If you are a cloud security professional working with Azure, 2026 has brought a significant change to your certification roadmap. Microsoft Azure Security Engineer Associate (AZ-500) — one of the most respected and widely held Microsoft security certifications — is scheduled to retire on September 30, 2026. Its replacement, SC-500 (Microsoft Cloud and AI Security Engineer), is being introduced as the next-generation security certification for professionals who need to protect not just cloud infrastructure but also AI systems, models, and pipelines.
For security professionals this creates a genuine decision point. AZ-500 is still active and fully recognized by employers today. SC-500 is new, forward-looking, and represents where Microsoft sees cloud security heading. Choosing between them is not just about exam content — it is about timing, career strategy, and understanding what the security job market will look like in the next two to three years.
This guide gives you the complete picture. We will cover what each exam tests, who each one is designed for, how the timing works, what changes between the two, and exactly what you should do based on your current situation.
The Short Answer First
Take AZ-500 if you are already well into your preparation, you can realistically sit the exam before September 30, 2026, and your current role is focused on Azure security engineering in today’s enterprise environments.
Take SC-500 if you are starting fresh, you want a certification that reflects where cloud and AI security is heading, and you are not under pressure to certify immediately on the current path.
The critical difference: AZ-500 retires on September 30, 2026 — giving you more runway than the June 30 retirements affecting AI-900, AI-102, AZ-204, and DP-100. This extra time changes the calculation for security professionals compared to candidates in those other tracks. You have more room to make a deliberate decision rather than a rushed one.
What Is AZ-500 and What Does It Actually Test
AZ-500 is the Microsoft Azure Security Engineer Associate certification. It has been the primary Microsoft certification for cloud security professionals since its launch and remains one of the most recognized security credentials in enterprise IT hiring. Security engineers, cloud architects, DevSecOps professionals, and IT security analysts have pursued AZ-500 as proof of their Azure security competency for years.
The certification validates that you can implement security controls, maintain security posture, manage identity and access, and protect data, applications, and networks in Azure and hybrid environments. It is not a theoretical exam — it tests practical knowledge of how Azure security tools and services are actually configured and managed in real enterprise environments.
The official skills measured in AZ-500 cover four main domains:
Manage identity and access
This covers managing Microsoft Entra identities, implementing authentication and authorization solutions, managing application access, and implementing conditional access and identity protection. This domain typically carries significant weight in the exam and requires solid hands-on familiarity with Microsoft Entra ID.
Secure networking
This includes planning and implementing security for virtual networks, private access to Azure services, network monitoring, and web application delivery. Candidates need to understand Azure Firewall, network security groups, Azure DDoS Protection, and related networking security services.
Secure compute, storage, and databases
This covers security posture management for compute and containers, configuring storage security, and implementing database security. It includes practical knowledge of Microsoft Defender for Cloud, Azure Key Vault, and container security in Azure Kubernetes Service environments.
Manage security operations
This domain covers configuring and managing Microsoft Sentinel, enabling and managing Microsoft Defender for Cloud, configuring monitoring for security events, and responding to security incidents. Security operations is an increasingly important part of the AZ-500 scope as organizations mature their cloud security practices.
The AZ-500 exam is typically 100 to 150 minutes in duration with a passing score of 700 out of 1000. It is considered a genuinely challenging associate-level exam — most candidates report needing 60 to 100 hours of focused preparation. Hands-on experience with Azure security services significantly improves pass rates compared to purely theoretical study.
What Is SC-500 and What Will It Actually Test
SC-500 is the Microsoft Cloud and AI Security Engineer certification. It is Microsoft’s announced replacement for AZ-500 and represents a meaningful expansion of what the cloud security engineer role is expected to know and do.
The naming change from “Azure Security Engineer” to “Cloud and AI Security Engineer” is not cosmetic. It signals two important shifts in how Microsoft defines the security engineer role for 2026 and beyond.
First, the scope moves beyond Azure-only security toward a broader cloud and AI security posture. Second, and more significantly, it explicitly incorporates AI security — protecting AI models, AI pipelines, generative AI deployments, and agentic AI systems — as a core competency for security engineers.
