Exam SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads, earns the Microsoft Certified: Cloud and AI Security Engineer Associate certification. This guide covers who it is for, how the exam works, what the four skill areas test, how SC-500 relates to AZ-500, how to renew and a suggested way to prepare.
SC-500 at a glance
| Detail | SC-500 |
|---|---|
| Awarded by | Microsoft |
| Certification | Microsoft Certified: Cloud and AI Security Engineer Associate |
| Level | Intermediate (associate) |
| Time | 120 minutes |
| Questions | Not listed for SC-500; Microsoft says most of its exams have 40–60 |
| Passing score | 700 on a scale of 1 to 1,000 (scaled) |
| Delivery | Proctored, scheduled through Pearson VUE |
| Languages | English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Italian, Portuguese (Brazil), Spanish |
| Price | Depends on the country or region where you take it |
| Renewal | Every year, free, with an online assessment on Microsoft Learn |
SC-500 replaces AZ-500. Microsoft retired the AZ-500 exam and the Azure Security Engineer Associate certification, including its renewal assessments, on August 31, 2026. AZ-500 can no longer be earned or renewed, and Microsoft lists the Cloud and AI Security Engineer Associate (Exam SC-500) as its replacement.
Who it is for
Microsoft describes the candidate as a security engineer who protects systems and data across cloud and hybrid environments by implementing security controls that help prevent unauthorized access. The role spans identity, network, application, data and compute, and includes making sure the platforms, data, identities and infrastructure used by AI workloads are secured and monitored. Typical responsibilities are:
- securing access to resources with Microsoft Entra ID and Azure Key Vault
- enforcing security and regulatory compliance
- securing storage, databases, networking and compute
- securing AI solutions
- managing and monitoring security posture
Recommended experience
Microsoft says you should have practical experience administering Azure and hybrid environments, including compute, network and storage; strong familiarity with Microsoft Entra ID; and familiarity with Microsoft 365 administration.
The exam format
You have 120 minutes. The exam is proctored and may include interactive components. Microsoft does not reveal question types in advance, but its exam sandbox lets you try the exam interface and question formats before you book. Most questions cover features that are generally available, though commonly used Preview features can appear.
- Scoring: you need 700 or more on a scale of 1 to 1,000. This is a scaled score, so it may not equal 70% of the points. There is no penalty for guessing, and some questions may be unscored without telling you which.
- Microsoft Learn is open: on associate and expert exams you can open Microsoft Learn in a split screen. No extra time is added and the clock keeps running.
- Breaks: five minutes are built into the exam time for breaks. The clock keeps running, and you cannot return to questions you saw before the break.
- Language: if the exam is not available in your preferred language, you can request an extra 30 minutes.
- Retakes: you can retake 24 hours after a first failed attempt; later waiting times vary.
The official skills measured
The SC-500 study guide groups the exam into four skill areas. This is how it describes them, in brief:
| Skill area | Weight | What it covers |
|---|---|---|
| Manage identity, access, and governance | 20–25% | Entra ID: Privileged Identity Management, Conditional Access, MFA and passwordless, app registrations, consent settings and managed identities. Key Vault: deployment, access, firewall settings and Defender for Key Vault. Governance: Azure Policy, regulatory compliance in Defender for Cloud, resource locks, built-in and custom roles, over-privileged access, Azure Backup security and infrastructure as code. |
| Secure storage, databases, and networking | 25–30% | Storage account security, firewall rules and Defender for Storage; Azure SQL security, auditing and Defender for Databases; NSGs and ASGs, Virtual Network Manager, Virtual WAN, VPN, Entra Private Access, private endpoints, Private Link, Azure Firewall and Network Watcher. |
| Secure compute | 20–25% | AI security: SharePoint oversharing, Purview Data Security Posture Management for Copilot and AI apps, Copilot Studio agent protection, Entra Agent ID, AI Gateway in API Management for Microsoft Foundry, Defender for AI services and Foundry guardrails. Servers and VMs: disk encryption, Bastion, just-in-time access, Azure Arc and Defender for Servers. App platforms: Defender for Containers, AKS, Container Registry, Container Apps, Functions, Logic Apps, App Service, Web Application Firewall and API Management. |
| Manage and monitor security posture | 20–25% | Defender for Cloud: Defender CSPM, compliance against frameworks, workload protection plans, connecting AWS and Google Cloud, vulnerability management and External Attack Surface Management. Microsoft Sentinel: workspaces, roles, content hub, data connectors, syslog and CEF, Windows Security events, automation rules, playbooks and retention. Microsoft Security Copilot: workspaces, permissions, plugins and agents. |
The largest single area is storage, databases and networking. AI security sits inside the Secure compute area rather than in a separate domain.
Official study resources
- the SC-500 study guide, which lists every skill measured
- self-paced learning paths and modules, or an instructor-led course, linked from the certification page
- product documentation, including Microsoft Entra ID, Key Vault, Defender for Cloud, Microsoft Sentinel, Azure Firewall and Azure Policy
- the exam sandbox, to practise the exam interface
Microsoft’s free Practice Assessment for SC-500 is not available yet. Microsoft says Practice Assessments usually appear within 8 weeks of an exam leaving beta and becoming generally available.
A suggested 6-week study plan
This is our suggested plan. It follows the four skill areas and gives the most time to the heaviest one.
- Week 1: Identity, access and governance. Entra ID, PIM, Conditional Access, managed identities, Key Vault, Azure Policy and RBAC.
- Week 2: Storage and databases. Storage account security, Azure SQL security and auditing, and the Defender plans for storage and databases.
- Week 3: Networking. NSGs, Azure Firewall, private endpoints and Private Link, VPN, Virtual WAN and Entra Private Access.
- Week 4: Compute and AI. VM and server security, containers and app platforms, then the AI security tasks for Copilot, agents and Foundry.
- Week 5: Security posture. Defender for Cloud, Microsoft Sentinel data collection and automation, and Security Copilot.
- Week 6: Practice and review. Take full-length timed practice exams, read every explanation, and revisit the areas where you score lowest. Practise finding answers quickly on Microsoft Learn, since it is open during the exam but the clock keeps running.
Keeping your certification
Microsoft role-based certifications expire after one year. Renewal is free: you pass a short online renewal assessment on Microsoft Learn, which becomes available six months before your certification expires. The assessment is unproctored and open book, takes about 45 minutes, and can be retaken as often as needed before expiry. Passing it extends your certification by one year from the expiration date. If the certification expires, you must pass the exam again.
I run ExamCrest, where this guide first appeared. Try 10 free SC-500 practice questions: https://examcrest.com/exam/ms-sc-500/free-questions?utm_source=devto&utm_campaign=sc-500-guide
Top comments (0)