Azure Security Engineer Exam Preparation Guide

AZ-500 retired on 31 August 2026. What the Azure Security Engineer exam covered, what it means for holders, and how to prepare for the paths that replace it.

Daniel Carter14 July 2026 · 10 min read

Ask AIChatGPT Claude Gemini Copilot Perplexity Grok

Signpost showing the retired AZ-500 path greyed out beside active Azure security certification routes

There is a quiet trap in searching "AZ-500 exam prep" in late 2026: most of the results will hand you a study plan for a booking that no longer exists. Per Microsoft's official certification page, 31 August 2026 was the last day the Azure Security Engineer Associate certification — its exam and its renewal assessments included — could be earned or renewed. Past that date, no amount of preparation puts AZ-500 on your calendar. A pass earned while the exam was live, though, stays on your Microsoft transcript permanently.

What should a preparation guide do with that? Not pretend. The skills AZ-500 measured are still the working core of the Azure security engineer role, and hours already sunk into them are far from wasted — they simply need a live destination. So the plan here is practical: understand what the exam actually tested, work out what the retirement means for your particular situation, then point the same preparation at credentials you can still book. The credential-level record of AZ-500 — its objectives and structure as they stood — is kept separately in the Azure Security Engineer certification guide; this article is about where your study effort goes next.

First, work out which reader you are

The retirement lands differently on different people. Find your row before reading on.

You hold AZ-500 already. Your certification remains on your transcript, but after the retirement date it can no longer be renewed — role-based Microsoft certifications normally expire after one year with free online renewal, and retired certifications lose that renewal path. Your practical move is to plan which active certification will carry your Azure security credibility forward when your current cert ages out.

You were mid-preparation when the deadline hit. None of your study is wasted — the domains below map heavily onto Microsoft's active security certifications — but your target has to change. The sections on redirecting your preparation are written for you.

You are starting fresh in Azure security. Skip mourning a cert you never met. Read the domain section as a map of the job, then choose a live target from the alternatives section.

What did the AZ-500 exam cover?

While live, AZ-500 "Microsoft Azure Security Technologies" was a 100-minute proctored exam at Microsoft's associate tier, scored from 1 to 1,000 with a pass mark of 700 — a scaled score, not a percentage. Microsoft never published question counts, and pricing varied by country. Its four skills areas describe the working scope of an Azure security engineer better than most job adverts do:

Secure identity and access

Identity is the control plane of cloud security, and this domain treated it that way: managing Microsoft Entra ID identities, authentication and authorisation, and the boundaries around who and what can touch which resources. Nothing about this domain retired with the exam — it simply moved house. Microsoft's active Identity and Access Administrator Associate certification (exam SC-300) is an entire credential built on this ground: implementing and managing user identities, authentication and access management, workload identities and identity governance.

Secure networking

Network-level protection for Azure workloads: securing connectivity, exposure and traffic paths. Candidates who enjoyed this domain often had an adjacent decision to make anyway — whether their interest was security-flavoured networking or networking proper, which is Azure Network Engineer Associate (AZ-700) territory, still active.

Secure compute, storage and databases

Hardening the workloads themselves — the compute, storage and data services where the actual assets live. This is the domain most directly built on Azure administration skills, which is why AZ-104-level fluency was always the unofficial floor for AZ-500 candidates, even though the exam had no formal prerequisite.

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

Security posture management and security operations: Defender for Cloud for protecting the estate, Microsoft Sentinel for detection and response. This is the domain with the clearest live successor: the Security Operations Analyst Associate certification (SC-200) covers managing a security operations environment, responding to incidents, and threat hunting across Defender XDR, Sentinel, Entra ID, Purview and Defender for Cloud, with KQL-based hunting at its heart.

What replaces AZ-500?

