Is AZ-500 being retired?

Yes. Microsoft states that Exam AZ-500 and the Azure Security Engineer Associate certification retire on August 31, 2026 at 11:59 PM Central Time. After that date you can no longer earn or renew this certification. The replacement is Exam SC-500, which leads to the Cloud and AI Security Engineer Associate certification.

What replaces AZ-500?

Exam SC-500, which earns the Cloud and AI Security Engineer Associate certification. Microsoft's own guidance is direct: if you have not already registered for AZ-500, it strongly recommends you prepare for and take SC-500 instead. Training for SC-500 became available in July 2026.

If I already passed AZ-500, do I lose my certification when it retires?

No. Microsoft states that retirement does not revoke or invalidate certifications that were already earned. Your credential stays valid and on your transcript until it expires. What you lose is the ability to renew it, because the renewal assessment retires with the exam on August 31, 2026.

What are the AZ-500 domain weights?

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel is the largest domain at 30 to 35 percent. Secure networking is 20 to 25 percent, secure compute, storage, and databases is 20 to 25 percent, and secure identity and access is the smallest at 15 to 20 percent. Identity was cut from 25 to 30 percent in January 2025, which surprises people.

How long is the AZ-500 exam and how many questions?

Microsoft's certification page states you have 100 minutes to complete the assessment, with 120 minutes of total seat time. Microsoft does not publish a question count for AZ-500. Its general guidance is that most exams contain 40 to 60 questions, varying by exam.

What score do you need to pass AZ-500?

700 or greater on a scale of 1 to 1000. Microsoft explicitly notes that because this is a scaled score, it may not equal 70 percent of the points. You cannot work backwards from it to a number of questions.

How much does the AZ-500 exam cost?

$165 USD in the United States, which is the standard price for Microsoft role-based associate and expert exams. Fundamentals exams like AZ-900 and SC-900 cost $99. Pricing varies by the country or region in which the exam is proctored, and tax may be added.

Do you need AZ-104 before AZ-500?

No. Microsoft lists no prerequisite certification or exam for AZ-500. It recommends practical experience administering Azure and hybrid environments, and strong familiarity with Microsoft Entra ID plus Azure compute, network and storage. In practice most people find AZ-500 hard without that administration grounding.

AZ-500 practice test

AZ-500 Practice Test, Practice Questions and Exam Prep From Your Own Security Notes

Upload your Azure security notes, Defender for Cloud runbook or prep-course PDF, and the AI writes unlimited AZ-500 practice questions with an answer key and explanations in seconds. Read the retirement notice below before you book anything.

Your study files are processed securely and deleted automatically after your practice questions are built.

Upload your AZ-500 notes or prep PDF and generate your first question set

Click to upload or drag and drop

PDF, DOCX, PPTX, TXT, JPG, JPEG, PNG, HEIC, ODP, ODT, BMP, or TIFF

up to 20MB

Please wait, your quiz is being created...

Uploading...

Read this before you book: AZ-500 retires on August 31, 2026. Microsoft is retiring both Exam AZ-500 and the Azure Security Engineer Associate certification at 11:59 PM Central Time on that date, and replacing them with Exam SC-500, leading to the Cloud and AI Security Engineer Associate certification. Microsoft's own advice: if you have not already registered, prepare for SC-500 instead. If you are mid-preparation and can sit before the deadline, AZ-500 is still worth finishing, and an already-earned certification is not revoked by the retirement. The exam is 100 minutes, needs 700 out of 1000, costs $165, and its biggest domain by far is Defender for Cloud and Microsoft Sentinel at 30 to 35 percent.

Last updated July 2026

AZ-500 is being retired, and most prep sites have not noticed

This is the single most important fact about AZ-500 in July 2026, and you will not find it on most of the pages selling you AZ-500 courses. Microsoft's warning banner on the official study guide is unambiguous:

"This certification, related exam, and renewal assessments will retire on August 31, 2026. You will no longer be able to earn or renew this certification after this date."

The replacement is Exam SC-500, which earns the Cloud and AI Security Engineer Associate certification. Microsoft's guidance to anyone who has not yet registered is direct: prepare for and take the new exam instead. SC-500 training became available in July 2026.

So what should you actually do?

Your situation	What to do
You already hold AZ-500	Nothing changes today. Microsoft states retirement "does not revoke or invalidate Certifications that were earned." It stays valid and on your transcript until its own expiry date. But you cannot renew it after August 31, 2026, because the renewal assessment retires too. When it lapses, SC-500 is the path forward.
You are deep in AZ-500 prep and can sit before August 31	Finish it. A real certification earned now beats an abandoned one, and it buys you a year of validity. Then plan for SC-500 when it lapses.
You are just starting out	Do not start AZ-500. Take Microsoft at its word and prepare for SC-500. Starting a study plan in July 2026 for an exam that dies in seven weeks is buying a credential you cannot renew.
Your employer is paying and wants "the Azure security cert"	Send them this section. The cert your employer means is now SC-500. Most training budgets are approved against a name, and the name changed.

