AZ-500 Retires August 31, 2026: SC-500 Replaces It

Microsoft pulls AZ-500 off the schedule on August 31, 2026, at 11:59 PM Central Standard Time. After that timestamp the Azure Security Engineer Associate certification can no longer be earned, and the renewal assessment goes away with it, which is the part most candidates miss. The replacement exam is SC-500, and it leads to a different credential with a different name and no conversion path from the old one.

So anyone mid study has roughly four weeks to make a decision, and the right decision is not the same for everybody. Someone eight modules into an AZ-500 plan with a Pearson VUE slot already booked is in a completely different position from someone whose manager just told them to go get an Azure security cert. Having spent a lot of time around Fortune 500 security teams and defense contractors, my read is that job requisitions and contract language lag certification changes by a year or more, and that lag cuts both directions depending on where you sit. This article lays out what changed, what SC-500 adds, and how to pick.

SC-500 is not AZ-500 with a new exam number stapled to it. It is a separate certification, and Microsoft is not converting anybody over. There is no free upgrade and no equivalency claim to make.

When Does AZ-500 Retire and What Replaces It?

Exam AZ-500: Microsoft Azure Security Technologies and the Microsoft Certified: Azure Security Engineer Associate certification both retire on August 31, 2026. Its replacement is Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, which leads to the Microsoft Certified: Cloud and AI Security Engineer Associate credential.

SC-500 opened in beta on May 15, 2026, with the usual Microsoft beta discount for the first 300 candidates who sat it on or before June 8. It reached general availability on July 21, 2026, so it has been live and bookable for a couple of weeks now. The instructor led courseware moved with it. AZ-500T00 is being retired and replaced by SC-500T00, a four day intermediate course organized into twelve learning paths and sixty three modules mapped to the four exam domains.

One thing to get straight up front, because the naming causes confusion. The prefix changed from AZ to SC, which in Microsoft’s taxonomy signals a move from the Azure track into the security, compliance, and identity track. That is not cosmetic. Microsoft is saying that securing cloud infrastructure and securing the AI systems running on top of it are now one job description rather than two.

What Does SC-500 Test That AZ-500 Never Did?

The headline addition is a set of AI security objectives that had no equivalent on AZ-500. Everything else carries forward from the old exam with updates, so a candidate who already knows Entra ID, Key Vault, network security groups, Defender for Cloud, and Sentinel is not starting from zero.

Per the official SC-500 study guide, the exam breaks into four skill areas: Manage identity, access, and governance at 20 to 25 percent; Secure storage, databases, and networking at 25 to 30 percent; Secure compute at 20 to 25 percent; and Manage and monitor security posture at 20 to 25 percent. The AI content lives inside Secure compute, under an objective group called Implement security for AI.

How Much of the Exam Is Actually About AI?

Less than the marketing around it suggests, and this is where I would push back on some of the coverage. Implement security for AI is one of three objective groups inside Secure compute. The other two are servers and virtual machines, covering disk encryption, Azure Bastion, just in time VM access, Azure Arc, Defender for Servers, secure boot and virtual TPM, and application platform services, covering Defender for Containers, AKS, Azure Container Registry, Functions, Logic Apps, App Service, and Web Application Firewall. All of that shares a domain worth 20 to 25 percent of the exam.

Microsoft Security Copilot does show up separately in the fourth domain, under configuring workspaces, permissions and roles, plugins, and Security Store agents. Add it all together and the AI specific content is a meaningful slice, not the majority of the exam. Someone who skips Sentinel data connectors and Azure Policy to spend three weeks on Foundry guardrails is going to fail this thing. The bulk of SC-500 is still cloud infrastructure security, and candidates who treat it as an AI exam misallocate their study time badly.

AZ-500 vs SC-500: A Side by Side Comparison

On price, both sit at Microsoft’s standard associate level rate. Microsoft prices by country and region rather than publishing one global number, and the exam detail page calculates it at registration, so check the figure for your location on the Cloud and AI Security Engineer Associate page before you budget. In the United States that has been $165 for role based associate exams.

