AZ-500, Azure Security Engineer Associate, and its renewal assessments retired on August 31, 2026. Microsoft names Cloud and AI Security Engineer Associate, earned through SC-500, as the replacement path. Check your transcript expiry, compare your existing knowledge with the current SC-500 skills, and retain older material where it still matches those tasks.
What changed after AZ-500 retired?
The certification, the AZ-500 exam, and its renewal assessments were retired on August 31, 2026. You can no longer earn or renew the credential, and Microsoft has named the Cloud and AI Security Engineer Associate (SC-500) as its replacement.
The credential page states that Azure Security Engineer Associate, AZ-500, and the renewal assessments retired on August 31, 2026. The archived exam guide gives the retirement time as 11:59 PM Central Standard Time.
Microsoft’s July announcement names Cloud and AI Security Engineer Associate (SC-500) as the replacement, available from July 21, 2026. The new credential has its own exam requirements and skills; a replacement announcement does not establish automatic badge conversion.
The retirement notice concerns the credential and assessments. It does not establish the retirement or current availability of every technology in the historical syllabus. Check current documentation when reusing older resources.
Official sources used: Microsoft Certified: Azure Security Engineer Associate - Certifications | Microsoft Learn — Retirement warning and exam skills overview; Study guide for Exam AZ-500: Microsoft Azure Security Technologies | Microsoft Learn — Skills measured as of January 22, 2026; Microsoft Certified: Cloud and AI Security Engineer Associate - Certifications | Microsoft Learn — Exam overview, 120-minute duration, exam policy, languages; Study guide for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads | Microsoft Learn — Passing score; skills at a glance; July 2026 announcements - Partner Center announcements | Microsoft Learn — Certifications retiring with replacements: AZ-500 to SC-500
What happens to an existing credential?
An unexpired Azure Security Engineer Associate credential remains active until its own expiry date. Its renewal assessment is no longer available.
Microsoft’s current policy gives role-based certifications one year of validity after their requirements are completed. A holder’s record may also reflect renewal before retirement, so use the actual expiry on your transcript rather than adding a year to the original award date.
Retirement does not cancel an unexpired credential early. It remains in the active section until its own expiry. The non-expiring Fundamentals policy does not apply to this Associate credential.
Official sources used: Microsoft Certified: Azure Security Engineer Associate - Certifications | Microsoft Learn — Retirement warning and exam skills overview; Credential expiration policies | Microsoft Learn — Role-based certification expiry; retired credential transcript behaviour; Microsoft Certification Renewal | Microsoft Learn — Six-month renewal window
Which older topics are useful to compare?
The archived AZ-500 English skills list dated January 22, 2026 covered identity and access, networking, compute and data, and Defender for Cloud and Sentinel.
Its historical ranges were identity and access 15–20%, networking 20–25%, compute/storage/databases 20–25%, and Defender for Cloud/Sentinel 30–35%. These describe the retired exam, not current SC-500 weights.
Compare existing explanations of identity controls, network rules, data protection, and security operations with the current tasks. A familiar service name does not guarantee that your material covers its current features, configuration, or required depth.
The historical audience profile described Azure and hybrid administration experience and familiarity with Entra, compute, networking, and storage. Treat that as preparation context, not proof that a particular background covers the new exam.
Official sources used: Study guide for Exam AZ-500: Microsoft Azure Security Technologies | Microsoft Learn — Skills measured as of January 22, 2026; Study guide for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads | Microsoft Learn — Passing score; skills at a glance
What to study for the current SC-500 path
The current SC-500 guide covers four areas across Azure, hybrid, and AI security. Compare the full task list with the work you want to do.
AI security is part of the current outline, alongside identity, data, network, compute, and security operations tasks. Do not assume adding one AI topic to an old course is sufficient.
The percentages below are official ranges, not exact question counts or required study-hour allocations. Use your knowledge gaps as well as the current task list to plan preparation.
