# AZ-500 Retired: Security Skills Roadmap and SC-500 Lab Plan

> AZ-500 retired on 31 August 2026. Use its skills measured as a lab roadmap and see how the SC-500 exam that follows it changes the study plan.

Source: https://www.epifive.com/blog/az-500-study-guide-azure-security-engineer · Published 2026-10-28 · EpiFive

## Key takeaways

- AZ-500 and the Azure Security Engineer Associate certification retired on 31 August 2026, so you can no longer earn or renew it.
- The final AZ-500 outline weighted Defender for Cloud and Microsoft Sentinel at 30-35 percent, making it the largest area.
- SC-500 keeps identity, Key Vault, storage, networking, servers, containers and posture management, and adds AI security and Security Copilot objectives.
- Study by building each skills-measured bullet in a test subscription, not by reading alone.
- Always confirm the current exam, passing score and credential name on Microsoft Learn before you schedule anything.

AZ-500, Microsoft Azure Security Technologies, can no longer be taken: Microsoft's study guide says the exam retired on August 31, 2026, at 11:59 PM Central Standard Time. The skills it measured are still the standard checklist for securing an Azure environment, and most of them carry over to its successor on Microsoft Learn, Exam SC-500. This guide walks through the final AZ-500 outline as a lab roadmap and shows where SC-500 differs, so your study time goes into skills you can use at work and in the exam that exists today.

Information in this article was checked against Microsoft Learn pages on 28 October 2026. Exam outlines change, so re-read the study guide on the day you book.

## Who this is for and what you will have at the end

This guide is for administrators and engineers who already work with Azure and want to move into a security-focused role, or who studied for AZ-500 before the retirement and want to reuse that effort. It is also useful if you manage a small Azure environment and want a structured way to harden it.

By the end you will have:

- A clear picture of the four AZ-500 skill areas and their weights.
- A list of what changed in SC-500, so you know which old notes still apply.
- A lab plan with concrete tasks for each area, small enough to run in a test subscription.
- A short checklist for deciding when you are ready to book an exam.

## Where the exam stands

Microsoft's AZ-500 study guide carries a warning that the exam retired on August 31, 2026. The Azure Security Engineer Associate certification page says the certification, the exam and the renewal assessments retired on that date, and that you can no longer earn or renew the certification. Microsoft's pages for the credential state that no training is listed for the exam any more.

Microsoft's SC-500 study guide covers Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads. Its study resources point to the Cloud and AI Security Engineer Associate certification page. The study guide says a score of 700 or greater is required to pass, the same statement made in the AZ-500 guide. The study guide does not give an exam duration or price. The certification page says you have 120 minutes to complete the exam and that the price depends on the country or region where it is proctored, so check it before scheduling.

If you already hold the retired certification, the certification page does not say what happens to a credential you earned earlier, so check your own Microsoft Learn profile.

## The final AZ-500 outline

The AZ-500 skills measured were last updated on January 22, 2026. The audience profile describes someone who implements, manages and monitors security for resources in Azure, multi-cloud and hybrid environments, using Microsoft Defender for Cloud and other tools, and who aligns the infrastructure with the Microsoft Cloud Security Benchmark.

| Skill area | Weight |
| --- | --- |
| Secure identity and access | 15-20% |
| Secure networking | 20-25% |
| Secure compute, storage, and databases | 20-25% |
| Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel | 30-35% |

The weights show where the effort went. Nearly a third of the exam was Defender for Cloud and Sentinel, and that area also included Azure Policy and Key Vault. Identity was the smallest area, but it underpins everything else because every other task assumes you can control who has access.

## The SC-500 outline and what changed

The SC-500 study guide lists these areas:

| Skill area | Weight |
| --- | --- |
| Manage identity, access, and governance | 20-25% |
| Secure storage, databases, and networking | 25-30% |
| Secure compute | 20-25% |
| Manage and monitor security posture | 20-25% |

The reorganisation matters more than the percentages. Key Vault and Azure Policy moved into the identity and governance area. Compute is now its own area and begins with security for AI, covering topics such as Microsoft Copilot Studio agents, Microsoft Entra Agent ID, AI Gateway in Azure API Management and the Defender for Cloud data and AI security dashboard. Servers and VMs, containers, Functions, Logic Apps, App Service and web application firewall follow in the same area. Posture management still centres on Defender for Cloud, but Microsoft Sentinel is now about collecting activity and events, and there is a separate objective on Microsoft Security Copilot.

