AZ-500 vs SC-500: what changed, and which one to study now

The short answer

AZ-500 is gone. Microsoft retired the exam on August 31, 2026, at 11:59 PM Central Standard Time (AZ-500 study guide), and the Azure Security Engineer Associate certification and its renewal assessment with it (certification page). For Microsoft’s security engineer certification today, the exam is SC-500. It leads to Microsoft Certified: Cloud and AI Security Engineer Associate (certification page).

So the useful question is not which of the two to take. It is how much of your AZ-500 preparation still counts. Most of it does, in new places. Three blocks are new.

Is SC-500 the AZ-500 replacement?

It is the successor Microsoft recommends. Microsoft’s June 2026 credentials roundup puts the Cloud and AI Security Engineer Associate (Exam SC-500) in the “Recommended new Certification” column next to AZ-500 (Microsoft Credentials roundup, June 2026). Pearson VUE, which delivers the exams, lists it as the related new certification in its retirement table (Pearson VUE). Both certification pages name the same role, Security Engineer, at the same level, Intermediate (Cloud and AI Security Engineer Associate, Azure Security Engineer Associate).

It is a successor, not a rename. SC-500 has its own outline and a wider scope. You earn the new certification by passing SC-500 (certification page); an Azure Security Engineer Associate you already hold stays on your transcript as it is (retirement page).

The two outlines side by side

	AZ-500	SC-500
Status	Retired August 31, 2026	Current
Certification	Azure Security Engineer Associate (retired)	Cloud and AI Security Engineer Associate
Outline version	Dated January 22, 2026, with a change log	No “as of” date and no change log; page last updated May 13, 2026
Identity and access	15–20%	20–25%, now with governance and Key Vault
Networking	20–25%, a domain of its own	One subgroup inside a 25–30% domain shared with storage and databases
Compute	Part of a 20–25% domain with storage and databases	20–25%, with a new AI subgroup
Defender for Cloud and Sentinel	30–35%	A 20–25% posture domain, with Security Copilot added
Securing AI	Not covered	11 objectives
Security Copilot	Not covered	4 objectives

Sources: AZ-500 study guide, SC-500 study guide.

Two things follow from that table. The Defender for Cloud and Sentinel block shrank from a third of the exam to about a fifth, yet most of its contents are still on the exam. Key Vault and Azure Policy moved into the identity and governance domain, Defender for Storage and Defender for Databases into the storage domain, Defender for Servers into compute. Networking, meanwhile, went from 21 objectives to 9. If you studied AZ-500 domain by domain, you have most of the right facts in the wrong boxes.

What is new or wider in SC-500

• Securing AI, 11 objectives: SharePoint oversharing, Purview DSPM, real-time protection for Copilot Studio agents, Conditional Access, blast-radius analysis and access management for Entra Agent ID, the AI gateway in API Management, Defender for AI Services, agent guardrails in Foundry, the Data and AI security dashboard, and agent management in the Microsoft 365 admin center.
• Microsoft Sentinel data collection: workspaces, roles, content hub solutions, syslog and CEF, Windows Security events through data collection rules including Windows Event Forwarding, custom log tables, retention, and querying Purview Audit in Defender XDR. AZ-500 covered connectors, analytics rules and automation.
• Microsoft Security Copilot, 4 objectives: workspaces, permissions and roles, plugins, and agents.
• Servers: Azure Arc for hybrid and multicloud machines, Defender for Servers onboarding and settings including EDR, VM security features such as secure boot and vTPM, and Azure Machine Configuration.
• Application platforms: Defender for Containers, and security controls for Azure Functions, Logic Apps and App Service.
• Governance and Key Vault: resource locks, overprivileged Azure RBAC assignments, infrastructure as code, deploying and configuring Key Vault, secrets scanning with Defender CSPM, and Defender for Key Vault.
• Smaller additions: passwordless authentication methods and Microsoft Entra Private Access.

Source: the SC-500 study guide, read against the AZ-500 study guide.

What is no longer named

User-defined routes, virtual network peering, ExpressRoute encryption, service endpoints, Application Gateway, Front Door, DDoS Protection, storage access keys, bring your own key, Defender for Cloud alerts and workflow automation, DevOps security, and Sentinel analytics rules have no objectives of their own in SC-500 (SC-500 study guide, AZ-500 study guide).

Read that list with care. The SC-500 study guide says the bullets under each skill illustrate how it is assessed and that related topics may be covered (SC-500 study guide). Key rotation, for example, could still come up inside managing keys in Key Vault. Treat these topics as lower priority, not as out of scope.

One trace of the old exam remains: the SC-500 study guide’s “Find a video” link still searches the Exam Readiness Zone for AZ-500 (SC-500 study guide). Videos you reach that way were made for the old outline.

Who should study what

• You were preparing for AZ-500. Switch to SC-500. Start with the new blocks above, then work through your old domains against the new outline, because their scope moved.
• You hold Azure Security Engineer Associate. It stays on your Microsoft Learn transcript, but it can no longer be renewed (retirement page, certification page). SC-500 is the route to a current security engineer certification.
• You are new to Azure security. Skip AZ-500 material. Microsoft’s course SC-500T00 has 12 free self-paced learning paths written for the new exam, including one on AI security and one on Security Copilot (course SC-500T00, Microsoft Learn FAQ).

Microsoft has no SC-500 practice assessment yet. On October 20, 2026, the certification page said it was not currently available (certification page).

Our SC-500 study guide has a chapter that runs this comparison objective by objective, with a column for where each dropped topic could still surface.