Should You Still Take AZ-500 Before August 31, 2026?

For most people reading this in August 2026, no. Sit SC-500 instead. There is a narrow set of circumstances where AZ-500 is still the better play, and it is worth being precise about them rather than giving the diplomatic answer.

Take AZ-500 if you are nearly finished and can book a seat. Somebody who has worked through most of the objectives and can realistically test in the next three weeks should finish what they started. Passing an exam you already prepared for beats abandoning that work to restart on new material, and the credential still lands on your transcript.

Take AZ-500 if a contract or job requisition names it explicitly. This is the one that matters in the federal and defense world, and it is the reason the answer is not a clean no. Statements of work name specific credentials by title, and so do DoD 8140 job role mappings and the staffing language at large primes. None of that updates the week Microsoft publishes a retirement notice. If a contract you are staffed against says Azure Security Engineer Associate, and it retires before the contract language catches up, earning it now is a legitimate business decision even though the credential has no long term runway. Ask your program manager, not the internet.

Skip AZ-500 if you are starting from scratch. Four weeks is not enough runway for a fresh candidate on an associate level security exam, and even if you cleared it, you would hold a credential you can never renew. It stays valid until its printed expiration date, then it lapses permanently. That is a cert with a shelf life measured in months, earned at full price, for a role that is being redefined underneath you.

What If Your Employer Requires AZ-500 for a Promotion?

This comes up inside companies as often as it does on contracts. A lot of large Microsoft only shops use certifications as the baseline for internal job levels, so a promotion packet or an annual progress review names a specific credential and the employee has to go earn it before the conversation moves forward. The cert is the gate, and nobody in the room has authority to waive it.

Four engineers at a large West Coast healthcare organization sat exactly there this summer, with AZ-500 named in their internal framework and promotion reviews coming up. They chose to hold off and wait for SC-500 rather than sprint the retiring exam before the deadline, reasoning that their internal framework would catch up eventually and they would rather hold a credential that still has a renewal path in twelve months. That is the opposite call from the contract scenario above, and for them it was the right one. There is a wrinkle, though. Their security organization is still evaluating SC-500 against its own compliance requirements before it replaces AZ-500 as the accepted baseline, and in a regulated healthcare environment that review is not a formality. That swap is likely, but it is not automatic.

An internal job framework is still far easier to get changed than a signed statement of work, because the person who owns that requirement usually works down the hall from you. Send them the Microsoft retirement notice and the SC-500 study guide, and most reasonable managers will update the requirement rather than send their team after a credential that expires without a renewal option.

Which is why, if you go that route, you want the change in writing before your review date. A verbal agreement that SC-500 counts is worth very little when the promotion packet reaches somebody two levels up who is reading the old requirement off a spreadsheet, and it is worth even less if the credential is still working its way through a compliance review that nobody told you about.

What Happens to an AZ-500 Certification You Already Hold?

It stays on your transcript. A certification you earned before the retirement date remains in the Active Certifications section of your Microsoft Learn profile until its normal expiration, then moves to Historical Certifications, where employers can still see that you earned it. Nothing gets deleted and no action is required right now.

The renewal question is where people get burned. Microsoft role based certifications are renewed through a free online assessment that opens six months before expiration, and the AZ-500 renewal assessment retires alongside the exam. So if your expiration date falls before August 31, 2026, you can still renew and buy yourself another twelve months. If it falls after, that renewal window never opens and the credential lapses when it expires. There is no automatic conversion to the new credential, no discounted upgrade exam, and no equivalency claim you can make. Anyone who wants Cloud and AI Security Engineer Associate takes SC-500 like everybody else. Check your expiration date today, because the difference between renewing on August 29 and discovering the assessment is gone on September 2 is a full year of certified coverage.

Which Other Microsoft Certifications Are Retiring in 2026?

AZ-500 is one piece of the largest Microsoft certification reshuffle since the move to role based credentials in 2019. The pattern is consistent across the whole wave: exams that tested one technology stack now test that stack plus how to build or secure AI on top of it.