Either way, the underlying skills carry over almost entirely. Defender for Cloud, Microsoft Sentinel, Entra ID, network security and workload protection do not stop mattering because an exam number changed. If you are studying this material, upload your notes and build a question bank from your security runbook. Questions built from your own material keep working after the exam code changes, which is more than can be said for a question bank you bought.

Exam time: 100 minutes
Passing score: 700 / 1000
Retires: Aug 31, 2026
Practice questions: Unlimited

AZ-500 stopped being an identity exam in January 2025

If you are working from material written before 2025, you are studying the wrong exam. On January 31, 2025 Microsoft rebuilt the AZ-500 outline, renamed two of the four domains, deleted whole sub-objectives, and moved a lot of weight. This is the update that matters, and it is bigger than anything since.

Before January 31, 2025	Weight	Current domain	Weight
Manage identity and access	25 to 30%	Secure identity and access (renamed)	15 to 20%, cut hard
Manage security operations	25 to 30%	Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (renamed)	30 to 35%, now the biggest
Secure networking	20 to 25%	Secure networking	20 to 25%
Secure compute, storage, and databases	20 to 25%	Secure compute, storage, and databases	20 to 25%

Read the top two rows together, because they tell one story. Identity fell by roughly ten points and the Defender for Cloud and Sentinel domain became the largest on the paper. Two entire sub-objectives, "Manage Microsoft Entra identities" and "Manage Microsoft Entra authentication", were deleted outright. AZ-500 used to be an exam about who can log in. It is now an exam about posture management, threat protection and security operations tooling.

That reframing is also, in hindsight, the reason AZ-500 is being retired into a cloud-and-AI security role. Microsoft has been steering this exam toward the security operations centre for eighteen months.

One honest note about Microsoft's own change log, because we would rather flag it than quietly launder it: the January 2025 log marks Secure networking as "% of the exam increased" while publishing an identical 20 to 25 percent range before and after. That is an inconsistency in Microsoft's documentation, not a number we can hand you. We are reporting the published ranges.

The most recent update, January 22, 2026, changed no weights at all. Every functional group is marked "No change". The only real edit was folding managed identities into the Entra application access objective.

AZ-500 skills measured, current objectives

Four domains, as published in Microsoft's study guide for Exam AZ-500 as of January 22, 2026.

Domain	What is actually in it	Weight
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel	Cloud governance policy enforcement, security posture with Defender for Cloud, threat protection, security monitoring and automation. Includes Defender EASM, agentless scanning, DevOps Security across GitHub, Azure DevOps and GitLab, data collection rules in Azure Monitor, and Sentinel connectors, analytics rules and automation. The biggest domain, and the newest material.	30 to 35%
Secure networking	Virtual network security, private access (Private Link, Virtual WAN and secured virtual hubs, Azure Virtual Network Manager, encryption over ExpressRoute), and public access.	20 to 25%
Secure compute, storage, and databases	Advanced compute security (AKS, ACI, Container Apps, Container Registry, App Service Environment), storage security, and Azure SQL Database and SQL Managed Instance. Encryption at host, confidential disk encryption, BYOK, TDE, Always Encrypted.	20 to 25%
Secure identity and access	Security controls for identity and access, Microsoft Entra application access and managed identities. The smallest domain now, after being the biggest.	15 to 20%

Microsoft gives 100 minutes for the assessment, with 120 minutes of total seat time, and does not publish a question count for AZ-500. General guidance is 40 to 60 questions. The exam is proctored, may contain interactive components, and like other role-based exams it lets you access Microsoft Learn while you sit it, with no extra time granted.

Azure AD is called Microsoft Entra ID, and your study notes may not know

Microsoft announced the rename on July 11, 2023, started rolling it across products on August 15, 2023, changed SKU and service-plan display names on October 1, 2023, and updated the AZ-500 exam outline on October 31, 2023. That entire October 2023 change log is, essentially, one find-and-replace: every objective that said "Azure AD" now says "Microsoft Entra ID".

It sounds cosmetic. On an exam it is not, for a practical reason: the answer options use the current product names. A candidate who has revised from a 2022 course is scanning for "Azure Security Center" and "Azure Sentinel", which are now Microsoft Defender for Cloud and Microsoft Sentinel, and for "Azure AD Privileged Identity Management" rather than the Entra branding. Under time pressure, that hesitation costs marks on questions you actually know.

If your notes say	The exam says
Azure AD / Azure Active Directory	Microsoft Entra ID
Azure Security Center	Microsoft Defender for Cloud
Azure Sentinel	Microsoft Sentinel
Azure Disk Encryption (on the VM objectives)	Encryption at host, and confidential disk encryption

Run your own material through that table before exam day. If you generate practice questions from notes that still say "Azure AD", the questions will too, and you will have rehearsed the wrong vocabulary.

