Short answer: AZ-500 (Azure Security Engineer Associate) retires on August 31, 2026. Microsoft's designated replacement is SC-500(Cloud and AI Security Engineer Associate) — it keeps roughly 80% of AZ-500's content (identity, networking, storage/database, Defender for Cloud, Sentinel) and adds a new domain covering AI-workload security: Copilot, Microsoft Entra Agent ID, and Defender for AI. If you can't finish AZ-500 before it retires, SC-500 is the exam to prepare for instead.
Heads up: AZ-500 retires on August 31, 2026, 11:59 PM Central Time — after that date you can no longer take the exam or renew an existing AZ-500 certification. Already-earned certifications stay on your Microsoft Learn transcript, they just can't be renewed going forward. See Microsoft's SC-500 certification page to start preparing for the replacement exam.
Side-by-Side Comparison
| Category | AZ-500 | SC-500 |
|---|---|---|
| Full Name | Microsoft Azure Security Technologies | Implementing End-to-End Security Controls for Cloud and AI Workloads |
| Certification Status | Retiring August 31, 2026 | Current — active replacement |
| Exam Price | $165 USD | $165 USD |
| Questions | 40–60 | 40 |
| Time Limit | ~120–150 minutes | 100 minutes |
| Passing Score | 700/1000 | 700/1000 |
| Domains | 4 domains | 4 domains (restructured) |
| AI Security Content | None | New domain — Copilot, Entra Agent ID, Defender for AI |
| Renewal | Free annual assessment (until retirement) | Free annual assessment |
| Level | Associate | Associate |
Why AZ-500 Is Retiring
Microsoft reviews its certification program every quarter and retires exams that no longer reflect the current shape of a role. Security engineering has expanded beyond infrastructure — organizations now need engineers who can also secure the AI systems (Copilot, agents, Foundry-based workloads) they're deploying. Rather than bolt AI security onto AZ-500 as an update, Microsoft replaced the exam outright with a broader one.
From Microsoft's own announcement: “AZ-500 is retiring. SC-500 offers a flexible transition.” During the transition window, Microsoft Partners can use either credential to meet Security Solutions Partner skilling requirements — but for anyone not already AZ-500 certified, SC-500 is the only path forward after August 2026.
Domain-by-Domain: What Carries Over
SC-500 isn't a from-scratch exam. Microsoft restructured AZ-500's four domains into a new four-domain layout, folded Key Vault into the identity domain, merged networking with storage/database security, and added AI-workload security inside the compute domain. Here's the mapping:
Carries over almost intact — RBAC, PIM, Conditional Access, Identity Protection, managed identities, app registrations. SC-500 folds in Key Vault (previously Domain 3 on AZ-500) as part of this domain.
Merged with AZ-500's storage/database security into one larger domain — NSGs, Azure Firewall, Private Link, Virtual WAN, plus Azure SQL and storage account protections. Same skills, one domain instead of two.
VM/server hardening, containers, and app platform security carry over directly. This is also where the entirely new AI-security content lives — Copilot, Entra Agent ID, Defender for AI, Foundry AI Gateway — which has no AZ-500 equivalent.
Defender for Cloud, Sentinel data connectors, and automation rules carry over. Microsoft Security Copilot configuration is added as new content.
What's Actually New in SC-500
The only content with no AZ-500 equivalent is AI-workload security, tested inside the Secure Compute domain:
- • Microsoft Entra Agent ID — conditional access for AI agents, blast-radius analysis with Defender XDR, access management
- • Copilot and AI app risk — identifying SharePoint data overexposure, real-time protection for Copilot Studio agents, Purview Data Security Posture Management (DSPM)
- • Defender for AI — enabling AI workload protection in Defender for Cloud, monitoring via the Data and AI security dashboard
- • Microsoft Foundry security — AI Gateway configuration in API Management, agent guardrails in Foundry
- • Microsoft Security Copilot — workspace configuration, plugin and agent management, permissions
Everything else — RBAC, PIM, Conditional Access, NSGs, Azure Firewall, Key Vault, storage/database encryption, Defender for Cloud, and Sentinel — is the same skill set AZ-500 tested, just redistributed across SC-500's domains.
