Can I still take the AZ-500 exam?

No. AZ-500 retired on 31 August 2026 at 11:59 PM Central Standard Time, and the Azure Security Engineer Associate certification retired on the same date. The current exam for this role is SC-500, which earns Microsoft Certified: Cloud and AI Security Engineer Associate.

I passed AZ-500 before it retired. Is my certification still valid?

Yes, until its expiry date. Microsoft keeps a retired certification in the Active section of your transcript until it expires and then moves it to Historical. Renewal is not possible after retirement, so if you want an active security engineer certification without a gap, pass SC-500 before your current one expires.

Is SC-500 harder than AZ-500?

It is broader rather than simply harder. SC-500 keeps most Azure security topics and adds securing AI workloads, Microsoft Entra Agent ID, Purview data security posture for Copilot, Security Copilot and more Sentinel data collection. It also expects familiarity with Microsoft 365 administration, which AZ-500 did not.

Is there an official SC-500 practice assessment?

Not yet, as of October 2026. Microsoft's certification page says practice assessments are usually published within eight weeks of an exam leaving beta and becoming generally available. Until then, use the free exam sandbox to learn the interface and build the labs in the study guide.

Should I take AZ-104 before SC-500?

For most people, yes. Microsoft lists no prerequisite certification, but the SC-500 profile expects practical experience administering Azure and hybrid compute, networking and storage, plus strong Entra ID knowledge. AZ-104 builds exactly that base, so the security objectives make sense when you meet them.

AZ-500 Exam Retired: SC-500 Security Engineer Guide for India

You can no longer take AZ-500. Microsoft retired the exam and the Azure Security Engineer Associate certification on 31 August 2026. The replacement is SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads, which earns Microsoft Certified: Cloud and AI Security Engineer Associate. SC-500 keeps most AZ-500 ground and adds a new block on securing AI: Copilot Studio agents, Entra Agent ID and Foundry guardrails.

At a glance

AZ-500 status: exam and certification retired on 31 August 2026
Replacement exam: SC-500, available from 21 July 2026
Certification: Cloud and AI Security Engineer Associate, intermediate level
Skills measured: four areas, with securing AI inside "Secure compute"
Expected experience: practical Azure and hybrid administration, strong Microsoft Entra ID, some Microsoft 365 administration
Pass mark: 700 or greater
Exam time: 100 minutes for role-based exams, or 120 if the exam contains labs
Practice assessment: not yet available when this was written

What the AZ-500 retirement means for you

If you hold Azure Security Engineer Associate, it stays in the Active section of your Microsoft Learn transcript until it expires, according to Microsoft's credential retirement page. After that it moves to Historical. You cannot renew a retired certification, so plan SC-500 before your expiry date if you want an active security engineer credential on your profile.

If you were preparing for AZ-500, most of your work carries over: Entra ID, Key Vault, network security groups, private endpoints, Azure Firewall, Defender for Cloud and Microsoft Sentinel all remain. Add the AI security block and the Microsoft 365 pieces.

If your employer is a Microsoft partner, the July 2026 Partner Center announcements name Cloud and AI Security Engineer Associate as the replacement in the Security designation and the Cloud Security specialisation. AZ-500 certifications earned before retirement keep counting for partner requirements for one year after retirement. If your security practice is asking for SC-500 rather than AZ-500, this is why.

AZ-500 versus SC-500

The table compares the last AZ-500 outline (January 2026) with the SC-500 study guide.

Area	AZ-500	SC-500
Identity and governance	15 to 20%: identity and access	20 to 25%: identity, Key Vault, Azure Policy, RBAC
Storage, databases, networking	Split across two areas	25 to 30%
Compute	Part of a 20 to 25% area	20 to 25%: AI, servers and VMs, app platforms
Posture and monitoring	30 to 35%: Defender for Cloud and Sentinel	20 to 25%: Defender for Cloud, Sentinel, Security Copilot

New in SC-500: the AI security objectives below, Microsoft Entra Private Access, Azure Arc for hybrid and multicloud servers, Azure Machine Configuration, Logic Apps security, Sentinel content hub solutions, syslog and CEF collection, Windows Event Forwarding, custom log tables, Sentinel data retention, querying Microsoft Purview Audit in Defender XDR, and Microsoft Security Copilot.

No longer named individually: Application Gateway, Front Door and CDN, recommending DDoS Protection, ExpressRoute encryption, App Service Environment network settings, and specific Azure SQL features such as dynamic masking and Always Encrypted. Azure SQL now appears as "platform-level security configurations", auditing and Defender for Databases.

The shift in the audience profile matters as much as the objectives. AZ-500 was an Azure exam. SC-500 expects familiarity with Microsoft 365 administration too, because AI workloads pull SharePoint, Copilot and agents into the security engineer's scope.

