AZ-500 Study Guide 2026: Complete Azure Security Engineer Exam Prep
Everything you need to pass the AZ-500 Azure Security Engineer Associate exam — all 4 domains, a 6-week study plan, hands-on lab strategy, and what shows up on test day including the heavily weighted Defender for Cloud and Microsoft Sentinel content.
Quick Summary
- • AZ-500 is an Associate-level exam with 40–60 questions, 150 minutes, 700/1000 passing score
- • Covers 4 domains: identity and access, networking, compute/storage/databases, and Defender for Cloud + Sentinel
- • Identity & access (Domain 1) and Defender for Cloud/Sentinel (Domain 4) together make up 50–60% of the exam
- • Exam cost: $165 USD
What is the AZ-500 Exam?
AZ-500 is the Microsoft certification exam for Microsoft Azure Security Technologies. Passing it earns the Microsoft Certified: Azure Security Engineer Associate credential — the primary security certification for professionals who implement and manage security controls across Azure infrastructure, identity systems, and security operations.
AZ-500 spans the full Azure security stack: from Microsoft Entra ID identity hardening and Privileged Identity Management (PIM), through network security controls (NSGs, Azure Firewall, WAF, Private Endpoints), to resource-level security (Key Vault, disk encryption, SQL Always Encrypted, AKS security), and finally operational security via Microsoft Defender for Cloud and Microsoft Sentinel.
The target candidate is a security engineer who implements, manages, and monitors security across Azure environments — not necessarily building applications, but hardening and monitoring the infrastructure that applications run on. Solid knowledge of both the Azure platform (at AZ-104 level) and security concepts (Zero Trust, least privilege, defence in depth) is expected.
| Detail | Information |
|---|---|
| Exam Code | AZ-500 |
| Credential Earned | Azure Security Engineer Associate |
| Number of Questions | 40–60 questions |
| Time Limit | 150 minutes |
| Passing Score | 700 out of 1000 |
| Exam Price | $165 USD |
| Exam Level | Associate |
| Prerequisites | None formal (AZ-104 experience strongly recommended) |
| Renewal | Annual free online renewal assessment |
AZ-500 Exam Domains & Weightings
AZ-500 has four domains. Identity and access is the heaviest domain — Microsoft Entra ID is the foundation of Azure security. Domain 4 (Defender for Cloud and Sentinel) is the most operationally focused and often catches candidates off guard with its depth.
Domain 1: Secure Identity and Access
25–30%- • Azure RBAC — built-in roles (Owner, Contributor, Reader), custom roles, deny assignments, management group inheritance
- • Microsoft Entra Privileged Identity Management (PIM) — eligible vs. permanent assignments, activation, approval workflows, access reviews
- • Conditional Access — named locations, device compliance requirements, sign-in risk, user risk, report-only mode, What If tool
- • Microsoft Entra Identity Protection — risk detections, user risk policies, sign-in risk policies, remediation
- • Managed identities — system-assigned vs. user-assigned, assigning to resources, RBAC for managed identities
- • App registrations — application vs. delegated permissions, admin consent, app roles, workload identity federation
- • Identity Governance — access packages, access reviews, Lifecycle Workflows
- • Continuous Access Evaluation (CAE) — requirements, supported clients, revocation events
- • B2B collaboration — guest user access, invitation restrictions, cross-tenant access settings
- • Microsoft Entra Password Protection — global and custom banned passwords, on-premises DC agent
Study tip: PIM and Conditional Access are tested deeply with multi-condition scenarios. Know every configuration option for PIM role settings and CA grant controls — the exam frequently presents a scenario and asks which specific setting achieves a security requirement.
