SC-500 vs AZ-500: Understanding the Shift from Azure Security to Cloud and AI Security

Microsoft is reshaping its security certification path with the launch of the Microsoft Certified: Cloud and AI Security Engineer Associate certification and its required exam, SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads. The new certification is now available in beta and is designed to validate the security skills needed to protect modern Azure, hybrid, and AI-enabled environments. At the same time, Microsoft has confirmed that AZ-500: Microsoft Azure Security Technologies and the related Microsoft Certified: Azure Security Engineer Associate certification will retire on August 31, 2026.

Microsoft’s Security Certification Path Is Moving Toward Cloud and AI Workloads

The release of SC-500 marks an important shift in Microsoft’s security certification strategy. Traditional cloud security remains important, but modern enterprise environments now include AI workloads, autonomous agents, Microsoft Copilot, Microsoft Foundry, hybrid infrastructure, multicloud resources, and increasingly complex identity and data protection requirements.

The new Cloud and AI Security Engineer Associate certification validates a candidate’s ability to design, implement, and manage end-to-end security controls across Azure, hybrid, and AI-enabled environments. Microsoft describes this certification as covering the protection of identities, data, applications, infrastructure, and regulatory compliance.

This makes SC-500 more than a simple replacement exam. It reflects how the security engineer role is expanding from protecting Azure infrastructure to securing the full cloud and AI security lifecycle.

Understanding SC-500: Microsoft’s New Certification for Cloud and AI Security Engineers

This Certification reflects the security skills used to help protect modern cloud environments that support AI workloads, including identity protection, data security, AI model security, and cloud threat defense.

It assesses a candidate’s knowledge of how to:

● Manage identity, access, and governance

● Secure storage, databases, and networking

● Secure compute

● Monitor and manage security posture

Exam SC-500 is designed for security engineers who protect organizational systems and data across cloud and hybrid environments by implementing comprehensive security controls that proactively help prevent unauthorized access and mitigate risks. This role spans multiple security domains, including identity, network, application, data, and compute, and it supports the secure implementation and monitoring of infrastructure, identities, and data used by AI workloads.

Responsibilities may include:

● Securing access to resources by using Microsoft Entra ID and Azure Key Vault

● Enforcing security and regulatory compliance

● Protecting cloud infrastructure, data platforms, and applications

● Securing AI solutions

● Monitoring and improving overall security posture

They may work closely with architects, administrators, engineers, analysts, and developers responsible for Azure, Microsoft 365, identity and access, information protection, security operations, DevOps, application development, database platforms, and networks.

Candidates for this exam should have practical experience in administration of Azure and hybrid environments, including compute, network, and storage. They need strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration.

AZ-500 and Azure Security Engineer Associate Will Retire on August 31, 2026

For years, AZ-500: Microsoft Azure Security Technologies has been the core exam for earning the Microsoft Certified: Azure Security Engineer Associate certification. It validates skills in implementing Azure security controls, maintaining security posture, managing threat protection, identifying vulnerabilities, and securing identity, network, compute, storage, data, applications, and DevOps security in Azure environments.

However, Microsoft has announced that the AZ-500 exam, its related certification, and renewal assessments will retire on August 31, 2026. After that date, candidates will no longer be able to earn or renew the Microsoft Certified: Azure Security Engineer Associate certification.

Microsoft Partner Center also confirms that SC-500 is being introduced to support a smooth transition as AZ-500 retires. During the transition period, partners may use either AZ-500 or SC-500 for relevant Security Solutions Partner designation and specialization skilling requirements. Existing AZ-500 certifications remain valid until retirement.

SC-500 vs AZ-500: What Is the Difference?

Although SC-500 and AZ-500 are both associate-level Microsoft security exams for security engineers, their focus is different.

The biggest difference is that AZ-500 focuses on Azure security engineering, while SC-500 expands the role into cloud and AI security engineering. AZ-500 emphasizes protecting Azure resources, managing security posture, implementing threat protection, and remediating vulnerabilities. SC-500 keeps many of those cloud security foundations but adds stronger coverage of AI workloads, AI data security, Microsoft Copilot risks, AI agents, and modern enterprise security patterns.

Which Exam Should You Choose Now: SC-500 or AZ-500?

At present, the choice depends on your timeline and career goal.

If you are already preparing for AZ-500 and want to earn the Microsoft Certified: Azure Security Engineer Associate certification before the retirement date, AZ-500 is still a valid option until August 31, 2026. It remains useful for candidates who need Azure security validation soon, especially if their work is centered on Azure infrastructure security, Defender for Cloud, identity, networking, storage, compute, and compliance.

However, if you are planning for long-term certification value, or your role involves AI workloads, Microsoft Copilot, cloud security architecture, data protection, or modern enterprise security controls, SC-500 is the better future-facing path. Microsoft is clearly positioning SC-500 as the next-generation security certification for engineers who need to secure both cloud and AI workloads.

For new candidates who are just starting their Microsoft security certification journey in 2026, SC-500 is likely the more strategic choice because it aligns with Microsoft’s future direction. For candidates who are already deep into AZ-500 preparation, it may still make sense to complete AZ-500 before the retirement deadline, then transition to SC-500 later as Microsoft’s new security path becomes more established.

Final Thoughts: Moving from Azure Security to Cloud and AI Security

The introduction of SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads shows that Microsoft is moving its security certifications toward the realities of modern enterprise environments. Security engineers are no longer responsible only for traditional cloud infrastructure. They must also secure identities, data, applications, AI systems, agents, Copilot experiences, hybrid environments, and multicloud resources.

With AZ-500 retiring on August 31, 2026, candidates should carefully plan their certification path. AZ-500 remains useful for Azure security professionals who want to certify before the deadline, but SC-500 represents Microsoft’s new direction for cloud and AI security. For anyone preparing for the future of Microsoft security engineering, SC-500 is the certification to watch.