Topics that appear in the AZ-500 outline but not by name in the SC-500 outline include Azure Disk encryption options such as encryption at host, ExpressRoute encryption, Azure Application Gateway and Front Door planning, and Azure DDoS Protection recommendations. They remain good Azure security knowledge, but do not assume they are tested. Compare the two guides line by line rather than relying on this summary.

## Prerequisites for the labs

You need:

- An Azure subscription you can break. A free account or a Visual Studio subscription is enough for most of these exercises. See [Azure free account limits for a home lab](https://www.epifive.com/blog/azure-home-lab-free-account-limits) for what the free tier covers.
- A budget alert before you start, because Defender plans, firewalls, Bastion and gateways bill by the hour. The post on [Azure budgets and cost alerts](https://www.epifive.com/blog/azure-budgets-cost-alerts-setup) shows the setup.
- A Microsoft Entra tenant where you hold Global Administrator or can create test users and groups. Use a development tenant, not a production one.
- Azure CLI or Azure PowerShell installed, so you can check results from the command line as well as the portal.

Delete resource groups when you finish each lab. A forgotten Azure Firewall or Bastion host is the usual source of surprise charges.

## Lab plan, area by area

Each lab below maps to bullets in Microsoft's skills measured. Do the portal version first, then repeat it with a command or a template so you know what the configuration actually is.

### Identity and access

Create two test users and a group. Assign the Reader role to the group at a resource group scope, then assign a custom role with a narrower set of actions. Enable Privileged Identity Management for an Azure role so one user must activate the assignment. Create a Conditional Access policy in report-only mode that requires MFA for the Azure management app, and review the sign-in logs to see what it would have done.

Then register an application, give it a permission scope, and look at how consent works. Create a managed identity, assign it a role on a storage account and read a blob from a VM without any stored credential. The outline asks you to manage service principals and managed identities, so list both from the command line:

```bash
az ad sp list --display-name "contoso-lab-app" --query "[].{name:displayName, id:appId}" -o table
az identity list --resource-group rg-lab-security -o table
```

If PIM or Conditional Access options are unavailable, check the licensing requirements in Microsoft's Entra documentation and use a trial licence in your development tenant.

### Networking

Build a virtual network with two subnets, attach network security groups and application security groups, and prove a rule works by testing connectivity. Use Network Watcher diagnostics to see which rule allowed or denied a flow. Add a user-defined route that sends traffic through a firewall. Then create a private endpoint for a storage account and disable public network access, so you can see name resolution change.

Cover the public-facing items too: put a web app behind an Application Gateway with a web application firewall policy, and read the firewall logs. For hybrid connectivity, a point-to-site VPN is the cheapest to try. Reading about site-to-site VPN, Virtual WAN and ExpressRoute encryption is fine if you do not want to pay for them, but be able to explain when each is used.

### Compute, storage and databases

For virtual machines, enable just-in-time access through Defender for Cloud and connect through Azure Bastion, then compare the experience with a public RDP rule. Encrypt a disk with a customer-managed key and note the difference between Azure Disk Encryption and encryption at host.

For storage, turn off shared key access where you can, create a user delegation SAS, enable soft delete and versioning, and try an immutable blob policy. For Azure SQL, enable Microsoft Entra authentication, turn on auditing to a Log Analytics workspace, add dynamic data masking to a column, and check that Transparent Data Encryption is on. For containers, create an AKS cluster with Microsoft Entra authentication and restrict access to the Azure Container Registry with Azure RBAC.

### Defender for Cloud, Policy, Key Vault and Sentinel

This is the largest AZ-500 area and the best place to spend time. Assign a built-in Azure Policy initiative, read the compliance results and remediate one non-compliant resource. In Key Vault, configure the firewall, grant access with Azure RBAC rather than access policies, create a key, set a rotation policy and test backup and restore. The article on [Key Vault RBAC versus access policies](https://www.epifive.com/blog/azure-key-vault-rbac-vs-access-policies) covers the permission model.