Anyone who lived through the MCSA sunset will recognize the rhythm. Microsoft announces, gives roughly a year of notice, retires the exam, and the credential lingers on transcripts while hiring managers slowly stop asking about it. If you want the longer version of how that played out, we covered it in Alternatives to MCSA Certifications. The difference this time is that the replacements are not just renumbered. They carry new scope, which means building a new study plan rather than patching the old one. Our complete guide to Microsoft certifications maps how the role based tracks fit together if you are trying to plan more than one exam.

How Should You Prepare for SC-500?

Use the published skills outline as your checklist. Microsoft states plainly that most questions cover generally available features, with preview features appearing only when they are commonly used, so the bulleted objectives really are the boundary of what shows up.

Candidates coming from an AZ-500 background should audit their gaps rather than restart. Entra ID, Privileged Identity Management, conditional access, Key Vault, Azure Policy, storage firewalls, network security groups, Azure Firewall, private endpoints, Defender for Cloud, and Sentinel all carry forward. What is new is the agent identity material, the Purview and Copilot exposure work, Foundry, and Security Copilot administration. Two of those overlap with things security teams are already dealing with in production, which helps. We wrote up the agent side of this when Microsoft shipped the first wave in Azure Copilot’s six new AI agents.

Hands on time matters more here than it did on AZ-500. Entra Agent ID, Foundry guardrails, and the Data and AI security dashboard are recent enough that there is not much accumulated exam prep material yet, and the question writers are drawing from documentation and product behavior rather than from a decade of established practice. Reading about a blast radius analysis in Defender XDR and actually running one are different levels of preparation, and Microsoft notes the exam may include interactive components. A free Azure account plus a Microsoft 365 developer tenant covers most of what you need to click through.

One scheduling note. Microsoft’s July 2026 Partner Center announcements confirm the AZ-500 retirement and SC-500 availability dates, and partner designation requirements shift on their own timeline. Register with a personal Microsoft account rather than a work account if you can, because exam records tied to an organizational account are lost and unrecoverable when you leave that organization.

Frequently Asked Questions

When exactly does AZ-500 retire?

Exam AZ-500 and the Azure Security Engineer Associate certification retire on August 31, 2026, at 11:59 PM Central Standard Time. The renewal assessment retires on the same date. After that, neither the exam nor the certification can be earned or renewed.

Does my AZ-500 certification become invalid after it retires?

No. A certification earned before the retirement date stays in the Active Certifications section of your Microsoft Learn profile until its printed expiration date, then moves to Historical Certifications where it remains visible to employers. You just cannot renew it once the renewal assessment retires.

Is there an upgrade path from AZ-500 to SC-500?

No. Microsoft has not published a transition exam or an equivalency claim, and there is no upgrade discount for existing AZ-500 holders. Cloud and AI Security Engineer Associate is a separate credential earned by passing SC-500 at full price.

Is SC-500 harder than AZ-500?

Both sit at the associate level with the same 120 minute limit and the same 700 out of 1000 passing score, so the tier has not changed. The scope is broader, though, because SC-500 keeps the Azure infrastructure security content and adds AI security objectives on top, which means more material for the same amount of exam time.

What are the SC-500 exam domains and their weights?

The four skill areas are Manage identity, access, and governance at 20 to 25 percent, Secure storage, databases, and networking at 25 to 30 percent, Secure compute at 20 to 25 percent, and Manage and monitor security posture at 20 to 25 percent. AI security objectives sit inside Secure compute alongside virtual machine and container security.

Are there prerequisites for SC-500?

Nothing is formally enforced. Microsoft’s audience profile expects practical experience administering Azure and hybrid environments across compute, network, and storage, strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration. It is not positioned as an entry level exam.

Which other Microsoft exams are retiring in 2026?

MS-900 retired March 31, DP-100 on June 1, AI-900 and AI-102 on June 30, AZ-204 on July 31, AZ-500 and PL-200 on August 31, and AZ-800 with AZ-801 on September 30, 2026. Most have named AI focused replacements, including AI-901, AI-103, AI-200, AI-300, AB-410, and SC-500.