This reflects a real change in enterprise security requirements. Organizations deploying Microsoft Copilot, Azure OpenAI Service, and other AI-powered solutions need security engineers who understand not just how to protect traditional cloud infrastructure but also how to govern AI access, prevent prompt injection attacks, secure model endpoints, and manage the unique risks that AI systems introduce.
Based on Microsoft’s announced direction for SC-500, the exam is expected to cover:
Cloud security foundations
Core Azure security concepts carried forward from AZ-500 including identity and access management, network security, compute security, storage security, and security operations. Candidates with strong AZ-500 preparation will recognize much of this domain.
AI security and governance
This is the genuinely new territory in SC-500. It covers securing AI model environments, implementing governance for AI deployments, protecting against AI-specific attack vectors, managing AI access controls, and ensuring responsible AI deployment from a security perspective. This domain has no direct equivalent in AZ-500.
Microsoft Defender for Cloud and Sentinel in AI contexts
Using Microsoft’s security operations tools to monitor, detect, and respond to threats in environments that include AI workloads and generative AI services.
Securing Microsoft Copilot and AI-powered services
Understanding the security architecture of Microsoft Copilot deployments, managing permissions and data access for AI agents, and implementing controls that prevent AI systems from being weaponized or abused within enterprise environments.
The SC-500 training is expected to become available around July 2026, with the exam following in the months after. This timing is important — it means if you are mid-preparation for AZ-500 right now, the SC-500 prep ecosystem will not be mature until after AZ-500’s retirement deadline has passed.
AZ-500 vs SC-500: Key Differences at a Glance
| Area | AZ-500 | SC-500 |
| Current status | Active, retires September 30, 2026 | Launching mid-to-late 2026 |
| Credential name | Azure Security Engineer Associate | Cloud and AI Security Engineer |
| Primary focus | Azure cloud security | Cloud and AI security combined |
| AI security coverage | Minimal | Central and extensive |
| Identity and access | Microsoft Entra, conditional access | Expected to carry forward and expand |
| Network security | Azure Firewall, NSGs, DDoS | Expected to carry forward |
| Security operations | Sentinel, Defender for Cloud | Expanded with AI threat contexts |
| AI-specific threats | Not covered | Prompt injection, model abuse, AI governance |
| Prep material maturity | Excellent — full ecosystem available | Still developing, expected July 2026 |
| Exam difficulty | Challenging associate level | Expected similar or slightly higher |
| Best for | Azure security engineers certifying now | Security professionals targeting AI-era roles |
| Recommended for fresh starters | If testing before September 30, 2026 | Yes, for candidates starting mid-2026 |
Who Should Take AZ-500 in 2026
AZ-500 remains a strong certification choice for specific groups of security professionals in 2026. Here is who those people are.
Security professionals who are already well prepared
If you have completed the official AZ-500 learning path, practiced with labs, and are reasonably close to exam-ready, switching to SC-500 now would reset months of preparation work. AZ-500 is a respected, established certification with strong employer recognition. Finishing it before September 30, 2026 is almost always the right call if you are already deep into preparation.
Professionals who need recognized Azure security credentials for current job applications
AZ-500 is well established in job descriptions, hiring requirements, and employer shortlists. SC-500 is brand new and will take time to appear consistently in job postings. If you are actively job hunting in cloud security right now, AZ-500 still carries stronger immediate recognition than an exam that has not yet launched.
Security engineers in organizations running primarily traditional Azure workloads
If your day-to-day security work is centered on Microsoft Entra identity management, Azure network security, Defender for Cloud configuration, and Sentinel operations — without significant AI workload responsibility yet — AZ-500’s scope maps closely to your current job reality. SC-500’s AI security content is forward-looking, not necessarily reflective of what most organizations are securing today.
Candidates who prefer a proven, stable exam ecosystem
AZ-500 has a well-documented exam blueprint, published skills breakdown, official Microsoft Learn learning path, practice assessment, and a mature community of candidates who have shared their experience. This makes preparation predictable. SC-500 will not have this ecosystem maturity until well into late 2026 at the earliest.
Who Should Take SC-500 in 2026
For security professionals starting fresh or planning for the medium term, SC-500 will be the more strategic choice. Here is who fits that profile.