Domain 2: Secure Networking
20–25%- • Network Security Groups — rule evaluation order, service tags, ASGs, default rules, effective security rules
- • Azure Firewall — rule types (DNAT/network/application), rule collection groups, Firewall Policy hierarchy, threat intelligence
- • Azure Firewall Premium — IDPS signature-based detection, TLS inspection, URL filtering
- • Web Application Firewall (WAF) — OWASP rule sets, custom rules, exclusions, detection vs. prevention mode
- • DDoS Protection — Network Protection vs. IP Protection, adaptive tuning, diagnostic settings and alerts
- • Azure Bastion — SKUs (Basic/Standard/Premium), shareable links, native client support, session recording
- • Just-In-Time VM access — JIT policy configuration, request approval, audit in Activity Log
- • Private Endpoints — DNS integration, private DNS zones, cross-VNet and on-premises resolution
- • Service Endpoints — VNet rules on PaaS services, cross-subscription VNet rules, NSG interaction
- • Network Watcher — IP flow verify, packet capture, NSG flow logs, Connection Monitor
Study tip: Azure Firewall rule evaluation order (DNAT → Network → Application) and Private Endpoint DNS resolution are the most commonly tested networking security topics. Get these exactly right.
Domain 3: Secure Compute, Storage, and Databases
20–25%- • Azure Key Vault — access models (RBAC vs. access policies), soft-delete and purge protection, certificate lifecycle management, secret-level RBAC scoping
- • VM security — Trusted Launch (Secure Boot, vTPM), Microsoft Defender for Servers Plan 1 vs. Plan 2, JIT VM access
- • Disk encryption — Azure Disk Encryption (ADE with BitLocker/DM-Crypt), Server-Side Encryption with CMK, customer-managed key rotation without re-encryption
- • Storage account security — shared key access, SAS tokens, Defender for Storage, immutability policies with Lock, network access (firewall, private endpoints, service endpoints)
- • Azure SQL Database security — Transparent Data Encryption (TDE), Always Encrypted (deterministic vs. randomised), Dynamic Data Masking, SQL Auditing, Advanced Threat Protection
- • Container security — AKS network policies, workload identity, image signing with Notation/Ratify, Defender for Containers
- • App Service and Function security — managed identities for downstream service access, Key Vault references, authentication middleware
Study tip: Always Encrypted vs. Dynamic Data Masking vs. TDE is a classic exam comparison. Memorise: TDE = files at rest, DDM = masks in results (bypassed by privileged users), Always Encrypted = client-side only (even DBAs see ciphertext).
Domain 4: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
25–30%- • Microsoft Defender for Cloud — Secure Score, recommendations, security policies, Azure Security Benchmark
- • Defender for Cloud plans — Defender for Servers (Plan 1/2), Defender for Storage, Defender for SQL, Defender for Containers, Defender for Key Vault
- • Defender for Cloud workload protections — Continuous Export, automation rules, regulatory compliance dashboard
- • Microsoft Sentinel — workspace architecture, data connectors (native, CEF, Syslog, Log Analytics agent)
- • Sentinel analytics rules — scheduled queries, near-real-time (NRT) rules, anomaly rules, Fusion rules
- • Sentinel automation — playbooks (Logic Apps), automation rules, SOAR orchestration
- • Sentinel UEBA — entity behaviour profiles, anomaly detection, investigation graph
- • KQL (Kusto Query Language) — basic query structure, project, where, summarize, join, ago(), extend, parse
- • Threat hunting in Sentinel — hunting queries, bookmarks, custom entities
- • Incident management — severity, assignment, investigation, triage workflow, closing codes
Study tip: KQL is tested — not deeply, but enough that you need to read and understand Sentinel query logic. Study the most common KQL operators: project, where, summarize, join, extend, ago(). You will not write queries from scratch but you will be asked to identify what a given query does or which operator to add.
Ready to test yourself?
Try 40 Free AZ-500 Practice Questions
Scenario-based questions with detailed explanations covering all 4 domains. No credit card required.
Start Free Practice →How Hard is AZ-500?
