SC-500 vs AZ-500: What Actually Changed in Microsoft's New Security Exam

SC-500 vs AZ-500: What Actually Changed in Microsoft's New Security Exam

AZ-500 has been the standard Azure security certification for years, and it retires on August 31, 2026. Its replacement, SC-500 (Implementing End-to-End Security Controls for Cloud and AI Workloads), isn't a simple rename — it's a broader exam with a genuinely new domain that didn't exist on the old one. If you're deciding whether to finish AZ-500 before it disappears or start fresh on SC-500, the domain weights below are the actual decision-making data, not marketing copy. For candidates looking for free certification exam questions, understanding these changes can also help you focus your preparation on the right exam domains.

Quick Comparison

What AZ-500 Covers (For Context, Since It's Retiring)

AZ-500 is built around four domains: managing identity and access (roughly 25–30%), securing networking (20–25%), securing compute, storage, and databases (20–25%), and managing security operations through Microsoft Defender for Cloud and Microsoft Sentinel (25–30%, sometimes published as the largest domain depending on the exam version). It's a solid, focused Azure security exam — but it was built before Copilot and agentic AI became standard parts of enterprise Azure deployments, so none of that surfaces on it.

What SC-500 Covers

SC-500 restructures around four domains too, but the weighting and scope shift meaningfully:

The identity, storage, database, and networking material will feel familiar if you've studied for AZ-500 — the fundamentals haven't changed. What's genuinely new is folded into the compute domain: securing AI workloads specifically, which covers configuring guardrails and access controls for Copilot deployments, securing Foundry-based agents, and managing the newer Entra Agent ID system for non-human, agent-based identities.

The Part That's Actually New: AI Security

This is worth calling out on its own because it's the single biggest reason SC-500 exists as a separate exam rather than an AZ-500 content update. AZ-500 assumes your attack surface is identity, network, and infrastructure. SC-500 assumes that surface now includes autonomous AI agents that can take actions inside your environment — which means new questions about what those agents can access, how their actions get logged and audited, and how you prevent an AI agent from becoming a privilege-escalation path. If your organization has deployed or is planning to deploy Copilot or Foundry-based agents, this domain is the reason to prioritize SC-500 over finishing AZ-500.

Format and Logistics

Both exams run similarly in practice: 120 minutes, roughly 40 to 60 questions, a 700-out-of-1000 passing score, and delivery through Pearson VUE. Cost sits around $165 USD in most regions, though this varies by country and occasionally by promotional pricing during beta periods. Neither exam requires a mandatory prerequisite, though Microsoft's stated audience profile for SC-500 assumes practical experience administering Azure and hybrid environments, plus familiarity with Microsoft 365 administration — slightly broader than AZ-500's Azure-only assumption.

Which Should You Take?

Take AZ-500 if:

• You're already deep into AZ-500 prep and can realistically finish before August 31, 2026

• Your employer's requirements specifically name AZ-500 or the Azure Security Engineer Associate credential

• Your role is focused purely on traditional Azure infrastructure security without AI workload exposure

Take SC-500 if:

• You're starting your study plan now, with more than a few weeks of prep ahead

• Your organization uses or is rolling out Copilot, Foundry agents, or other AI-integrated Azure services

• You want the current, actively-earnable credential rather than one with a closing window

• You're newer to Azure security and would rather learn the current material once instead of learning AZ-500 now and SC-500's AI content later

How to Prepare for SC-500 If You Already Know AZ-500

If you've already studied AZ-500 material, most of your knowledge transfers directly — identity, network security, and Defender/Sentinel operations are structurally the same skill set, just reorganized. Focus your additional study time specifically on the AI security content inside the compute domain: Copilot governance settings, Foundry agent security configuration, and Entra Agent ID concepts. This is genuinely new material with limited historical study resources, so budget more time for it than you would for a familiar Azure security topic, and rely on Microsoft's own official study guide as your primary source since third-party material is still catching up.