Skip to content
CertGPS

Microsoft Cloud and AI Security Engineer Associate

Proves you can secure Azure, hybrid and AI workloads across identity, network, data and compute; SC-500 replaced the retired AZ-500 in 2026

IntermediateMicrosoft

The exam

Exam cost
$165
Study time
3-4 months
Passing score
700 (scale of 1–1,000)
Valid for
1 year

Before you book

  • None required
  • Expected: practical experience administering Azure and hybrid environments, including compute, network and storage
  • Expected: strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Information Systems Security Professional

    Expert

    Comes before. Adds the governance and architecture breadth that a single-vendor engineering exam skips

  2. Microsoft Cloud and AI Security Engineer Associate

    You are here

Study guide

Last updated

Azure Security Engineer After AZ-500: A Study Guide to the SC-500 Exam

Microsoft retired the Azure Security Engineer Associate certification, its AZ-500 exam and the renewal assessment on August 31, 2026. You can no longer earn or renew it. Its replacement is the Cloud and AI Security Engineer Associate, earned by passing SC-500, and it keeps the Azure security engineering core of AZ-500 while adding a block on securing AI workloads. If you're starting now, SC-500 is the exam to plan for.

Who it suits, and who should look elsewhere

Microsoft writes SC-500 for a security engineer who protects identity, network, data and compute across Azure and hybrid environments, and who now also secures the platforms and identities that AI workloads run on. You're expected to have practical experience administering Azure and hybrid environments, strong familiarity with Microsoft Entra ID, and some Microsoft 365 administration. In practice that's a cloud engineer two or three years into Azure who has taken over security, or a security engineer at a Microsoft-heavy company.

If you already hold AZ-500, your credential stays valid and on your transcript until its expiry date, but you can't renew it, so SC-500 becomes your renewal plan in all but name. If your job is triage and hunting rather than configuration, SC-200 fits better. If identity is most of your week, take SC-300. On AWS, the counterpart is AWS Certified Security - Specialty.

SC-500 at a glance

SC-500
CertificationMicrosoft Certified: Cloud and AI Security Engineer Associate
Exam titleImplementing End-to-End Security Controls for Cloud and AI Workloads
Time120 minutes; Microsoft says the exam may include interactive components
QuestionsNot published for this exam
Passing score700 on a 1–1,000 scale
Price$165 in the United States; varies by country
DeliveryProctored, scheduled through Pearson VUE
PrerequisitesNone; Azure and hybrid administration experience and strong Entra ID knowledge expected
Retakes24 hours after a first fail, then 14 days; five attempts in 12 months

What the four skill areas cover

  • Manage identity, access, and governance: 20–25%
  • Secure storage, databases, and networking: 25–30%
  • Secure compute: 20–25%
  • Manage and monitor security posture: 20–25%

Storage, databases and networking carry the most weight, and that section will feel familiar to anyone who studied for AZ-500: network security groups and application security groups, Azure Virtual Network Manager, private endpoints and Private Link, Azure Firewall, storage firewall rules and Defender for Storage, Azure SQL auditing and Defender for Databases. Microsoft Entra Private Access is a new entry there.

The new material sits mostly in Secure compute, under "Implement security for AI." It asks you to find overexposed SharePoint data, use Microsoft Purview Data Security Posture Management to spot risks from Microsoft Copilot and other AI apps, turn on real-time protection for Copilot Studio agents, apply Conditional Access to Microsoft Entra Agent ID, deploy an AI gateway in Azure API Management for Microsoft Foundry, enable Defender for AI Services, and set guardrails for agents in Foundry. Some of these features are young, and Microsoft's note that the exam may include preview features "if those features are commonly used" applies here more than anywhere.

The posture section brings Microsoft Sentinel ingestion and automation alongside Defender for Cloud, and adds Microsoft Security Copilot: workspaces, roles, plugins and agents. AZ-500 gave Defender for Cloud and Sentinel 30–35% of the exam. SC-500 spreads that work across two sections and adds Azure Arc for hybrid and multicloud servers, Azure Machine Configuration, and security controls for Azure Functions, Logic Apps and App Service.

Two exam mechanics shape preparation. Associate exams let you open Microsoft Learn during the test, which helps with a setting name and hurts if you lean on it, because the clock doesn't stop. And because of the interactive items, you should practise each task in the portal until you can do it from memory.

How to prepare

Start with the SC-500 study guide and mark every bullet you haven't configured yourself. Microsoft runs a four-day instructor-led course, SC-500T00-A, if your employer pays for training. The official practice assessment isn't out yet: Microsoft's page says practice assessments usually follow within eight weeks of an exam leaving beta. Until then, use the exam sandbox to learn the interface.

Then build. A pay-as-you-go Azure subscription and a test Entra tenant cover most of the outline, with a 30-day Entra ID P2 trial for Privileged Identity Management. The Copilot and Purview items need Microsoft 365 licensing that few personal labs have, so read the documentation for those.

  1. Identity and governance: assign Azure Policy initiatives, create a custom role, put a resource lock on a production resource group, and set up Privileged Identity Management for an owner role.
  2. Network and data: hide a storage account and an Azure SQL database behind private endpoints, then prove the public path is closed with Network Watcher.
  3. Compute: harden a VM with Bastion and just-in-time access, onboard an on-premises server through Azure Arc, and turn on Defender for Servers and Defender for Containers.
  4. AI: stand up a small Foundry project behind an API Management AI gateway, enable Defender for AI Services, and read what the Data and AI security dashboard reports.
  5. Posture: connect Sentinel, ingest Windows Security events through a data collection rule, and write one automation rule.

Delete the resources after each session. We'd spend about a third of your time on the AI and Security Copilot items, since they're new to most candidates, and split the rest across the other sections by weight.

Renewal and what to earn next

Microsoft's role-based certifications expire every year. Renewal is a free, unproctored, open-book assessment on Microsoft Learn that you can take during a six-month window before expiry, as many times as you need; passing adds a year. The SC-500 certification page doesn't yet list a renewal frequency, so check it once your first year is underway.

  • SC-200 adds the analyst side: hunting in KQL and incident response in Defender XDR and Sentinel.
  • CCSP puts the same work in vendor-neutral terms.
  • Microsoft's Cybersecurity Architect Expert accepts this certification as one of its prerequisites, through the SC-100 exam.

Our view

AZ-500 was well regarded as a hands-on Azure exam, and SC-500 keeps that core. The AI section is the risk: it tests features that are months old, so material dates quickly and the exam can reward reading release notes over judgment. Still, at $165 with free annual renewal it's cheap for a role-based certification, and for anyone securing Azure in an organization rolling out Copilot and Foundry, the new section matches work that's already arriving. If you hold AZ-500 and your job hasn't changed, there's no rush, as long as you pass SC-500 before your current certificate expires.

Sources