AZ-500 is widely considered one of the hardest Associate-level Azure exams. The difficulty comes from the combination of breadth (identity, networking, compute, storage, databases, SIEM, SOAR) and depth (each domain goes well beyond surface-level configuration). The exam rewards candidates who have actually implemented Azure security controls in production environments.
Scenario questions are the norm — you will rarely see a straightforward "what does feature X do?" question. Instead, the exam describes a multi-constraint security requirement and asks which specific configuration achieves it. Many questions have two plausible answers that differ in one meaningful way.
Why candidates fail AZ-500
- • Weak Microsoft Sentinel knowledge: Sentinel is 10–15% of the exam — candidates from infrastructure backgrounds often underestimate how much SOC tooling knowledge is required
- • Surface-level PIM knowledge: Many candidates know PIM exists but cannot answer detailed questions about approval workflows, role settings configuration, and break-glass account procedures
- • Confusing encryption options: TDE vs. Always Encrypted vs. Dynamic Data Masking vs. CMK vs. ADE — the exam tests the distinctions in scenario form
- • Skipping KQL: Not learning basic KQL means losing all Sentinel query-related questions, which appear consistently across exam versions
- • Ignoring deny assignments: RBAC deny assignment behaviour (deny overrides allow at any scope) is a frequent and commonly missed question type
6-Week AZ-500 Study Plan
This plan assumes 1.5–2 hours per day with hands-on lab time built in. A free Azure account provides sufficient resources for most labs — Sentinel requires a Log Analytics workspace (minimal cost for trial use). AZ-104 experience or equivalent is assumed.
Week 1: Identity and Access Security
- Days 1–2: Azure RBAC deep dive — built-in roles, custom role creation, deny assignments, management group inheritance, effective permissions analysis
- Days 3–4: Privileged Identity Management — eligible vs. permanent, role settings (MFA, approval, duration, justification), access reviews, break-glass accounts
- Days 5–6: Conditional Access — all grant controls, session controls, named locations, risk-based policies, What If tool, Report-only mode
- Day 7: Lab — configure PIM eligible assignment for Global Admin with approval workflow; test Conditional Access What If for a blocked-location scenario
Week 2: Identity Protection, Managed Identities & App Security
- Days 1–2: Identity Protection — risk detections (leaked credentials, atypical travel, impossible travel), user risk and sign-in risk policies, remediation workflow
- Days 3–4: Managed identities — system-assigned vs. user-assigned lifecycle, assigning RBAC roles to managed identities, DefaultAzureCredential usage
- Days 5–6: App Registrations — application vs. delegated permissions, admin consent, workload identity federation for DevOps pipelines, CAE requirements
- Day 7: Identity Governance — entitlement management access packages, Lifecycle Workflows, access reviews for privileged group membership
Week 3: Network Security
- Days 1–2: NSGs — rule evaluation, service tags, ASGs, effective security rules view, flow logs and Traffic Analytics
- Days 3–4: Azure Firewall Standard and Premium — rule types, evaluation order (DNAT/network/application), Firewall Policy hierarchy, IDPS, TLS inspection
- Day 5: WAF (Application Gateway and Front Door) — OWASP rule sets, exclusions, custom rules, prevention vs. detection mode
- Day 6: Bastion (SKUs and features), JIT VM Access (configuration and audit), DDoS Protection (tiers and alerting)
- Day 7: Private Endpoints and DNS — private DNS zone linking, on-premises resolution via Private DNS Resolver; Service Endpoints vs. Private Endpoints comparison
Week 4: Compute, Storage & Database Security