Should You Finish AZ-500 or Start SC-500?
Finish AZ-500 If:
- • You're already mid-preparation and can realistically test before August 31, 2026
- • A job posting, contract, or partner requirement specifically names AZ-500
- • You want the fastest path to a credential right now — AZ-500 study materials are more mature
Start SC-500 Instead If:
- • You're starting preparation from zero and won't be exam-ready before the retirement date
- • Your role increasingly touches Copilot, AI agents, or Foundry workloads
- • You want a credential that keeps renewing — SC-500 has no retirement date yet
Already AZ-500 Certified?
Your certification stays on your Microsoft Learn transcript. It just won't be renewable after August 31, 2026. Most AZ-500 holders won't need to rush — plan to add SC-500 later specifically for the AI-security domain, since your existing Azure security knowledge transfers directly.
Frequently Asked Questions
Is SC-500 replacing AZ-500?
Yes. Microsoft has stated directly: "AZ-500 is retiring. SC-500 offers a flexible transition." AZ-500 (Microsoft Certified: Azure Security Engineer Associate) retires August 31, 2026 at 11:59 PM Central Time, and SC-500 (Microsoft Certified: Cloud and AI Security Engineer Associate — exam name "Implementing End-to-End Security Controls for Cloud and AI Workloads") is Microsoft's designated successor.
Should I still take AZ-500, or go straight to SC-500?
If you can realistically prepare and sit AZ-500 before August 31, 2026, and your organization's partner or job requirements still reference AZ-500 by name, finishing it now is often faster since study materials for it are more mature. If you're starting from zero and won't be exam-ready before the retirement date, skip straight to SC-500 — it covers everything AZ-500 did plus AI security, and it's the credential that will actually keep renewing after August 2026.
What happens to my AZ-500 certification after it retires?
Certifications you've already earned stay on your Microsoft Learn transcript permanently — retirement does not revoke a credential you hold. What changes is that you can no longer take the AZ-500 exam or complete its annual free renewal assessment after August 31, 2026, so an already-earned AZ-500 will eventually show as expired rather than renewed. For Microsoft Partners, AZ-500 continues to count toward Security Solutions Partner designation requirements for one year after retirement.
Is SC-500 harder than AZ-500?
SC-500 covers a superset of AZ-500's content — the same identity, networking, compute, storage, and Defender for Cloud/Sentinel material, plus an entirely new AI-security domain covering Copilot, Microsoft Entra Agent ID, Defender for AI, and Security Copilot. If you already know AZ-500's material, the incremental difficulty is concentrated in that new AI-security content. If you're starting fresh, expect SC-500 prep to take slightly longer than AZ-500 did, simply because there's more exam-relevant surface area.
Can I use AZ-500 to meet Microsoft Partner skilling requirements after it retires?
During the transition period, Microsoft Partners can use either AZ-500 or SC-500 to meet Security Solutions Partner designation and specialization requirements — existing AZ-500 certifications remain valid for this purpose until retirement, and no immediate action is required. Microsoft has said to continue using AZ-500 for current skilling needs and start planning future skilling around SC-500 as it becomes generally available.
Does SC-500 cost the same as AZ-500?
Yes. Both exams are $165 USD with a 700/1000 passing score. AZ-500 runs 40–60 questions depending on the attempt; SC-500 is documented at 40 questions over 100 minutes. Retake pricing and Exam Replay vouchers work the same way for both.
Start SC-500 Practice Today
500 scenario-based questions covering all four SC-500 domains, including the new AI-security content AZ-500 never tested. Free to start.
Try SC-500 Practice Free →Related Resources
SC-500 Study Guide 2026
All four SC-500 domains, including the AI-security content that's new to this exam.
Free SC-500 Practice Questions
Try scenario-based SC-500 questions before you commit to full prep.
SC-500 Cheat Sheet 2026
Quick-reference tables for final review.
AZ-500 Study Guide 2026
If you're finishing AZ-500 before it retires, start here.
SC-300 vs AZ-500 Comparison
How AZ-500 compared to the Identity Administrator track before retirement.
SC-500 Certification Page
500 practice questions, exam details, and FAQs for SC-500.