For most people, the certification to take after SC-500 is SC-100: Microsoft Cybersecurity Architect. Microsoft now lists the Cloud and AI Security Engineer Associate, the credential SC-500 earns, as one of three certifications that qualify you for the Cybersecurity Architect Expert. Passing SC-500 therefore puts you halfway to Microsoft's expert-level security credential. SC-100 completes it.
Not everyone should go straight there. If your job leans towards detection and response, or towards identity, a second associate certification (SC-200 or SC-300) is often the better next step. The rest of this guide explains how to choose, and which roles the SC-500 career path leads to. If you have not sat either exam yet, our SC-500 vs SC-200 comparison covers which to take first.
What SC-500 certifies you for
SC-500 is the exam for Microsoft Certified: Cloud and AI Security Engineer Associate. Its full title is Implementing End-to-End Security Controls for Cloud and AI Workloads. Microsoft rates it Intermediate and assigns it to the Security Engineer role.
The job Microsoft describes is hands-on engineering: securing access with Microsoft Entra ID and Azure Key Vault, enforcing compliance, securing storage, databases, networking and compute, securing AI solutions, and monitoring security posture. The AI part covers work like configuring guardrails for agents in Microsoft Foundry, enabling Defender for AI Services, and applying conditional access to Microsoft Entra Agent ID.
That scope matters for your next step. SC-500 already covers identity, Sentinel data collection and Defender for Cloud at implementation depth. It gives you breadth. Your next certification should add either design authority (SC-100) or specialist depth (SC-200 or SC-300).
Exam Tip: SC-500 replaced AZ-500, which Microsoft retired on 31 August 2026 together with its renewal assessment. If you are weighing the two, our AZ-500 vs SC-500 comparison explains what changed.
The SC-500 to SC-100 path: how the expert certification works
To earn Microsoft Certified: Cybersecurity Architect Expert you need two things:
- Pass exam SC-100.
- Hold at least one of these three associate certifications:
- Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500)
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Identity and Access Administrator Associate (SC-300)
The current Microsoft Learn page no longer lists Azure Security Engineer Associate (AZ-500) as a prerequisite. That is the practical effect of the retirement: for new candidates, SC-500 is the engineering route into the architect certification.
Exam Tip: If you already hold AZ-500 and are planning SC-100, check how the prerequisite shows in your own Microsoft Learn profile before you book. Microsoft's public page lists the three certifications above and does not describe how existing AZ-500 holders are handled, so do not assume either way.
SC-100 requires a score of 700 to pass, the same scaled pass mark Microsoft uses for SC-500. It has four domains:
| SC-100 domain | Weighting |
|---|---|
| Design solutions that align with security best practices and priorities | 20-25% |
| Design security operations, identity, and compliance capabilities | 25-30% |
| Design security solutions for infrastructure | 25-30% |
| Design security solutions for applications and data | 20-25% |
SC-100 changes on 21 October 2026
Microsoft updates the English SC-100 exam on 21 October 2026. The new study guide adds AI design work that follows on directly from SC-500. It includes designing AI solutions that align to the Microsoft Cloud Security Benchmark, designing security for data used in AI workloads, and evaluating data security and compliance controls in Microsoft 365 Copilot.
This is why SC-100 is the most natural next step. SC-500 teaches you to implement AI security controls. From 21 October, SC-100 asks you to design them. Take both close together and most of your study carries over.
The SC-200 Security Operations Analyst certification is also being updated on 21 October 2026. If SC-200 is your next exam, study from the new study guide rather than older course material.
Which certification to take after SC-500
Choose based on the job you do now, or the job you want next.
| Your situation | Take next | Why |
|---|---|---|
| You design or review security for Azure and Microsoft 365 estates, or want to | SC-100 | Completes the Cybersecurity Architect Expert, and your SC-500 already counts as the prerequisite |
| You work in a SOC, or your role is moving towards detection and incident response | SC-200 | Adds depth in Microsoft Sentinel, Defender XDR and investigation, which SC-500 covers only at setup level |
| Most of your day is identity: conditional access, PIM, app registrations, governance | SC-300 | Deepens the Entra ID work SC-500 introduces, and is a third route into SC-100 later |
| You have fewer than two years of hands-on Azure administration | No new exam yet | Build experience first. SC-100 is scenario-based and assumes you have made design decisions in real environments |
When SC-100 straight away makes sense
Go straight to SC-100 if you already review designs, write security standards, or sit in architecture boards. Microsoft expects SC-100 candidates to have expert skills in at least one area and experience designing solutions with Microsoft security technologies. If that describes your work, a second associate exam would mostly repeat what you know.