- Days 1–2: Key Vault — RBAC model vs. access policies, secret-level RBAC scoping, soft-delete, purge protection, certificate auto-renewal, Key Vault HSM
- Days 3–4: Disk and VM security — ADE vs. SSE with CMK, Trusted Launch (Secure Boot/vTPM), Defender for Servers Plan 1 vs. Plan 2
- Day 5: Storage account security — shared key disabling, SAS token types (service/account/user delegation), immutability with Lock, Defender for Storage
- Day 6: SQL Database security — TDE vs. Always Encrypted vs. DDM, SQL Auditing targets (Log Analytics + Storage), vulnerability assessment, Ledger
- Day 7: Container and AKS security — workload identity, network policies, Notation/Ratify image signing, Defender for Containers, Secrets Store CSI driver
Week 5: Defender for Cloud & Microsoft Sentinel
- Days 1–2: Defender for Cloud — Secure Score, recommendations, all Defender plans (Servers P1/P2, Storage, SQL, Containers, Key Vault), Continuous Export
- Days 3–4: Microsoft Sentinel — workspace setup, data connectors, analytics rules (scheduled/NRT/anomaly/Fusion), UEBA
- Day 5: Sentinel automation — playbooks (Logic Apps trigger), automation rules, SOAR workflow design for common incident types
- Day 6: KQL fundamentals — project, where, summarize, join, extend, ago(), parse, count, distinct — practice writing 10 basic security queries
- Day 7: Threat hunting — hunting queries, bookmarks, entity investigation, incident management workflow (triage, assign, investigate, close)
Week 6: Mock Exams & Targeted Review
- Days 1–2: Review highest-impact areas: PIM scenarios, Conditional Access combinations, Azure Firewall rule order, Always Encrypted vs. DDM vs. TDE
- Day 3: Full 150-minute timed mock exam
- Days 4–5: Targeted review of any domain below 70%; re-do KQL exercises if Sentinel is a weak point
- Day 6: Second full mock exam — aim for 80%+
- Day 7: Light review only. Book exam if consistently 80%+.
Best AZ-500 Study Resources
1. Microsoft Learn AZ-500 Learning Path (Free)
The official learning path is the most authoritative source and essential for Defender for Cloud and Sentinel content, which changes frequently as Microsoft releases new security features. Complete every hands-on exercise — Sentinel labs in particular build the operational intuition needed for scenario questions. The learning path is long (40+ hours) but comprehensive.
2. MSCertQuiz AZ-500 Practice Tests
500 AZ-500 practice questions across all four domains with detailed explanations. The question bank is particularly strong on PIM scenario questions, RBAC deny assignment edge cases, Conditional Access policy accumulation, encryption comparison scenarios, and Sentinel KQL interpretation — the areas where most candidates drop the most marks.
Start free AZ-500 practice →3. John Savill's AZ-500 Study Cram (YouTube)
Savill's AZ-500 content is among the best available. His coverage of identity security (PIM configuration, Conditional Access policy design) and the Defender for Cloud / Sentinel landscape is particularly strong. Watch his "Azure Security Master Class" for the full-depth treatment before moving to exam-focused review.
4. Microsoft Sentinel KQL for Beginners (Microsoft Learn)
KQL is a distinct query language — do not skip it. Microsoft Learn's "Write your first query with Kusto Query Language" module gives you the operators needed for the exam in about 3 hours. Focus on: where, project, summarize, extend, join, ago(), count, and string operations. The Log Analytics demo environment lets you practice against real Microsoft log data for free.
5. Azure Security Benchmark Documentation
The Microsoft Cloud Security Benchmark (successor to Azure Security Benchmark) maps Defender for Cloud recommendations to security controls. Reading through the controls for compute, networking, identity, and data sections gives you the security reasoning behind many exam scenarios — understanding why a recommendation exists helps you pick the right answer when multiple options look plausible.
