SC-500
SC-500: Cloud and AI Security Engineer
Everything you need for Microsoft exam SC-500: format, passing score, the four skill areas, a study plan and free sample questions.
- Duration
- 120 min
- Passing score
- 700 / 1000
- Replaces
- AZ-500
- Language
- English only
SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads, is Microsoft’s exam for security engineers protecting Azure and hybrid environments — now including the AI workloads running on them. Passing it earns the Microsoft Certified: Cloud and AI Security Engineer Associate credential.
It is the current exam for this role. AZ-500 and the Azure Security Engineer Associate certification were retired on August 31, 2026, along with their renewal assessments.
This is a wide exam. Microsoft expects practical experience administering Azure and hybrid environments across compute, network and storage, strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration. The AI content is genuinely new: Entra Agent ID, Purview DSPM for AI, real-time protection for Copilot Studio agents, AI Gateway in API Management, and Defender for AI Services.
What the exam covers
| Skill area | Weight |
|---|---|
| Manage identity, access, and governance | 20–25% |
| Secure storage, databases, and networking | 25–30% |
| Secure compute | 20–25% |
| Manage and monitor security posture | 20–25% |
Unusually even. No domain dominates, which means there is nowhere to hide a weakness — the flat weighting is itself the main planning constraint.
Where to start
Read the exam format for the mechanics, then what changed from AZ-500 if you studied for or held the old certification. The study plan runs to six weeks, which is honest for the breadth here.
SC-500 guides
- SC-500 exam format: questions, score and costThe SC-500 format: 120 minutes, passing score 700, English only, question types and what the even domain weighting means for your revision.
- SC-500 vs AZ-500: what changed?AZ-500 retired on 31 August 2026 and SC-500 is the current security engineer exam. What changed, what carries over, and what is new.
- SC-500 study plan: pass in 6 weeksA six-week SC-500 study plan covering all four evenly weighted domains, with hands-on Azure tasks and a dedicated week for the AI security content.
- Free SC-500 sample questions with answersFive free SC-500 practice questions across the four skill areas, each with an explained answer.
- SC-500 identity, access and governanceThe SC-500 identity domain explained: Entra ID, PIM, conditional access, Key Vault, Azure Policy, RBAC and remediating overprivileged access.
- SC-500 storage, databases and networkingThe largest SC-500 domain explained: storage account security, Azure SQL protection, NSGs, private endpoints, Azure Firewall and Entra Private Access.
- SC-500 secure compute and AI explainedThe SC-500 compute domain explained: securing AI with Entra Agent ID and Purview DSPM, plus servers, VMs, containers and app platform services.
- SC-500 manage and monitor security postureThe SC-500 posture domain explained: Defender for Cloud and CSPM, multicloud onboarding, EASM, Microsoft Sentinel collection and Security Copilot.
- Is SC-500 hard? Exam difficulty explainedHow hard SC-500 really is: why the flat domain weighting and the breadth matter more than any single topic, and what catches candidates out.
- Is SC-500 worth it? Who should take itIs SC-500 worth taking? Who benefits, what it costs, and why the retirement of AZ-500 changes the calculation for Azure security engineers.