In Defender for Cloud, open the secure score and inventory, work through a recommendation, enable a Defender plan such as Defender for Servers on one test machine and check agentless scanning settings. Connect an AWS or GCP account only if you have one; the outline names both. Create a workflow automation that reacts to an alert.

For Sentinel, create a workspace, enable a data connector, turn on an analytics rule and build a simple automation rule. Query the workspace with KQL to check data is arriving:

```kusto
SecurityAlert
| where TimeGenerated > ago(7d)
| summarize alerts = count() by AlertName
| order by alerts desc
```

An empty result is normal in a new workspace. If a table is missing entirely, the connector has not sent data yet, so check its status page.

## Adding the SC-500 extras

If you are aiming for SC-500, add labs for items the AZ-500 guide did not name:

- Security Copilot: configure a workspace, assign roles and enable a plugin, using the objectives under the Security Copilot heading.
- AI security: review SharePoint oversharing, look at the Defender for Cloud data and AI security dashboard and review conditional access for agents, as listed in the guide.
- Platform services: secure an Azure Function, a Logic App and an App Service with authentication and network restrictions.
- Sentinel data collection: ingest syslog or CEF, create a custom log table and set retention.
- Governance: apply a resource lock and write one custom policy definition.

Some of these need licences you may not have in a test tenant. Where you cannot run a lab, read Microsoft's documentation for the feature and write down what you would configure and why.

## Verify that you are ready

Microsoft's AZ-500 guide linked a free practice assessment, but the certification page for SC-500 says its practice assessment is not currently available and usually appears within eight weeks of the exam being generally available. It does offer an exam sandbox to try the exam interface. Until a practice assessment exists, rely on your own labs to find gaps, since the guides say the bullets only illustrate how a skill is assessed and related topics may appear.

A simple test: for each bullet in the outline, can you perform it without notes and explain the trade-offs? If you can describe when to choose a service endpoint over a private endpoint, or Azure RBAC over a Key Vault access policy, you are close.

## Troubleshooting common study problems

- **A feature is missing in your tenant or subscription.** Check the licence or Defender plan first. Many security features are paid or need a higher Entra ID licence.
- **Costs climb.** Delete firewalls, gateways, Bastion hosts and enabled Defender plans after each lab, and keep the budget alert active.
- **Notes from an older course disagree with the portal.** Portal names change often. Trust the current Microsoft Learn documentation over video courses.
- **The outline mentions a preview feature.** Microsoft states most questions cover generally available features, but preview features may appear if commonly used.

## Closing checklist

- Confirm the current exam and credential names on Microsoft Learn.
- Download the study guide and tick each bullet as you build it.
- Run every lab in a throwaway subscription with a budget alert.
- Practise in both the portal and the command line.
- Use the exam sandbox, and a practice assessment once one is published, then revisit weak areas.
- Delete lab resources when done.

## References

- Study guide for Exam AZ-500 (retired): https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-500
- Microsoft Certified: Azure Security Engineer Associate (retired): https://learn.microsoft.com/en-us/credentials/certifications/azure-security-engineer/
- Study guide for Exam SC-500: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-500
- Cloud and AI Security Engineer Associate certification: https://learn.microsoft.com/en-us/credentials/certifications/cloud-and-ai-security-engineer-associate
- Exam scoring and score reports: https://learn.microsoft.com/en-us/credentials/certifications/exam-scoring-reports

## Frequently asked questions

### Can I still take the AZ-500 exam?

No. Microsoft's AZ-500 study guide states that the exam retired on August 31, 2026, at 11:59 PM Central Standard Time, and the certification page says you can no longer earn or renew the Azure Security Engineer Associate certification.

### What replaces AZ-500?

Microsoft publishes a study guide for Exam SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads. It has a different outline from AZ-500, so treat it as a new exam rather than a renamed one. Check the certification page for the credential it leads to before you book.

### Is the AZ-500 skills outline still worth studying?

Yes, as a practical checklist. Identity, networking, storage, Key Vault, Defender for Cloud and Microsoft Sentinel all appear again in the SC-500 outline. Labs built from the AZ-500 list stay useful for the job even though the exam itself is gone.

### What is the passing score for these exams?

Both study guides link to Microsoft's scoring page and state that a score of 700 or greater is required to pass.