Azure Security Engineer Certification Guide

Before you build a study plan around AZ-500, check the date. Microsoft's official certification page carries this notice: the Azure Security Engineer Associate certification, its exam and its renewal assessments retire on 31 August 2026 — after that date it can no longer be earned or renewed. If you are reading this after the deadline, AZ-500 is closed to new candidates. This guide therefore does two jobs: it documents what the AZ-500 exam tested, for the candidates racing the deadline and the certified engineers deciding what their credential now means, and it maps the Microsoft security certifications that remain open — including the successor exam that secondary sources have named.

That framing matters because much of the AZ-500 content you will find online was written before the retirement announcement and still presents the certification as a long-term career target. It is not one any more. The skills it certified — Azure identity, platform hardening, Defender for Cloud, Microsoft Sentinel — remain thoroughly in demand; the badge that packaged them is being replaced as part of Microsoft's sweeping 2025–26 certification overhaul, which also retired AZ-204, AI-102, DP-100 and others.

The retirement, stated precisely

Three details from Microsoft's broader retirement pattern are worth knowing:

• Retired certifications stay on your transcript. An earned AZ-500 does not vanish; it shows as a historical credential, dated.
• No automatic migration. Reporting on the 2025–26 overhaul indicates there is no free upgrade, voucher or automatic transition from a retired certification to its successor — new credentials mean new exams.
• The pattern is consistent. AZ-500 is the last of a string of mid-2026 retirements, so guidance written for "Azure security certification" even a year ago may name targets that no longer exist.

What the AZ-500 exam tested

For anyone who sat the exam before retirement — or who wants to understand what the credential on a colleague's CV certifies — AZ-500 (Microsoft Azure Security Technologies) was a 100-minute proctored exam at Microsoft's associate tier, scored on the standard 1–1,000 scale with a 700 pass mark (a scaled score, not a percentage). Pricing sat at the associate tier, which varies by country; US candidates commonly cited around US$165, though Microsoft never printed a universal figure. Its objectives were organised into four domains.

Secure identity and access

Microsoft Entra ID at depth: managing identities, authentication methods, conditional access, privileged identity management and external identities. Identity was the exam's centre of gravity, reflecting its place as the primary security perimeter in cloud environments.

Secure networking

Network security groups, Azure Firewall, private endpoints and private link, DDoS protection and secure hybrid connectivity — designing and implementing the controls that segment and shield Azure network traffic.

Secure compute, storage, and databases

Hardening the workload layer: VM security, container and App Service protections, storage account access controls and encryption, and database-level security features such as auditing and data classification.

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

The operations layer: posture management and workload protections in Microsoft Defender for Cloud, and detection, investigation and response with Microsoft Sentinel. This domain connected configuration skills to day-to-day security operations.

Those four domains remain a serviceable syllabus for the job of an Azure security engineer even though the exam is closed — a point we return to below.

Reading the objectives the way the exam did

A domain list understates what AZ-500 actually rewarded, and the distinction matters for anyone using its syllabus to prepare for the successor certifications. Three emphases ran through the exam:

• Configuration over concept. AZ-500 was an engineer's exam, not an analyst's. It asked how controls are implemented — which setting, which scope, which order — rather than why security matters. Candidates who had only read about conditional access, without building policies and watching them block a sign-in, reliably struggled.
• Integration over isolation. The best questions crossed domain boundaries: an identity decision with networking consequences, a Defender for Cloud recommendation that touched storage configuration. That mirrors the role, where security engineering is mostly about how controls compose.
• Microsoft-stack fluency as an assumption. The exam presumed working comfort with the Azure portal, general resource management and Entra ID basics. It had no formal prerequisite, but candidates without administrator-level Azure experience were effectively sitting two exams at once — one of the reasons many people sequenced AZ-104 first even though nothing required it.

Those same emphases are visible in the live SC-200 and SC-300 objectives, which is why AZ-500 preparation transfers so well: Microsoft changed the packaging, not the philosophy.

What this means for you, by situation

You already hold AZ-500

Your certification remains visible on your transcript, but it can no longer be renewed once it expires — Microsoft's role-based certifications run on a one-year cycle, and the free renewal assessment for AZ-500 retires with the exam. Practically: note your expiry date, keep evidence of the hands-on work behind the credential, and plan your next certification before the lapse rather than after. The successor exam, once officially launched, is the obvious candidate; SC-200 (Security Operations Analyst) and SC-300 (Identity and Access Administrator) are live alternatives today.

You were mid-preparation when the window closed

Your study effort is not wasted — it is repositioned. The Entra ID knowledge maps almost directly onto SC-300; the Defender for Cloud and Sentinel material is the heart of SC-200; the platform-hardening content will almost certainly resurface in the successor exam, given its reported "Cloud and AI Security Engineer" scope. Choose the live exam that overlaps most with the domains you had already mastered, and check Microsoft Learn for the successor's official page before assuming its content.

You are starting an Azure security path from zero

Skip AZ-500 entirely — it is not available to you — and sequence forwards: SC-900 (Security, Compliance, and Identity Fundamentals) if you want a no-prerequisite, never-expiring starting point; then SC-200 or SC-300 depending on whether operations or identity fits your role; and watch for the successor exam's launch. Whether a Microsoft-specific security credential or a vendor-neutral one serves you better is a separate decision, examined in the comparison of Azure security certifications against vendor-neutral cybersecurity certifications.