Security professionals starting their preparation from scratch in mid-2026
The SC-500 prep ecosystem is expected around July 2026. If you are beginning your cloud security certification journey around that time, starting directly on SC-500 rather than rushing through AZ-500 in its final months makes more sense. You will build toward a credential that Microsoft actively supports rather than one in its retirement window.
Security engineers moving into AI-inclusive security roles
Enterprise security teams are rapidly expanding their scope to include AI governance, AI access controls, and AI-specific threat detection. If your role is evolving in this direction — or you want it to — SC-500’s AI security content gives you certified competency in exactly the areas where demand is growing fastest.
Professionals targeting Microsoft security architect or senior security roles
At senior levels, the expectation is increasingly that security professionals understand AI risks alongside traditional cloud security risks. SC-500 positions you as someone who has validated competency in both dimensions, which is a meaningful differentiator in senior hiring conversations.
Candidates building a long-term Microsoft security certification stack
If you are planning to eventually pursue SC-100 (Microsoft Cybersecurity Architect) or other senior Microsoft security credentials, SC-500 will likely serve as a more natural building block than AZ-500, which is being retired as the foundation of the new security path.
The AI Security Question: Why It Changes Everything
The most important thing to understand about the AZ-500 to SC-500 transition is not a cosmetic exam update. It reflects a fundamental change in what enterprise security engineers are expected to protect.
When AZ-500 was designed, AI workloads were a small fraction of what enterprise security teams managed. Azure identity, networking, compute, storage, and security operations were the full scope of most security engineers’ responsibilities.
In 2026 that picture has changed significantly. Organizations running Microsoft Copilot, Azure OpenAI deployments, AI agents, and generative AI-powered applications now have an entirely new attack surface that traditional security frameworks were not built to address. Prompt injection attacks, data exfiltration through AI models, misconfigured AI access permissions, and AI-assisted social engineering are real threats that security engineers encounter today.
SC-500 is Microsoft’s answer to this reality. By making AI security a core competency of the Cloud and AI Security Engineer certification, Microsoft is signaling to the industry that securing AI systems is no longer optional or specialized knowledge — it is a baseline expectation for professional cloud security engineers.
For candidates deciding between AZ-500 and SC-500, this means asking yourself one honest question: In two years, do you want your certified skills to include AI security? If yes, SC-500 is where you want to end up eventually. The only real question is whether you get there via AZ-500 first or go directly to SC-500.
Timing Scenarios: What You Should Do Right Now
Scenario 1: You are already studying for AZ-500 and your exam is scheduled
Stay on your current path. You have until September 30, 2026 to sit the exam, which is a generous runway. Focus on completing your preparation and testing as planned. A certified AZ-500 on your transcript is a real achievement that employers recognize today, and it remains on your profile until it naturally expires.
Scenario 2: You have not started studying yet and it is before June 2026
You have a genuine choice. AZ-500 gives you a proven path with mature prep materials and strong immediate employer recognition. SC-500 gives you a more future-aligned credential but with a prep ecosystem that will not be fully mature until mid-to-late 2026. If you can start AZ-500 immediately and commit to testing before September 30, 2026, it remains a strong investment. If you are not ready to commit to that timeline, waiting for SC-500 is reasonable.
Scenario 3: You have not started studying yet and it is July 2026 or later
At this point SC-500 is the clear choice. Starting AZ-500 with fewer than three months to retirement and switching prep ecosystems midway would be unnecessarily disruptive. Focus your energy on SC-500 from the beginning.
Scenario 4: You already hold AZ-500 and it is approaching renewal
If your AZ-500 is due for renewal before September 30, 2026, complete the renewal assessment now. After retirement you will no longer be able to renew it. Once your AZ-500 expires post-retirement, you will need to earn SC-500 from scratch to have a current Microsoft cloud security credential.
Scenario 5: You want both the current credential and the new one
Some security professionals may choose to earn AZ-500 before retirement and then pursue SC-500 when it launches. This gives you continuous certified coverage across the transition period and demonstrates both established Azure security knowledge and modern AI security competency. For senior security professionals or those in consulting roles this dual-credential approach has real career value.
