SC-500
Microsoft Certified: Cloud and AI Security Engineer Associate
- DESCRIPTION
- VIDEO
- FEEDBACKS
- RELATED NEWS
SC-500 exam overview
SC-500 is the required exam for the Microsoft Certified: Cloud and AI Security Engineer Associate certification. It validates the skills needed to design, implement, and manage security controls across Azure, hybrid, multicloud, and AI-enabled environments.
The exam covers identity, data, applications, networks, compute, governance, and security posture. It also adds security controls for AI platforms, Microsoft Copilot, agents, Microsoft Foundry, and other AI workloads.
SC-500 replaces AZ-500 as Microsoft's main associate-level certification exam for cloud security engineers. The new exam keeps much of the Azure security foundation but gives AI security, Microsoft Entra, Microsoft 365, Defender XDR, and Security Copilot a larger role.
Page contents
2. Target Audience and Experience
4. Skills and Technologies Covered
7. Common Preparation Mistakes
9. CertQueen Preparation Materials
SC-500 exam quick view
| Certification | Microsoft Certified: Cloud and AI Security Engineer Associate |
| Exam code | SC-500 |
| Official exam title | Implementing End-to-End Security Controls for Cloud and AI Workloads |
| Level | Intermediate |
| Role | Security Engineer |
| Duration | 120 minutes |
| Passing score | 700 or greater |
| Language | English |
| Price | $165 USD, with regional pricing applied |
| Delivery | Proctored through Pearson VUE |
| Availability | Available since July 21, 2026 |
| Question count | Not published by Microsoft |
The exam may include interactive components. Microsoft does not publish a fixed number of questions, so candidates should manage time by question complexity rather than expecting a specific question count.
Target audience and recommended experience
SC-500 is intended for security engineers responsible for protecting systems and data across Azure, hybrid, multicloud, and AI-enabled environments.
- Azure security engineers
- Cloud security engineers
- Identity and access engineers
- Security architects working in implementation roles
- Platform and infrastructure security engineers
- AI platform security engineers
- Microsoft security consultants
Recommended experience
You should have practical experience administering Azure and hybrid environments, including compute, networking, and storage. Strong familiarity with Microsoft Entra ID is expected. Microsoft also recommends familiarity with Microsoft 365 administration.
Before taking the exam, you should be able to configure Azure resources, read Microsoft Entra and Azure role assignments, work with Azure Policy, and investigate security recommendations in Microsoft Defender for Cloud.
SC-500 exam skills and weights
| Skill domain | Weight | Main focus |
| Manage identity, access, and governance | 20% to 25% | Microsoft Entra ID, PIM, Conditional Access, authentication, managed identities, Azure Key Vault, Azure Policy, RBAC, compliance, and infrastructure as code |
| Secure storage, databases, and networking | 25% to 30% | Azure Storage, Azure SQL, Defender protection plans, NSGs, Virtual Network Manager, VPN, Private Link, private endpoints, Azure Firewall, and Network Watcher |
| Secure compute | 20% to 25% | AI security, Microsoft Copilot and agents, Entra Agent ID, Microsoft Foundry, VMs, Azure Arc, containers, AKS, App Service, Functions, API Management, and WAF |
| Manage and monitor security posture | 20% to 25% | Defender for Cloud, Defender CSPM, multicloud posture, vulnerability management, Microsoft Sentinel, event collection, automation, and Security Copilot |
Skills and technologies covered
- Microsoft Entra ID and Entra Agent ID
- Azure Key Vault and managed identities
- Azure Policy, RBAC, and regulatory compliance
- Azure Storage and Azure SQL security
- Azure Firewall, Private Link, VPN, and network controls
- Virtual machines, Azure Arc, containers, and AKS
- Microsoft Copilot, Copilot Studio agents, and Microsoft Foundry
- Microsoft Defender for Cloud and Defender CSPM
- Microsoft Sentinel and Security Copilot
SC-500 vs. AZ-500
| Comparison | SC-500 | AZ-500 |
| Certification | Cloud and AI Security Engineer Associate | Azure Security Engineer Associate |
| Status | Available from July 21, 2026 | Scheduled to retire August 31, 2026 at 11:59 PM Central Time |
| Main scope | Azure, hybrid, multicloud, Microsoft 365, and AI security | Primarily Azure infrastructure security |
| AI security | Explicit exam coverage | Not a separate major objective |
| Identity | Entra ID, Key Vault, managed identities, governance, and Entra Agent ID | Azure identity, RBAC, PIM, Conditional Access, and managed identities |
| Compute scope | AI workloads, servers, VMs, containers, applications, and APIs | VMs, containers, applications, storage, and databases |
| Security operations | Defender for Cloud, Sentinel, Security Copilot, Defender XDR, and AI security dashboards | Defender for Cloud and Sentinel |
| Microsoft 365 | Relevant to Copilot, agents, SharePoint exposure, Purview DSPM, and administration | Limited role |
| Passing score | 700 | 700 |
SC-500 is not a simple rename of AZ-500. Candidates moving from AZ-500 should keep their Azure security knowledge but add Microsoft 365, agent identity, AI workload protection, Purview DSPM, Defender XDR, Microsoft Foundry, and Security Copilot.