The AI security block, in plain words

The "Implement security for AI" objectives are the part most candidates have never touched at work. Here is what each asks, in order:

Find overshared SharePoint data, because Copilot can only surface what a user can already reach.
Use Purview Data Security Posture Management (DSPM) to spot risks from Microsoft Copilot and other AI apps.
Turn on real-time protection for Copilot Studio agents.
Apply Conditional Access to Microsoft Entra Agent ID, the identity an agent signs in with, and manage what those agent identities can reach.
Analyse blast radius for Agent ID risks in Defender XDR.
Deploy the AI Gateway in Azure API Management in front of Microsoft Foundry.
Enable Defender for AI Services in Defender for Cloud, configure Foundry guardrails for agents, and watch the Data and AI security dashboard.
Manage agents in the Microsoft 365 admin center.

For labs you need both an Azure subscription and a Microsoft 365 tenant with suitable licences. Budget for that before you start, or use a course that provides lab access.

Labs that map to the exam

Each lab below proves one cluster of objectives. Keep resources in one region, such as Central India, and delete them at the end of each session.

Privileged access: make yourself eligible, not permanent, for a role with Privileged Identity Management, then activate it with approval.
Key Vault: deploy a vault with the firewall on, grant access with Azure RBAC, rotate a secret and read it from an app with a managed identity.
Governance: assign a built-in policy that denies public storage accounts, write one custom policy, and check compliance in Defender for Cloud.
Private access: put a storage account and an Azure SQL database behind private endpoints, then prove access with Network Watcher.
Servers: onboard one Azure VM and one Arc-enabled machine to Defender for Servers, enable agentless scanning and JIT access, and connect through Bastion.
Sentinel: create a workspace, install a content hub solution, connect Entra ID logs, collect Windows Security events with a data collection rule, and build an automation rule with a playbook.
AI: put API Management's AI Gateway in front of a Foundry model, add a guardrail, and look at what the Data and AI security dashboard reports.

For lab 6, write your own detections. A starting query for repeated sign-in failures:

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize failures = count() by UserPrincipalName, IPAddress
| where failures > 10
| order by failures desc

The India angle: CERT-In directions and SC-500 skills

Indian security teams work under CERT-In's directions of 28 April 2022. This is general information, not legal advice, but the technical overlap with SC-500 is direct:

CERT-In direction	SC-500 skill that supports it
Report listed incidents within 6 hours	Sentinel analytics, automation rules and playbooks
Keep ICT logs securely for a rolling 180 days	Sentinel data collection and data retention
Sync clocks to NIC or NPL time servers	Machine Configuration and Arc for consistent server settings
Logs may be stored abroad if produced in reasonable time (FAQ 35)	Deliberate workspace region and retention choices

The retention row needs care. Microsoft's Sentinel data tiers page explains that analytics retention for Sentinel solution tables can be extended to 90 days at no extra retention charge, and total retention in the data lake can run up to 12 years. A 180-day requirement therefore means setting retention per table on purpose. The defaults will not do it for you. Our guide to CERT-In directions for IT teams covers the rest of the directions.

How SC-500 fits a security career in India

SC-500 is an engineer's certification: you implement controls, you do not only monitor them. A sensible order for most people:

SC-900 if security vocabulary is new to you. It is optional.
AZ-104, because SC-500 assumes you already administer Azure compute, networking and storage.
SC-500 for the cloud and AI security engineer role.

Related routes depend on the job you want. SC-200 suits security operations centre analysts who live in Sentinel and Defender XDR. SC-300 suits identity and access administrators. SC-401 suits people protecting data in Microsoft 365 with Purview; see our SC-401 guide. Real incidents cross identity, data and operations, so plan a second certification once SC-500 is done.

Exam day and preparation tips

No practice assessment yet: Microsoft's certification page says practice assessments usually appear within eight weeks of an exam leaving beta and becoming generally available. Use the exam sandbox to learn the interface meanwhile.
Microsoft Learn is open during role-based exams, but the clock keeps running. It helps with a setting name, not with a concept you never learned.
Read every scenario for scope: is the resource in Azure, on-premises through Arc, or in Microsoft 365? The right tool depends on where it lives.
Price: fees depend on the country where you sit the exam; check the exam page when you book.

How CertTulen Academy can help

CertTulen Academy, a Microsoft Training Services Partner, runs live, MCT-led online security training with hands-on labs. Our Azure security engineer course page shows the current outline, inclusions and INR pricing; ask us how the current batch maps to SC-500 before you enrol. If you still need the administration base, start with AZ-104. Teams can book a private corporate cohort. Message us on WhatsApp at +91 93618 83583 or use our contact page for a batch that suits your time zone.