How AZ-500 Preparation Transfers to SC-500
One of the most practical questions security professionals ask is how much of their AZ-500 study will carry over to SC-500. The honest answer is: a significant amount, but not everything.
The core Azure security domains — identity and access management, network security, compute and storage security, and security operations — are expected to carry forward into SC-500. Microsoft is not rebuilding cloud security fundamentals from scratch. It is adding AI security as an additional competency layer on top of a familiar foundation.
This means candidates who earn AZ-500 before retirement will have a solid foundation for SC-500 when they eventually pursue it. The incremental learning required to go from AZ-500 knowledge to SC-500 readiness will be primarily in the AI security domain rather than a complete relearning of cloud security concepts.
For candidates who cannot complete AZ-500 before retirement and jump straight to SC-500, the recommendation is to make sure your foundational Azure security knowledge is strong before focusing on the AI security additions. SC-500 will build on that foundation rather than replace it.
Best Preparation Strategy for AZ-500
If you are targeting AZ-500 before the September 30, 2026 retirement deadline, here is how to prepare effectively.
Use the official Microsoft Learn AZ-500 learning path as your foundation
Microsoft’s free learning path for AZ-500 on Microsoft Learn covers all four exam domains in structured modules. This should be your starting point and primary reference throughout your preparation.
Prioritize hands-on lab practice
AZ-500 is a practical exam. Reading about Azure security services is not enough — you need to actually configure them. Microsoft Learn sandbox environments, Azure free trial accounts, and lab-based practice platforms are essential for building the hands-on familiarity that the exam tests.
Focus heavily on Microsoft Entra ID
Identity and access management questions consistently appear across the exam. Make sure you deeply understand conditional access policies, Privileged Identity Management, Microsoft Entra ID Protection, managed identities, and service principal configurations.
Study Microsoft Sentinel and Defender for Cloud thoroughly
Security operations is a major exam domain and both Sentinel and Defender for Cloud appear extensively. Understand how to configure analytics rules, incident response workflows, workbooks, and threat intelligence in Sentinel, and how to implement security recommendations in Defender for Cloud.
Practice with realistic exam questions
After completing your learning path and labs, validate your readiness with practice questions that reflect the real exam format. Our AZ-500 exam preparation materials are designed to help you identify knowledge gaps and build confidence before exam day.
A realistic study timeline for AZ-500 is 6 to 10 weeks of consistent preparation for candidates with some Azure background, and 10 to 14 weeks for candidates newer to Azure security concepts.
Best Preparation Strategy for SC-500
Since SC-500 training is expected around July 2026, specific preparation guidance will evolve as official materials become available. Here is how to prepare intelligently in the meantime.
Build strong AZ-500 level Azure security knowledge first
Whether or not you sit the AZ-500 exam, the foundational knowledge it covers — identity, networking, compute security, security operations — will be expected as background knowledge in SC-500. If you are planning to go straight to SC-500, make sure you study these domains thoroughly using existing AZ-500 learning materials.
Learn Microsoft AI security concepts proactively
Microsoft has published documentation on securing Azure OpenAI deployments, AI governance in Microsoft Purview, Copilot security configurations, and responsible AI implementation. Studying these materials now will give you a head start on SC-500’s AI security domain before official exam prep materials are available.
Follow Microsoft’s security blog and Skills Hub for SC-500 updates
Microsoft will publish official learning paths, exam blueprints, and practice assessments for SC-500 as the exam moves through beta toward general availability. Following Microsoft Learn and the Microsoft Security Blog will ensure you have the most current preparation guidance.
Understand prompt injection and AI-specific threat vectors
AI security is meaningfully different from traditional cloud security. Prompt injection attacks, jailbreaking attempts, data exfiltration through AI model responses, and misconfigured AI permissions are distinct threat categories. Building conceptual familiarity with these attack vectors now will help you when SC-500 prep materials become available.
AZ-500 and SC-500 in the Broader 2026 Microsoft Security Landscape
The AZ-500 to SC-500 transition does not happen in isolation. It is part of Microsoft’s broader 2026 certification restructuring that is reshaping credentials across every technical track.