When a second associate is the better move
If SC-500 was your first Microsoft security certification, SC-200 or SC-300 is often the stronger next step. SC-100 questions give you a business scenario and ask for the best design, and the right answer is hard to spot without implementation depth in at least one area. A second associate builds that depth and still leaves SC-100 open, because either one is also a valid prerequisite. Our SC-200 vs SC-300 guide compares the two, and when you are ready for the architect exam, the SC-100 study plan sets out the preparation. Check it against the new 21 October outline.
The jobs the SC-500 career path leads to
Microsoft maps SC-500 to the Security Engineer role. In job adverts, the same work tends to appear under these titles:
- Cloud security engineer or Azure security engineer, the direct match for the SC-500 skills outline
- AI security engineer, a newer title for engineers who secure AI platforms, agents and the data they reach. SC-500's AI domain is one of the few vendor exams that tests this at implementation depth
- Security engineer (Microsoft 365 and Azure), common in organisations running a mostly Microsoft estate
- Cybersecurity architect or cloud security architect, the usual next role, and the one SC-100 is aimed at
SC-500 is new, so few job adverts name it yet. Many still ask for AZ-500 because they were written before the retirement. Hiring managers who know the Microsoft portfolio treat the two as the same level, and SC-500 is the current version. In a cover letter or interview, say so directly rather than assuming the reader knows.
Microsoft does not publish salary data for its certifications, and pay figures from job boards vary widely by region and seniority. We have not quoted a figure here because nothing reliable ties a salary to SC-500 specifically. The certification supports a move into cloud or AI security engineering. It does not set a salary band.
Why employers that are Microsoft partners care
There is also a direct commercial reason employers want this certification. To earn Microsoft's Solutions Partner for Security designation, a partner organisation needs certified staff. On the enterprise track, at least two people must hold the Azure Security Engineer Associate or the Cloud and AI Security Engineer Associate. Microsoft notes that AZ-500 certifications earned before retirement stay valid for one year, so partners are now replacing them with SC-500.
If you work for, or want to work for, a Microsoft partner or managed security provider, SC-500 is a certification your employer is counting.
Keeping SC-500 current while you move on
Microsoft role-based certifications expire unless you renew them. Renewal is free. You pass a short, unproctored, open-book online assessment on Microsoft Learn at any point in the six months before your certification expires, and each pass extends it by one year.
Keep SC-500 renewed while you work towards SC-100. Your Cybersecurity Architect Expert depends on holding a valid prerequisite certification, and the renewal assessments focus on recent product changes. With how often Microsoft is changing its AI security tooling, that reading is useful in any case.
A realistic SC-500 career sequence
For someone starting from SC-500, a sensible order looks like this:
- SC-500, if you have not passed it yet. Our SC-500 8-week study plan and the SC-500 domain weightings cover the preparation.
- Six to twelve months applying it at work, particularly the Defender for Cloud and AI security controls. They are the hardest part of the exam to learn from reading alone.
- SC-200 or SC-300, only if your role needs that depth.
- SC-100, to earn the Cybersecurity Architect Expert.
If you are still deciding whether SC-500 is the right starting point, read is SC-500 difficult, and who it is for first.
Frequently Asked Questions
What should I take after SC-500?
For most candidates, SC-100: Microsoft Cybersecurity Architect. SC-500 is one of the three certifications Microsoft accepts as a prerequisite for the Cybersecurity Architect Expert, so passing SC-100 completes the expert credential. If you work in a SOC or mainly on identity, SC-200 or SC-300 may be the better step first.
Which Microsoft security certification is best?
It depends on the job. SC-500 is the broadest engineering certification in Microsoft's security portfolio. SC-200 suits security operations analysts, SC-300 suits identity administrators, and SC-100 is the expert-level architect certification that builds on any of those three.
What do AI security engineers do?
They secure the platforms, identities and data that AI systems use. In Microsoft environments that means work such as configuring guardrails for agents in Microsoft Foundry, applying conditional access to agent identities, finding overexposed data before Copilot can surface it, and monitoring AI workloads in Defender for Cloud. SC-500 tests all of these.
Is SC-500 difficult?
SC-500 is an Intermediate exam with a pass mark of 700 and a 120-minute time limit. The AI security domain is new to almost every candidate, and much of the older study material predates the exam. We cover the detail in our SC-500 difficulty guide.
Ready to Start Practising?
Whichever exam comes next, practise on questions written for the current outline. CertCrush has exam-style practice for SC-500, SC-100 and SC-200, with explanations for every answer. Create your free account and start with the exam you are sitting next.