An existing AZ-500 certification is not automatically converted into SC-500. To earn the new Cloud and AI Security Engineer Associate certification, candidates must meet the SC-500 certification requirements.
Preparation priorities
Secure Storage, Databases, and Networking has the largest published range. The other three domains are close in weight, so none can be treated as a minor section.
- Review Microsoft Entra ID, PIM, Conditional Access, managed identities, and Key Vault.
- Practice Azure Storage, Azure SQL, private endpoints, Private Link, NSGs, and Azure Firewall.
- Study AI security separately from traditional VM and container security.
- Use Defender for Cloud to review posture, recommendations, compliance, and workload protection.
- Practice Sentinel data collection, connectors, automation rules, and playbooks.
- Review Security Copilot roles, plugins, workspaces, and agents.
Use hands-on exercises where possible. Many objectives ask you to implement or configure a control, not simply explain what the service does.
Common preparation mistakes
Preparing with AZ-500 materials alone
Older AZ-500 content remains useful for Azure security, but it does not cover the full SC-500 scope. AI workloads, Entra Agent ID, Microsoft Foundry, Purview DSPM, and Security Copilot require separate study.
Looking for a separate AI domain
AI security sits inside the Secure Compute domain. It may be overlooked because the top-level domain name does not mention AI.
Memorizing services without configuring them
Knowing that a service exists is not enough. Practice choosing settings, permissions, network controls, protection plans, and monitoring options for a given requirement.
Confusing posture management with workload protection
Defender CSPM finds configuration risks and exposure. Defender for Cloud workload protection plans detect threats against supported workloads. The exam can test which capability fits a particular scenario.
Ignoring Microsoft 365
SC-500 is broader than an Azure-only exam. SharePoint data exposure, Microsoft Copilot, agents, Purview DSPM, and the Microsoft 365 admin center are part of the published scope.
Free SC-500 sample questions
The following gallery is reserved for independently prepared SC-500 sample question screenshots. Replace each placeholder image address after uploading the final images.
CertQueen SC-500 preparation materials
CertQueen SC-500 preparation materials are organized around the four published skill domains. They are intended for candidates who have completed Microsoft Learn training or have equivalent practical experience.
What is included?
- Questions covering all four official domains
- Azure and Microsoft Entra configuration scenarios
- AI workload and agent security coverage
- Defender for Cloud, Sentinel, and Security Copilot questions
- Answers with concise explanations
- PDF and testing-engine formats
- 12 months of free content updates, with an optional upgrade to 24 months for $10
Begin with an untimed session and record mistakes by skill domain. Review the related Microsoft Learn modules, repeat the configuration in a lab, and then complete timed practice sessions.
The standard package includes free SC-500 content updates for 12 months from the purchase date. Updates may include corrections and changes made after Microsoft revises the official skills outline.
Start Your SC-500 Exam Preparation
Disclaimer
CertQueen is an independent preparation provider and is not affiliated with or endorsed by Microsoft. The sample questions are independently prepared and are not copied from the live exam. Preparation materials do not guarantee a passing result.