Secondary industry sources name a successor exam — SC-500, tied to a "Cloud and AI Security Engineer Associate" certification — as part of Microsoft's broader 2025–26 overhaul, which retired around a dozen role-based certifications and introduced AI-focused replacements. Treat that successor with appropriate caution: at the time of writing we could not verify an official Microsoft page for SC-500, its name and format may change at launch, and those same sources report no automatic migration, voucher or discount from retired certifications to their replacements. Before committing study time to a successor, confirm it exists and read its skills outline on Microsoft Learn directly.

What you do not need to wait for are the certifications that are already live and already cover most of AZ-500's ground:

SC-200 (Security Operations Analyst Associate) — the operations and detection side: Sentinel, Defender XDR, incident response, threat hunting. Active, 100 minutes, no formal prerequisites, annual free renewal.
SC-300 (Identity and Access Administrator Associate) — the identity side: Entra ID end to end. Active, 100 minutes, no formal prerequisites, annual free renewal.
SC-900 (Security, Compliance, and Identity Fundamentals) — the 45-minute, never-expiring fundamentals tier, for those earlier in the journey.

A rough decision rule: if your AZ-500 interest was defending and responding, aim at SC-200; if it was identity and access, aim at SC-300; if you want the engineer-of-everything scope AZ-500 had, watch for the successor's official launch and build the underlying skills meanwhile. And if your real question is whether to stay vendor-specific at all versus pursuing Security+ or CISSP-style credentials, that cross-family decision has its own article: Azure Security Engineer vs cybersecurity certifications.

How to prepare for Azure security work now

Whatever exam code ends up on your booking confirmation, the preparation that made strong AZ-500 candidates makes strong candidates for every successor. Build it in this order.

1. Confirm your administration floor

Azure security engineering presumes Azure administration. If you cannot confidently manage identities, networking, compute and storage at AZ-104 level, security study will keep stalling on missing fundamentals — one sentence of sequencing advice: sort the admin floor first, then specialise.

2. Lab the identity control plane

In a personal Azure tenant, work through the identity lifecycle hands-on: create and govern users and groups, configure authentication policies, experiment with role assignments and least-privilege boundaries, and set up workload identities for non-human access. Every hour here pays out across SC-300, SC-200 and any AZ-500 successor alike.

3. Run a security operations loop end to end

Enable Defender for Cloud on a small estate, connect Microsoft Sentinel, generate some benign noise, and practise the loop: signal, triage, investigation, response. Learn enough KQL to interrogate logs without copying queries blindly — KQL-based hunting is explicitly in scope for SC-200 and is the daily language of Azure security operations.

4. Study posture, not just incidents

Security engineering is mostly prevention: secure configuration of compute, storage and data services, network exposure management, and the governance that keeps an estate hardened as it grows. Use Microsoft Learn's free learning paths for the active SC-series certifications as your syllabus — they are the official statement of what Microsoft currently thinks this job is.

5. Benchmark before you book

When a live target is chosen, validate readiness with timed practice rather than gut feel. Microsoft offers free practice assessments on Microsoft Learn, and a timed practice test simulation sat under exam conditions will show which domains hold up under pressure and which need another lab week. Analyse the misses by domain and study the pattern; practice questions are there to test your understanding of the objectives, and if you catch yourself memorising answers, return to the lab. For those documenting the historical exam's scope, ExamPractice's AZ-500 Microsoft Azure Security Technologies page retains the exam's question style for reference.

Choosing between the live options at a glance

Factor	SC-900	SC-200	SC-300
Level	Fundamentals	Associate	Associate
Exam length	45 minutes	100 minutes	100 minutes
Focus	Security, compliance and identity concepts across Microsoft's stack	Security operations: Sentinel, Defender XDR, incident response, threat hunting	Identity end to end: Entra ID, authentication, workload identities, governance
Prerequisites	None	None formal	None formal
Best for	Newcomers proving baseline security literacy	Defenders drawn to AZ-500's Defender/Sentinel domain	Engineers drawn to AZ-500's identity and access domain
Validity	Never expires	12 months, free online renewal	12 months, free online renewal
Pass mark	700/1,000 scaled	700/1,000 scaled	700/1,000 scaled

Fees for all three vary by country or region — Microsoft prices exams by where they are proctored, so confirm the figure for your country on each official exam page.