As we covered in our complete guide to Microsoft certifications retiring in 2026, security is one of several tracks undergoing significant change. The pattern across all tracks is consistent: Microsoft is embedding AI competency directly into role-based certifications rather than treating AI knowledge as a separate specialization.
This matters for security professionals because it means the expectation is not that you become an AI engineer. The expectation is that you understand AI well enough to secure it. That is a different and more achievable bar, and SC-500 appears designed with exactly that audience in mind.
If you are also considering how the AZ-204 to AI-200 developer transition or the AI-102 to AI-103 AI engineer transition affects your team or organization, our AZ-204 vs AI-200 guide and AI-102 vs AI-103 comparison cover those transitions in detail.
Final Verdict: AZ-500 or SC-500 in 2026
For most security professionals the answer depends on one thing: where you are in your preparation journey right now.
Choose AZ-500 if:
- You are already studying and can realistically test before September 30, 2026
- You need a recognized cloud security credential for immediate job applications
- Your current work is focused on traditional Azure security without significant AI workload responsibility
- You want a proven exam with a mature and reliable prep ecosystem
Choose SC-500 if:
- You are starting fresh in mid-2026 or later
- Your security role is expanding to include AI governance and AI-specific threats
- You want to future-proof your certification investment for the next three to five years
- You are building toward senior Microsoft security credentials like SC-100
The honest bottom line: AZ-500 and SC-500 are not competing options in the long run — they are sequential chapters in the evolution of Microsoft cloud security certification. Most security professionals will eventually need the knowledge SC-500 validates. The only real question is whether you earn AZ-500 along the way or jump straight to SC-500.
If you are close to AZ-500 ready, earn it. If you are starting fresh, build toward SC-500. Either way, the investment in Microsoft cloud security certification is well worth making in 2026.
FAQs
Is AZ-500 retiring in 2026?
Yes. Microsoft has confirmed that the Azure Security Engineer Associate certification and its associated AZ-500 exam will retire on September 30, 2026. After that date you will not be able to take the exam or earn the certification for the first time.
What is replacing AZ-500?
AZ-500 is being replaced by SC-500, the Microsoft Cloud and AI Security Engineer certification. SC-500 expands the scope of cloud security to include AI security, AI governance, and protecting AI-powered deployments alongside traditional Azure security engineering competencies.
Will my AZ-500 automatically become SC-500 after retirement?
No. Retired certifications are not converted to their replacements. SC-500 must be earned independently by completing and passing the SC-500 exam. Your existing AZ-500 credential remains on your transcript until it naturally expires but does not transfer to SC-500.
How much of AZ-500 knowledge carries over to SC-500?
A significant portion of core Azure security knowledge — identity and access management, network security, compute and storage security, and security operations — is expected to carry forward into SC-500. The primary new content in SC-500 is the AI security and governance domain which has no direct equivalent in AZ-500.
Is SC-500 harder than AZ-500?
The full SC-500 exam blueprint is not yet published so a definitive difficulty comparison is not possible. Based on Microsoft’s announced scope, SC-500 covers everything AZ-500 covers plus AI security additions. Candidates with strong AZ-500 preparation should find SC-500 manageable with focused study of the new AI security content.
When will SC-500 training and exam materials be available?
Based on Microsoft’s announcements, SC-500 training is expected around July 2026 with the exam following in the months after. Candidates planning to pursue SC-500 should monitor Microsoft Learn and the Microsoft Skills Hub for official release dates.
Can I take AZ-500 and SC-500 both?
Yes. Some security professionals may choose to earn AZ-500 before retirement and then pursue SC-500 when it launches. This approach provides continuous certified coverage across the transition and demonstrates both established Azure security expertise and modern AI security competency.
Is AZ-500 still recognized by employers in 2026?
Yes. AZ-500 remains a highly recognized and respected certification in enterprise security hiring. Its employer recognition will remain strong through its retirement date and for some time afterward as organizations continue to value certified Azure security expertise regardless of certification vintage.
Where can I find AZ-500 study materials right now?
Microsoft Learn has a complete free learning path for AZ-500. You can also use our AZ-500 exam preparation materials to validate your readiness with practice questions that reflect the real exam format before you sit the official exam.