The renewal trap, sharpened by the retirement

Azure Security Engineer Associate expires 12 months after you earn it, like every Microsoft associate certification. Normally you renew free on Microsoft Learn in the six-month window before expiry. But the AZ-500 renewal assessment retires on August 31, 2026 along with the exam. So a certification you earn in July 2026 expires in July 2027 with no renewal path. When it lapses, SC-500 is how you stay certified.

That does not make earning it pointless. A certification on your transcript is a certification, and Microsoft is explicit that retirement does not revoke it. But it does change the math on whether to start from scratch today, and it is exactly the sort of thing a course seller has no incentive to mention.

A related trap worth knowing, because it is repeated everywhere: several training sites still tell you Microsoft certifications are valid for two years. InfoSec Train's AZ-500 page says the certification "does not expire but is valid only for two years", which is wrong twice in one sentence. CertHippo publishes nearly identical wording. Two years has been wrong since June 30, 2021, when Microsoft moved role-based certifications to a one-year cycle. We wrote up the whole policy, including which certifications never expire, in do Microsoft certifications expire.

How to make AZ-500 practice questions from your own notes

With the exam changing under you, questions generated from current material beat any bank you can buy.

1 Upload current material: Defender for Cloud and Sentinel documentation, your organization's security runbook, or a prep PDF published after January 2025.
2 Lead with Defender and Sentinel: 30 to 35 percent of the exam, the largest domain, and the one that grew while identity shrank.
3 AI writes the questions: Exam-style items with an answer key and explanations, using the product names your source material uses.
4 Carry it into SC-500: The skills transfer even though the exam code does not. Questions built from your own notes keep working after August 31.

AZ-500 questions, answered

Is AZ-500 being retired?: Yes. Microsoft states that Exam AZ-500 and the Azure Security Engineer Associate certification retire on August 31, 2026 at 11:59 PM Central Time. After that date you can no longer earn or renew this certification. The replacement is Exam SC-500, which leads to the Cloud and AI Security Engineer Associate certification.
What replaces AZ-500?: Exam SC-500, which earns the Cloud and AI Security Engineer Associate certification. Microsoft's own guidance is direct: if you have not already registered for AZ-500, it strongly recommends you prepare for and take SC-500 instead. Training for SC-500 became available in July 2026.
If I already passed AZ-500, do I lose my certification when it retires?: No. Microsoft states that retirement does not revoke or invalidate certifications that were already earned. Your credential stays valid and on your transcript until it expires. What you lose is the ability to renew it, because the renewal assessment retires with the exam on August 31, 2026.
What are the AZ-500 domain weights?: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel is the largest domain at 30 to 35 percent. Secure networking is 20 to 25 percent, secure compute, storage, and databases is 20 to 25 percent, and secure identity and access is the smallest at 15 to 20 percent. Identity was cut from 25 to 30 percent in January 2025, which surprises people.
How long is the AZ-500 exam and how many questions?: Microsoft's certification page states you have 100 minutes to complete the assessment, with 120 minutes of total seat time. Microsoft does not publish a question count for AZ-500. Its general guidance is that most exams contain 40 to 60 questions, varying by exam.
What score do you need to pass AZ-500?: 700 or greater on a scale of 1 to 1000. Microsoft explicitly notes that because this is a scaled score, it may not equal 70 percent of the points. You cannot work backwards from it to a number of questions.
How much does the AZ-500 exam cost?: $165 USD in the United States, which is the standard price for Microsoft role-based associate and expert exams. Fundamentals exams like AZ-900 and SC-900 cost $99. Pricing varies by the country or region in which the exam is proctored, and tax may be added.
Do you need AZ-104 before AZ-500?: No. Microsoft lists no prerequisite certification or exam for AZ-500. It recommends practical experience administering Azure and hybrid environments, and strong familiarity with Microsoft Entra ID plus Azure compute, network and storage. In practice most people find AZ-500 hard without that administration grounding.
What happens if you fail AZ-500?: You wait 24 hours before the second attempt, then 14 days between each attempt after that, with a maximum of five attempts in a 12-month period. You pay the exam fee each time. Given the August 31, 2026 retirement, a failed first attempt leaves a very tight runway.

PDFQuiz is not affiliated with, endorsed by, or sponsored by Microsoft. Microsoft, Azure, Microsoft Entra ID, Microsoft Defender for Cloud and Microsoft Sentinel are trademarks of the Microsoft group of companies. This generator builds practice questions from material you upload and is a study aid, not a substitute for Microsoft's official learning paths. Retirement dates and exam details change: always confirm on Microsoft's own pages before you book.

Related study tools

Most AZ-500 candidates come through Azure administration first, so the AZ-104 practice test generator is the natural companion, and the AZ-900 practice test generator covers the fundamentals exam that never expires. For architecture, use the AZ-305 practice test generator. On the wider security track, the Security+ practice test generator and the CISSP practice questions generator cover the vendor-neutral credentials, and the CySA+ practice test generator covers security operations. For any source document, use the certification exam generator.

Build your first AZ-500 practice set

Upload your Azure security notes and generate exam-style questions in under a minute, weighted to Defender for Cloud and Sentinel.

Start Creating Practice Questions