If you’ve been circling AZ-500, the clock is now real.
The exam retires August 31, 2026, at 11:59 PM Central Standard Time. After that date you can no longer earn or renew the Azure Security Engineer Associate certification. The replacement is already live, but it comes with a catch worth knowing before you book anything.
Deciding between them comes down to three questions.
What Is Actually Retiring
This is a full sunset, not a version bump.
AZ-500 is the exam. “Microsoft Certified: Azure Security Engineer Associate” is the certification it earns. Both retire August 31, 2026, and so do the renewal assessments. Microsoft associate certifications expire 12 months after you pass and normally renew through a free online assessment. Once the renewal assessment retires with the exam, that path closes too.
So a pass in August 2026 gives you a valid credential for 12 months from your exam date, with no way to renew it afterward. If you need the Azure Security Engineer title on record for the next year, that still works. If you want a credential you can keep current, it doesn’t.
What SC-500 Is (and the Beta Catch)
The successor is Exam SC-500, “Implementing End-to-End Security Controls for Cloud and AI Workloads.” Passing it earns Microsoft Certified: Cloud and AI Security Engineer Associate.
It is not a renamed AZ-500. The role is wider: Azure plus Microsoft 365, plus a full domain on securing AI workloads. Passing score is 700, same as AZ-500, and you get 120 minutes instead of AZ-500’s 100.
The catch: as of mid-July 2026, SC-500 is still a beta exam. That means three things. You won’t get your score right after you finish, because Microsoft is still calibrating the questions. The exam is English only for now. And there’s no official practice assessment yet, since those usually appear within eight weeks of an exam leaving beta. If you need a score fast, beta is a real consideration.
What Carries Over From AZ-500
Most of your AZ-500 study time transfers. The topics didn’t disappear, they got reorganized into new domains.
AZ-500 domains (as of January 22, 2026):
| Domain | Weight |
|---|---|
| Secure identity and access | 15–20% |
| Secure networking | 20–25% |
| Secure compute, storage, and databases | 20–25% |
| Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel | 30–35% |
SC-500 domains:
| Domain | Weight |
|---|---|
| Manage identity, access, and governance | 20–25% |
| Secure storage, databases, and networking | 25–30% |
| Secure compute | 20–25% |
| Manage and monitor security posture | 20–25% |
The mapping is close to one for one on the core Azure material:
- Identity and access work (PIM, Conditional Access, MFA, managed identities, app registrations, OAuth consent, RBAC roles, Key Vault) moves into “Manage identity, access, and governance.”
- Networking and data (NSGs and ASGs, Virtual Network Manager, Virtual WAN, VPN, Private Endpoints, Private Link, Azure Firewall, Network Watcher, storage account security, Azure SQL auditing, Defender for Storage and Databases) becomes “Secure storage, databases, and networking,” now the heaviest SC-500 domain.
- Compute security (disk encryption, Azure Bastion, just-in-time VM access, AKS and container security, App Service, Web Application Firewall) sits in “Secure compute.”
- Defender for Cloud and Sentinel posture (CSPM, workload protection plans, AWS and GCP multicloud connectors, EASM, Sentinel data connectors and automation) becomes “Manage and monitor security posture.”
The biggest structural shift: on AZ-500, Defender for Cloud and Sentinel is one dominant 30–35% block. On SC-500 that content is trimmed to 20–25% to make room for the new material.
What’s New in SC-500
Three areas are genuinely new, and none of them were on AZ-500.
Securing AI workloads. This is the headline addition, folded into the “Secure compute” domain. It covers finding data overexposure in SharePoint, spotting Copilot and AI-app risks with Microsoft Purview Data Security Posture Management, protecting Copilot Studio agents, applying Conditional Access to Microsoft Entra Agent ID, analyzing an agent’s blast radius in Defender XDR, deploying an AI Gateway in API Management for Microsoft Foundry, enabling Defender for AI, and setting guardrails in Foundry. If your day job doesn’t touch AI yet, this is where you’ll spend the most new study time.
Microsoft Security Copilot. SC-500 expects you to configure Security Copilot workspaces, manage its roles and permissions, and enable plugins and agents. AZ-500 had none of this.
A Microsoft 365 footprint. AZ-500 lived almost entirely in Azure. SC-500 pulls in Purview, SharePoint data exposure, and managing agents from the Microsoft 365 admin center. The stated prerequisites now include familiarity with Microsoft 365 administration on top of the Azure and Entra ID experience AZ-500 already assumed. Azure Arc for hybrid and multicloud servers and Microsoft Entra Private Access also show up as new named topics.
Take AZ-500 Before August 31 If…
You’re already deep in prep. If you’ve been studying for weeks and scoring in range on practice questions, book it now. Restarting on a broader exam with an AI domain you haven’t touched isn’t a good trade with the deadline this close.
You need the Azure Security Engineer title specifically. Some partner requirements and internal frameworks name that credential. Earning it now gives you a year of validity to work with, even though it won’t renew.
You want a scored result quickly. AZ-500 scores immediately. SC-500, in beta, does not.
Aim Straight at SC-500 If…
You haven’t started yet. Don’t sprint toward a credential that can’t be renewed. SC-500 is where Microsoft is taking this role.
You already work with AI security, Purview, or Microsoft 365. The new domains map to what you’re likely doing already. That live experience is your study material, and it’s the part of SC-500 that trips up pure-Azure candidates.
You can wait out the beta. If you don’t need a score this month, the beta window is fine. You take the exam now, and the score lands once Microsoft finishes calibrating.
Quick Reference
| Detail | AZ-500 | SC-500 |
|---|---|---|
| Certification | Azure Security Engineer Associate | Cloud and AI Security Engineer Associate |
| Status | Retires August 31, 2026 | Live, currently beta |
| Duration | 100 minutes | 120 minutes |
| Pass score | 700 | 700 |
| Languages | 10 languages | English only (beta) |
| AI security content | No | Yes |
| Microsoft 365 scope | Minimal | Yes |
| Renewable after retirement | No | Yes |
The honest read: if you’re ready, sit AZ-500 this month and bank the credential. If you’re starting from scratch, or your work already spans AI and Microsoft 365 security, skip it and prepare for SC-500. Just plan around the beta scoring delay.
Pass-IT has practice questions for both AZ-500 and SC-500, generated from Microsoft’s official documentation with per-domain tracking, so you can see exactly which sections need work before the deadline. Free to start, no card for your first session.
