SC-500 vs AZ-500: AZ-500 Retires August 31, 2026, and SC-500 Is Still in Beta

AZ-500 is being retired: Microsoft says the exam, the certification and the renewal assessments all retire on August 31, 2026. The replacement is Exam SC-500 (Implementing End-to-End Security Controls for Cloud and AI Workloads), leading to Microsoft Certified: Cloud and AI Security Engineer Associate, and that certification page still carries the word "beta" today. If you have AZ-500 booked and can sit it before the end of August, sit it. If you have not booked, Microsoft's own words are: "If you haven't registered for the exam, we strongly recommend that you prepare for and take the new exam instead."

Last updated July 2026.

What is the difference between SC-500 and AZ-500?

AZ-500 is a pure Azure security engineering exam, weighted heavily toward Defender for Cloud and Sentinel. SC-500 keeps most of that Azure security core, then adds an entire AI security surface (Purview DSPM for AI, Copilot Studio agents, Microsoft Foundry guardrails, Entra Agent ID), adds Microsoft Security Copilot, and expects familiarity with Microsoft 365 administration. It also runs 120 minutes instead of 100.

On the score, Microsoft is explicit that 700 is scaled and "it may not equal 70% of the points," so anyone telling you to aim for 70 percent of the questions is guessing. There is no published per-exam question count either. The only figure Microsoft gives is general: most of its exams contain 40 to 60 questions.

The trap: there is no AI domain on SC-500

Read the four SC-500 domain titles and you would conclude the AI content is a footnote. It is not. All of it lives inside "Secure compute," weighted 20 to 25 percent, sitting next to VM disk encryption and Azure Bastion. The objectives listed there include Microsoft Purview DSPM for AI, real-time protection for Copilot Studio agents, conditional access for Microsoft Entra Agent ID, blast-radius analysis using Defender XDR, deploying AI Gateway in Azure API Management for Microsoft Foundry, configuring guardrails for agent security in Foundry, Defender for AI Service, and data overexposure in SharePoint.

Skip that lot and you walk into roughly a fifth of the paper unprepared. The weighting is flat: nothing under 20 percent, nothing over 30. No domain is safely skippable.

The agent objectives are the ones most candidates have no hands-on story for. In practice that work looks less like a firewall rule and more like a policy layer in front of the model that will stop prompt injection and enforce what an agent is allowed to touch, which is roughly what Microsoft means by "guardrails for agent security" and conditional access for Entra Agent ID.

Is AZ-500 being retired?

Yes. The warning on the Azure Security Engineer page reads: "This certification, related exam, and renewal assessments will retire on August 31, 2026. You will no longer be able to earn or renew this certification after this date." Microsoft publishes the date only, not a time of day, so treat August 31 as the last safe day and do not cut it fine.

AZ-500 is not alone. Microsoft's timeline (updated May 28, 2026) retires DP-100 on June 1, AI-900 and AI-102 on June 30, AZ-204 on July 31, AZ-500 on August 31, and AZ-800 plus AZ-801 in September (a planned date, per the footnote). AZ-104 is not in that table and is not retiring, so an AZ-104 practice test routine is still time well spent.

What replaces AZ-500?

SC-500, titled "Implementing End-to-End Security Controls for Cloud and AI Workloads." No formal prerequisite. Microsoft's recommended experience: administering Azure and hybrid environments (compute, network, storage), strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration. That last clause is the quiet change, and it surfaces in objectives like SharePoint data overexposure and Purview.

If you are mid-way through AZ-500 prep, most of it carries over: Defender for Cloud, Sentinel, Entra ID, Key Vault, network security (NSGs, Azure Firewall, private endpoints), storage and database protection. Genuinely new: the AI surface, Security Copilot, and the Microsoft 365 flavor.

Should I take AZ-500 or SC-500?

It depends on how close you are to sitting it. Booked and ready before August 31: take AZ-500, a live, scored, well-documented exam with an official practice assessment. Not booked: take SC-500, because AZ-500 is a dead end after August 31 and Microsoft says so in plain language.