None of these is universally "the" AZ-500 replacement, and that is the point: pick by the work you want to be trusted with, not by which exam looks closest to the retired code on paper.

A redirection scenario: from stalled AZ-500 plan to live target

Picture a cloud engineer three years into an infrastructure role, AZ-104 earned eighteen months ago, who spent June and July working through AZ-500 material and then watched the August retirement date arrive before he felt ready to book. His sunk study time breaks down roughly evenly across the four old domains, but his lab notes tell a clearer story: the identity work felt like revision, while the Sentinel investigations were the first study sessions he lost track of time in.

That instinct is the decision. He maps his completed AZ-500 identity and platform-hardening study to background knowledge, targets SC-200, and rebuilds his plan around its three domains — managing a security operations environment, responding to incidents, threat hunting — with KQL practice added as the one genuinely new skill. Six weeks later his timed practice results cluster comfortably above his own benchmark in two domains, with threat hunting lagging; one more lab fortnight closes it, and he books. Total new study: about two months, most of it repurposed rather than restarted.

The transferable lesson: let your strongest reaction to the old material choose your new exam code, and audit what carries over before assuming you are starting again.

Mistakes to avoid when redirecting your preparation

Waiting indefinitely for the successor. Building skills while you wait is wise; freezing your certification plans for an exam with no verified official page is not. The live SC-series credentials are bookable today and renew annually for free — momentum beats perfect alignment.

Studying from pre-retirement AZ-500 materials for a new exam. Old study guides describe an outline nobody will test you on again. When you pick a live target, restart from that certification's official Microsoft Learn study guide and treat overlap with your AZ-500 notes as a bonus, not a plan.

Skipping fundamentals out of pride. If your security knowledge is genuinely new, SC-900's 45-minute, never-expiring credential is a legitimate first rung, not an admission of weakness — and it costs far less time than stalling at associate level with gaps underneath.

Assuming the 700 pass mark means 70 per cent. Microsoft scores on a 1–1,000 scale and 700 is a scaled score, not a percentage of questions correct. Benchmark your practice results against consistency across domains rather than a percentage superstition.

Frequently asked questions

Can I still take the AZ-500 exam?

No — per Microsoft's official certification page, the certification, exam and renewal assessments retire on 31 August 2026, and after that date the credential can no longer be earned or renewed. Anyone selling you AZ-500 preparation as a bookable goal after that date is behind the news.

Does my existing AZ-500 certification disappear?

No. Retired certifications remain on your Microsoft transcript permanently. What you lose is the ability to renew, so the credential will eventually show as expired rather than active — which is why planning a live successor matters.

Is there a free upgrade or voucher to the replacement?

Secondary sources covering Microsoft's 2025–26 certification overhaul report no automatic migration, free upgrade, voucher or discount from retired certifications to their replacements. Check Microsoft's official announcements for your specific case, but do not plan around a transfer.

Was AZ-500 the only security certification affected by the overhaul?

The overhaul was broad — roughly a dozen role-based certifications retired between 2025 and 2026, including AZ-204, AI-102 and DP-100 — but the SC-series security certifications discussed above (SC-200, SC-300, SC-900) remained active with no retirement warnings as of August 2026.

Your preparation outlives any exam code

If there is one habit to take from this guide, it is separating the skills from the badge. An engineer who can govern an Entra ID tenant, harden workloads and networks, and run a Defender-and-Sentinel operations loop was employable under AZ-500 and is employable now — the only thing that changed is which booking page proves it. Work the sequence in order: administration floor, identity lab, operations loop, posture, benchmark, then book whichever live credential fits the work you want, checking any rumoured successor against Microsoft Learn before you trust its name. For a view of where a security specialisation sits among everything else Microsoft still certifies, the Azure certifications roadmap lays out the full board.

Exam facts in this guide were checked against official certification-provider pages on 30 August 2026. Fees, exam codes and policies change — confirm on the provider’s own site before you book.