headline: AZ-500 is retiring and SC-500 replaces it

Microsoft is running its biggest certification overhaul since the move to role-based credentials in 2019, and Azure security is right in the middle of it.

• AZ-500 (Azure Security Technologies) retires on 31 August 2026. After that date you can no longer sit the exam.
• SC-500 (Cloud and AI Security Engineer Associate) launched in beta on 15 May 2026, with general availability and full training expected around July 2026.
• There is no automatic conversion and no free transition exam. SC-500 is a separate credential you earn by passing the SC-500 exam.

Exam Tip: AZ-500 retiring does not wipe the credential off your transcript. If you pass and renew before retirement, your Azure Security Engineer Associate certification stays active until its renewal date, even though new candidates can no longer take the exam.

This is why the AZ-500 vs SC-500 question is so time-sensitive. The clock is running on one option, while the other is brand new and still settling into its final form.

AZ-500 vs SC-500: side-by-side comparison

Both exams sit at the Associate level, cost the same and use the same passing score, so the real differences are scope, content and shelf life.

The pricing, question count and 700 passing score are effectively identical, so do not let those numbers drive your decision. The scope difference is what matters.

What AZ-500 actually covers

AZ-500 is a focused Azure infrastructure security exam. It has always rewarded hands-on depth across four areas:

• Manage identity and access - Microsoft Entra ID, Conditional Access, privileged identity.
• Secure networking - network security groups, firewalls, private endpoints.
• Secure compute, storage and databases - Key Vault, encryption, workload protection.
• Manage security operations - Microsoft Defender for Cloud and Microsoft Sentinel.

Exam Tip: On AZ-500, identity and security operations together make up roughly half the exam. Key Vault and Microsoft Sentinel show up constantly, and weak KQL query skills are one of the most common reasons capable candidates fall short.

If your day job is Azure infrastructure security, Defender for Cloud, identity, networking and compliance, AZ-500 still maps almost perfectly to your work. The catch is simply the retirement date.

What SC-500 adds on top

SC-500 keeps most of the Azure infrastructure security content you would recognise from AZ-500, then widens the role into cloud and AI security. The official skills measured break down roughly as follows:

• Manage identity, access and governance (20 to 25%)
• Secure storage, databases and networking (25 to 30%)
• Secure compute, including security for AI (20 to 25%)
• Manage and monitor security posture (20 to 25%)

The genuinely new part is AI security. SC-500 is the first Microsoft security exam to test AI security as its own discipline, including:

• Microsoft Copilot risk and data exposure.
• Microsoft Entra Agent ID for securing AI agents.
• Microsoft Defender for AI Service.
• Azure AI Foundry AI Gateway controls.
• Microsoft Defender XDR blast-radius analysis for agentic AI.

In other words, SC-500 assumes a world where security engineers protect AI models, AI pipelines, generative AI deployments and autonomous agents, not just virtual machines and storage accounts. If you have read our take on why AI certifications are exploding, SC-500 is Microsoft baking that same shift directly into its core security track.

So which should you take in 2026?

Use your start date and your role to decide. Here is the practical decision path.

Choose AZ-500 if

• You are already mid-preparation and can realistically pass before 31 August 2026.
• Your work is centred on Azure infrastructure security and you need the validation soon.
• You want a known, stable exam rather than a beta that is still bedding in.

Choose SC-500 if

• You are starting from scratch in 2026 and have time on your side.
• Your role touches AI workloads, Copilot, or agentic AI security.
• You want the credential that aligns with Microsoft's stated future direction.

Exam Tip: If you cannot sit AZ-500 comfortably before late August 2026, do not gamble on a last-minute attempt. Pivot to SC-500 instead. A rushed exam booking is a classic reason people fail, as we cover in why most people fail certification exams.

One more point on beta exams. SC-500 results can take several weeks to arrive while the exam is in beta, because Microsoft scores beta exams once enough data is gathered. If you need a result on a fixed deadline, factor that delay in.

How AZ-500 and SC-500 fit the wider Microsoft security path

Neither exam exists in isolation. Microsoft's security certifications stack, and the SC series is increasingly the centre of gravity.

• AZ-500 / SC-500 sit at the engineer level for Azure and cloud security.
• SC-200 (Security Operations Analyst) and SC-300 (Identity and Access Administrator) sit alongside them for analysts and identity specialists. If you are weighing those two, our guide on SC-200 vs SC-300 breaks down the difference.
• SC-100 (Cybersecurity Architect) sits above them as the design-level credential.

A common 2026 path is to pair an operations or identity exam with the engineer credential, then move toward the architect level. SC-500 slots neatly into that ladder while adding the AI security layer the others do not yet cover in depth.

Is the Azure security path still worth it?

Yes, and the numbers back it up. Cloud security roles are growing faster than general cloud roles, and demand is outpacing supply. Azure Security Engineers in the US are reported to average roughly $180,000 to $190,000 according to Glassdoor and ZipRecruiter figures, which puts this firmly among the better-paid Microsoft tracks.

Adding AI security on top, as SC-500 does, only strengthens that position. Organisations are deploying Copilot and agentic AI faster than they can secure it, and the engineers who can lock those systems down are scarce. That is exactly the gap SC-500 is designed to fill.

Ready to Start Practising?

Whichever side of the AZ-500 vs SC-500 decision you land on, passing comes down to repetition under exam conditions. Reading documentation is not the same as answering scenario questions against the clock, and both exams lean heavily on applied judgement rather than recall.

CertCrush gives you realistic, scenario-based practice questions and full explanations for Microsoft security exams, so you walk in knowing how the questions are framed and where the traps are. Browse the Microsoft security courses to find your exam, then put your knowledge to the test.

Create your free CertCrush account and start practising today. Choose the exam that fits your timeline, then practise until passing feels routine.