AZ-500 Exam Day Tips
Do
- • For RBAC questions: deny assignments always override role assignments at any scope — even Owner cannot bypass a deny assignment
- • For PIM questions: eligible = must activate on-demand; permanent = always active. Know every activation setting option
- • For encryption questions: use the DBA-visibility test — if the question says DBAs must not see data, Always Encrypted is the only answer
- • For CA policy questions: when multiple CA policies match, the most restrictive combined result applies (block beats grant+MFA)
- • For Sentinel questions: analytics rules generate incidents; automation rules and playbooks respond to incidents
Don't
- • Don't confuse Dynamic Data Masking with Always Encrypted — DDM is bypassed by db_owner; Always Encrypted is not
- • Don't confuse Azure Firewall rule types — Network rules are evaluated before Application rules, regardless of rule collection priority numbers
- • Don't forget that creating a Private Endpoint does not disable the public endpoint — you must explicitly disable public network access separately
- • Don't skip KQL — even basic Sentinel questions require reading and interpreting KQL query logic
- • Don't select "Defender for Cloud" when a question asks specifically about SIEM/threat hunting — that is Microsoft Sentinel
AZ-500 Encryption Quick Reference
TDE
- • Protects data at rest (files)
- • Transparent to applications
- • DBAs can read plaintext
- • PMK or CMK
Always Encrypted
- • Client-side encryption
- • DBAs see ciphertext only
- • Deterministic = queryable
- • Randomised = not queryable
Dynamic Data Masking
- • Masks in query results
- • Not encryption
- • db_owner bypasses it
- • Easy to implement
Ready to Practice AZ-500?
500 scenario-based questions across all 4 domains. Practice mode with explanations + timed exam simulation.
Start Free Practice →Related Resources
SC-300 Study Guide 2026
SC-300 goes even deeper on identity and access — a natural companion or next step after AZ-500 Domain 1.
SC-300 vs AZ-500: Which to Take?
A direct comparison of both security exams — understand the overlap and differences before choosing your next certification.
SC-200 Study Guide 2026
SC-200 (Security Operations Analyst) goes deeper on Microsoft Sentinel and KQL — a strong next step after AZ-500.
AZ-104 Study Guide 2026
AZ-104 Azure Administrator is the best preparation for AZ-500 — covers the Azure fundamentals that AZ-500 security questions assume.
Frequently Asked Questions
Do I need AZ-104 before AZ-500?
AZ-104 is not a formal prerequisite, but AZ-500 assumes you already understand Azure resource management, virtual networking, storage, and basic identity concepts. Candidates who attempt AZ-500 without AZ-104-level knowledge typically struggle with the networking domain and find the compute/storage/database security content hard to contextualise. Completing AZ-104 first (or having 12+ months of hands-on Azure admin experience) is strongly recommended.
How is AZ-500 different from SC-300?
AZ-500 covers the full Azure security stack — identity, networking, compute/data, and SOC tooling. SC-300 focuses exclusively and deeply on identity and access management with Microsoft Entra ID. AZ-500's identity domain (Domain 1) overlaps significantly with SC-300, but AZ-500 spends the other 70% on networking, resource security, and security operations. If you want depth in identity only, take SC-300. If you want the full Azure security engineer profile, take AZ-500.
Is Microsoft Sentinel heavily tested on AZ-500?
Yes. Domain 4 (Defender for Cloud and Sentinel) is 25–30% of the exam, and Microsoft Sentinel makes up a significant portion of that domain. You need to understand data connectors, analytics rule types, automation with playbooks and automation rules, UEBA, threat hunting, and basic KQL. Candidates who treat Sentinel as a minor topic and skip KQL routinely fail this section.
What is the passing score for AZ-500?
The passing score for AZ-500 is 700 out of 1000. Microsoft uses a scaled scoring model, meaning the raw percentage needed varies by exam version. Aim for 80%+ on practice exams before booking your appointment — this provides enough margin for the scaled scoring and question variability across versions.
How long does it take to prepare for AZ-500?
Most candidates with solid Azure experience (AZ-104 level) require 6–8 weeks at 1.5–2 hours per day. Security engineers with hands-on Entra ID, Defender for Cloud, and Sentinel experience may be ready in 4–5 weeks. Candidates coming from a networking or development background with limited security operations experience should budget 8–10 weeks to build sufficient Sentinel and Defender for Cloud depth.