The current credential page gives 120 minutes for SC-500 and states that its practice assessment is not currently available. Follow that page’s current learning and scheduling links; do not reuse retired AZ-500 logistics.
| Current SC-500 area | Weight range | Topics and suggested practice |
|---|---|---|
| Identity, access, and governance | 20–25% | Entra, Key Vault, Policy, RBAC, and backup-related controls. Explain which identity, scope, and requirement a fictional access design uses. |
| Storage, databases, and networking | 25–30% | Storage and SQL protection, NSGs and ASGs, network management, VPN and private access, private endpoints, and Firewall. Work the NSG example and compare the named controls in current documentation. |
| Compute | 20–25% | Server, Arc, container, application, and AI workload security, including the listed Purview, Copilot, Agent ID, Foundry, and Defender capabilities. Map each task to an official learning resource. |
| Security posture | 20–25% | Defender CSPM, vulnerabilities and attack-surface management, Sentinel data and automation, and Security Copilot. Practice explaining what evidence a finding provides and what investigation is still needed. |
Official sources used: Microsoft Certified: Cloud and AI Security Engineer Associate - Certifications | Microsoft Learn — Exam overview, 120-minute duration, exam policy, languages; Study guide for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads | Microsoft Learn — Passing score; skills at a glance; July 2026 announcements - Partner Center announcements | Microsoft Learn — Certifications retiring with replacements: AZ-500 to SC-500
Practice: which NSG rule handles a new connection?
Network security group rules are evaluated from lower to higher priority numbers, stopping at the first matching rule. Existing connections are stateful.
For custom rules, the documented priority range is 100–4096. A narrower source address does not move a rule ahead of an earlier matching rule. Compare both the traffic match and the priority number.
Microsoft documents that rule changes apply to new connections and that removing an allowing rule does not itself interrupt an existing connection. This does not guarantee that a session continues regardless of other network or application events.
The original exercise below separates a new-connection decision from an already-established-flow question. It does not ask you to change a real network.
Practice exercise
Part 1: One applicable NSG contains two inbound custom rules and no earlier custom rules. Rule 100 denies TCP traffic from any source and source port to 10.10.1.4:443. Rule 200 allows TCP traffic from 192.0.2.10 and any source port to 10.10.1.4:443. No other network control affects this example. Which rule handles a NEW connection from 192.0.2.10 to 10.10.1.4:443, and is it allowed? Part 2 is a SEPARATE case: a TCP connection was successfully established while an NSG rule allowed it. An engineer later removes that allowing rule. Does removing the rule necessarily terminate that existing connection immediately?
Show answer
Part 1: rule 100 matches first and denies the new connection. Part 2: no; removing an allowing rule does not itself immediately terminate an already-established NSG flow.
The new connection matches rule 100, which has the lower priority number. Evaluation stops there, so rule 200’s narrower source does not change the decision. In the separate second case, the connection was already allowed and established. NSG flow state explains why removing its allowing rule does not by itself interrupt it. A later new connection must be evaluated against the rules then in effect; its result cannot be inferred without that rule set.
Official sources used: Azure network security groups overview | Microsoft Learn — Security rules; default security rules; stateful behaviour
Your next-study checklist
Compare your goals and current knowledge with SC-500, then plan the specific tasks you still need to learn.
- Check your transcript expiry if you hold Azure Security Engineer Associate.
- Read the current SC-500 audience profile and complete skills list.
- Compare each task with your existing notes and current product documentation.
- Identify gaps across all four areas, including the listed AI security tasks.
- Work the NSG example and explain why new and established connections are different cases.
- Use official learning exercises in an appropriate practice environment and check resource requirements before starting.
- Check the current credential page for preparation resources and scheduling details.
Official sources used: Microsoft Certified: Azure Security Engineer Associate - Certifications | Microsoft Learn — Retirement warning and exam skills overview; Study guide for Exam AZ-500: Microsoft Azure Security Technologies | Microsoft Learn — Skills measured as of January 22, 2026; Azure network security groups overview | Microsoft Learn — Security rules; default security rules; stateful behaviour; Credential expiration policies | Microsoft Learn — Role-based certification expiry; retired credential transcript behaviour; Microsoft Certified: Cloud and AI Security Engineer Associate - Certifications | Microsoft Learn — Exam overview, 120-minute duration, exam policy, languages; Study guide for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads | Microsoft Learn — Passing score; skills at a glance
Official sources used
Retirement, credential, and exam details checked against official Microsoft Learn pages on September 14, 2026.:
- Microsoft Certified: Azure Security Engineer Associate - Certifications | Microsoft Learn
- Study guide for Exam AZ-500: Microsoft Azure Security Technologies | Microsoft Learn
- Azure network security groups overview | Microsoft Learn
- Credential expiration policies | Microsoft Learn
- Microsoft Certified: Cloud and AI Security Engineer Associate - Certifications | Microsoft Learn
- Study guide for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads | Microsoft Learn
- July 2026 announcements - Partner Center announcements | Microsoft Learn
- Microsoft Certification Renewal | Microsoft Learn