AZ-500 Is Retired: What to Study for SC-500 (Domain-by-Domain Map)

The short answer

If you were preparing for AZ-500, stop. Microsoft retired the exam, the Azure Security Engineer Associate certification and its renewal assessments on August 31, 2026. The replacement is exam SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads, which leads to Microsoft Certified: Cloud and AI Security Engineer Associate. It is a separate certification, not a renewal or a conversion of AZ-500.

Most of your Azure security study still applies: identity, networking, storage and databases, Defender for Cloud and Microsoft Sentinel are all on the new exam. What SC-500 adds is AI workload security and Security Copilot, so budget extra time for those two areas and treat the rest as a refresher with new product names.

What happened, and what did not

• AZ-500 and the Azure Security Engineer Associate certification retired on August 31, 2026. Microsoft's own certification page now carries the warning that you can no longer earn or renew it after that date.
• If you already hold AZ-500, it stays in the Active Certifications section of your Microsoft Learn transcript until its expiry date, then moves to Historical Certifications. Retirement does not revoke a certification you earned. That is Microsoft's credential retirement policy, not a courtesy.
• Renewal is gone. A renewable certification has to be renewed before it retires. After the retirement date the renewal assessment is simply not offered, so an AZ-500 that expires in 2027 cannot be extended.
• There is no transition exam and no automatic conversion. SC-500 is a new exam with its own study guide, its own skills outline and the usual passing score of 700.
• Ignore third-party pages that still say there are "a few weeks left" to pass AZ-500. They were written before the deadline and never updated.

Domain map: where your AZ-500 study lands in SC-500

The weights below come from Microsoft's SC-500 study guide (last updated July 31, 2026). The lesson numbers refer to the free Protego SC-500 course, which follows the same outline, so you can jump straight to the lessons you need.

Reader takeaway: if you already know the AZ-500 material, lessons 11, 12 and 18 are the gap. Those cover Purview Data Security Posture Management for AI and Copilot risks, Entra Agent ID and Foundry guardrails, and Security Copilot. Everything else is revision.

One detail worth knowing before you plan: Microsoft lists AI security as a sub-area of "Secure compute", not as a domain of its own. It shares the 20 to 25 percent with servers, containers and application platforms, so the AI questions are real but they are not a quarter of the exam by themselves.

What SC-500 asks that AZ-500 never did

These are the AI objectives from the "Implement security for AI" section of the study guide, in Microsoft's wording, lightly shortened. If any of them is unfamiliar, that is where your extra study time goes.

• Identify overexposure of data in SharePoint, and identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM).
• Enable and configure real-time protection for Microsoft Copilot Studio agents, and manage agents in the Microsoft 365 admin center.
• Implement Conditional Access for Microsoft Entra Agent ID, manage Agent ID access, and analyze the blast radius of Agent ID risks in Defender XDR.
• Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry, and configure guardrails for agent security in Foundry.
• Enable Defender for AI Service in Defender for Cloud and monitor AI security from its Data and AI security dashboard.
• Implement Microsoft Security Copilot: workspaces, permissions and roles, plugins, and Microsoft and Security Store agents (this sits in the posture domain).

Prerequisites, honestly

The study guide does not require AZ-104 or any other exam. It expects practical experience administering Azure and hybrid environments, including compute, network and storage, strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration. If you studied for AZ-500 you already meet the first two. The Microsoft 365 part matters more than it looks, because the AI objectives lean on Purview and Copilot, which live on that side of the house.

A four-week study order for ex-AZ-500 candidates

This is our suggested order, not a Microsoft recommendation. It assumes you were close to exam-ready for AZ-500.

1. Week 1: skim lessons 1 to 10 as a refresher. Take the identity and network questions from the SC-500 practice exam and only dig into what you miss.
2. Week 2: lessons 11 and 12, AI apps and agents. Write a one-page lab note for each: what Purview DSPM for AI actually shows you, and what changes once an agent has an Entra Agent ID.
3. Week 3: lessons 13 to 17, compute, containers, posture management and Sentinel. Pay attention to the Defender for Cloud plans and the Sentinel data collection objectives; both are more detailed than the AZ-500 versions.
4. Week 4: lesson 18 on Security Copilot, then the full 50-question practice exam twice, 48 hours apart. Book the real exam only when the second attempt is comfortably above the pass mark.

The free course covers every objective at the depth of the study guide. If you want instructor-led depth with hands-on labs for the AI security objectives, a Pluralsight trial is the training library that fits this exam best; the free course first, the trial second.

Frequently asked questions

Can I still take AZ-500?

No. The exam retired on August 31, 2026, together with the certification and its renewal assessment.

Does my AZ-500 certification disappear?

No. An earned certification stays in the Active Certifications section of your transcript until it expires, then moves to Historical Certifications. It cannot be renewed after the retirement date.

Is SC-500 harder than AZ-500?

Nobody has data on that yet, and we will not invent a difficulty ranking. It covers the same Azure security core plus AI workload security and Security Copilot, so it is broader. Whether it is harder depends on how much Microsoft 365 and Purview experience you bring.

Do I need AZ-104 first?

No exam is required. The study guide describes expected experience, not prerequisites: Azure and hybrid administration, strong Entra ID familiarity, and familiarity with Microsoft 365 administration.

Which should I take: SC-500, SC-200 or SC-300?

SC-500 for cloud and AI security engineering, SC-200 for security operations, SC-300 for identity and access. Our three-way comparison walks through each with job roles and study time.

Sources

• Microsoft Learn, Study guide for Exam SC-500 (updated July 31, 2026): skills measured, weights and audience profile.
• Microsoft Learn, Microsoft Certified: Azure Security Engineer Associate: retirement notice dated August 31, 2026.
• Microsoft Learn, Credential retirement: what happens to earned certifications and renewals after a retirement.
• Protego, SC-500 course: the 18 lessons referenced in the domain map.