SC-500 vs SC-300: security engineer or identity administrator?

The short answer

SC-300 tests whether you can run identity in Microsoft Entra: users, hybrid sync, sign-in methods, Conditional Access, application identity and governance (SC-300 study guide). SC-500 tests whether you can secure an Azure estate, its AI workloads included. Entra is one part of that: one subgroup of six objectives, plus a few more elsewhere (SC-500 study guide).

If identity is your day job, take SC-300. If you secure subscriptions, networks and workloads, take SC-500.

Side by side

	SC-300	SC-500
Certification	Identity and Access Administrator Associate	Cloud and AI Security Engineer Associate
Level	Intermediate	Intermediate
Exam time	100 minutes	120 minutes
Domains	User identities; authentication and access management; workload identities; identity governance	Identity, access and governance; storage, databases and networking; compute; security posture
Products	Microsoft Entra, plus Defender for Cloud Apps for app access	Entra, Key Vault, Azure networking and storage, Azure SQL, servers and containers, Purview, Foundry, Defender for Cloud, Sentinel, Security Copilot
Free practice assessment	Available	Not available on October 20, 2026
Outline	New English version from October 28, 2026; Microsoft’s change log rates the changes minor	First version, no change log; page last updated May 13, 2026

Sources: SC-300 study guide, SC-300 certification page, SC-500 study guide, SC-500 certification page.

Where they overlap

Both outlines cover the topics below. The difference is depth: what SC-300 gives a subgroup, SC-500 usually gives one objective.

Topic	SC-300	SC-500
Conditional Access	A subgroup of ten objectives: planning, assignments, controls, troubleshooting, session management, continuous access evaluation, authentication context, protected actions and more	One objective, plus a separate one for Conditional Access on agent identities
Authentication methods	A subgroup: certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, passkeys, MFA settings, self-service password reset, Windows Hello for Business, password protection	One objective, naming MFA and passwordless
Privileged Identity Management	Entra roles, Azure resources and groups in PIM, approvals, audit history, emergency access accounts	One objective
Application identity and consent	Two subgroups: enterprise apps, Application Proxy, SaaS integration, app registrations, API permissions, app roles, consent	Two objectives: identity for applications, and OAuth permission grants with consent settings
Managed identities	Choosing, creating, assigning and using them	One objective
Roles	Built-in and custom Entra roles, administrative units, effective permissions	Custom Azure and Entra roles, plus Azure RBAC assignments and overprivileged access
Microsoft Entra Private Access	Part of a Global Secure Access subgroup, with Internet Access and the clients	One objective, inside the network subgroup
Access packages	Entitlement management for people and external users	Managing Entra Agent ID access; Microsoft documents access packages for agent identities

Sources: SC-300 study guide, SC-500 study guide, access packages for agent identities.

Only in SC-300

Hybrid identity (Connect Sync, Cloud Sync, password hash sync, pass-through authentication, seamless SSO, moving off AD FS), external users and cross-tenant synchronization, user and sign-in risk in ID Protection, access reviews, Defender for Cloud Apps, sign-in and audit logs with workbooks, Identity Secure Score, and tenant settings such as domains and company branding (SC-300 study guide).

Only in SC-500

Everything outside Entra: Key Vault, Azure Policy and resource locks, Defender for Cloud, storage, Azure SQL, network security, servers and containers, and Sentinel data collection. Two subgroups have no matching subgroup in SC-300: securing AI, with 11 objectives, and Security Copilot, with 4 (SC-500 study guide).

SC-500 also reaches a kind of identity the SC-300 outline doesn’t mention: AI agents. Conditional Access, blast-radius analysis and access management for Microsoft Entra Agent ID are SC-500 objectives. The SC-300 outline dated October 28, 2026 doesn’t use the word “agent” (SC-300 study guide, SC-500 study guide).

Which one to take

• You administer Entra most days: SC-300. It matches the work, and SC-500 would spend most of your study time on services you don’t run.
• You secure Azure subscriptions and workloads: SC-500.
• You want both: SC-500’s audience profile asks for strong familiarity with Microsoft Entra ID (SC-500 study guide). If Conditional Access and PIM are still new to you, SC-300 first builds that base. If you use them daily, go straight to SC-500.
• You are aiming for Cybersecurity Architect Expert: either certification meets the prerequisite for that certification, which you earn by passing SC-100 (Cybersecurity Architect Expert).

If SC-500 is your pick, our SC-500 study guide covers its four domains with practice questions where every option is explained.