Is SC-500 still in beta?

Yes, as of July 2026. The certification page headline still reads "Microsoft Certified: Cloud and AI Security Engineer Associate (beta)." Microsoft's announcement said training and the exam were expected in July 2026, but the beta marker has not come off, so do not let a training provider tell you it is generally available.

Beta status has three concrete consequences. First, scoring. Microsoft: "Beta exams are not scored immediately because we're gathering data on the quality of the questions and the exam," and "If you took a beta exam, you won't receive results until the exam completes the beta process and goes live." You walk out knowing nothing, and no date has been published for when results arrive.

Second, no official question bank: "The Practice Assessment for this exam is not currently available. Practice Assessments are usually available within 8 weeks of the exam being out of beta and generally available." Every "official SC-500 practice test" advertised right now is somebody's invention. That gap is what our SC-500 practice test generator exists for: feed it the study guide you are actually reading, and the questions come from your source material rather than a guess.

Third, English only. AZ-500 is offered in 10 languages. SC-500 is not, which is a real accessibility hit.

One thing has not changed: role-based exams are open book. You can browse learn.microsoft.com during the exam (excluding Q&A, practice assessments and your profile), with no extra time granted. On a 120-minute paper that lookup budget is thin, so practice using it.

Does SC-500 replace SC-200?

No. Microsoft does not say that anywhere. SC-200 is not on the retirement timeline and is not mentioned on the SC-500 pages. Read the two outlines side by side and you will spot overlap in Sentinel and Defender XDR content, but that is an observation about the syllabi, not a Microsoft statement. Treat any claim that SC-500 "combines SC-200 and AZ-500" as unsourced.

What happens to my AZ-500 certification after it retires?

Nothing bad, and nothing immediate. Microsoft's FAQ: "If you've already earned any of the retiring Certifications, your credential remains valid and, on your transcript, until it expires. Retirement does not revoke or invalidate Certifications that were earned." You can still renew, but only before the date: "Yes, as long as it's eligible for renewal and you renew it before the Certification officially retires."

Here is the nuance people miss. The renewal assessment retires on August 31, 2026 along with the exam, so an AZ-500 certification can be renewed one last time before that date and never again after it. Whatever expiry you hold then is final, and when it lapses the credential becomes historical on your transcript. Our explainer on whether Microsoft certifications expire and how renewal works covers the six-month renewal window that catches people out.

Be careful what you read about either exam

Of the AZ-500 prep pages checked while writing this, none mentioned the August 31, 2026 retirement. SPOTO says the exam is "150 minutes" (it is 100) and never uses the word "retire." mscertquiz.com prints "40-60 questions, 150 minutes" and builds a study plan around a "150-minute timed mock exam." CertWizard still lists AZ-500 domains that stopped existing before 2022 ("Implement Platform Protection 35-40%"). On SC-500, aguidetocloud.com puts "Duration 100 minutes" under a heading reading "Official Exam Details" (Microsoft says 120) and never mentions beta. betastudy.app prints "Official SC-500 exam format: Questions 50," the same 50 it prints for AI-103 and AI-200: one hardcoded number sold as three exams' official format.

Check the exam length, domain weights and retirement banner on learn.microsoft.com yourself, and distrust any confident question count or pass rate: Microsoft publishes neither.

How to study when there is no official question bank

For SC-500 you cannot buy a trustworthy practice set, so build one from primary sources: the Learn modules for the four domains, the study guide, your own team's documentation. You can build a question bank from your security runbook or from any PDF or deck, so your questions come from current material rather than a scraped 2022 syllabus. Sitting AZ-500 before August 31 instead? Drill the four current domains with an AZ-500 practice test, weighting your time toward Defender for Cloud and Sentinel, which alone are 30 to 35 percent of that paper.

The decision itself is not complicated. Booked and ready before the end of August: AZ-500. Everyone else: SC-500, beta warts included.