Stop. Before you book anything, read this first sentence twice: Microsoft retired the AZ-500 exam on August 31, 2026, at 11:59 PM Central Standard Time. You can no longer sit it, you can no longer earn the Microsoft Certified: Azure Security Engineer Associate certification, and if you already hold that certification, you can no longer renew it. The study guide on Microsoft Learn carries the warning in plain text at the very top of the page, and every guide written since has had to start the same way this one does — with the date.
That is why this article is not a "how to pass AZ-500" guide. Plenty of those still exist online, some written before the retirement date and never updated, and following one now means preparing for an exam that no longer exists. What follows is the honest version: what retired, what happens if you already hold the certification, what replaced it, and how the study you may already have done can still pay off. The exam is gone. The skills are not.
What exactly retired on August 31, 2026
Microsoft retired three things at once, and the distinction matters. First, the exam itself: AZ-500, Microsoft Azure Security Technologies, can no longer be scheduled or taken. Second, the certification it earned — Microsoft Certified: Azure Security Engineer Associate — can no longer be earned by anyone. Third, and most painfully for existing holders, the renewal assessment retired on the same date. Microsoft's role-based certifications normally stay alive through a free online renewal assessment that opens six months before expiry; when AZ-500 retired, that renewal path went with it.
If you passed AZ-500 before the deadline, your certification is not erased overnight. It stays Active on your Microsoft Learn transcript until its one-year expiry date, then moves to Historical. What you lose is the ability to extend it: no final renewal window, no grace period, no conversion. Microsoft is not migrating holders across, there is no discounted upgrade, and holding AZ-500 gives you no equivalency claim. If you want a current credential, you sit the new exam.
Microsoft's own guidance to candidates who had not yet registered was direct: prepare for and take the new exam instead. That advice is now the only advice that makes sense, because there is no AZ-500 left to register for.
What replaced it: SC-500
The replacement is exam SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads, which earns the Microsoft Certified: Cloud and AI Security Engineer Associate certification. It reached general availability on July 21, 2026, about six weeks before AZ-500 closed, so the two overlapped briefly and the handover was deliberate rather than accidental.
The new ground is securing AI workloads: Purview data security posture management for AI, Copilot Studio agents, Foundry guardrails, agent identities through Entra Agent ID, and Security Copilot. The rename is the tell — Microsoft retired the exam not because Azure security stopped mattering, but because the job now includes securing AI systems and the old syllabus had no room for them.
SC-500 also replaced AZ-500 in the skilling requirements for Microsoft's Security Solutions Partner designation and Cloud Security specialization in July 2026, and pre-retirement AZ-500 certifications keep counting toward partner requirements for one year after retirement. If your employer is a Microsoft partner, that clock is already running.
What your AZ-500 knowledge is still worth
Here is the good news, and it is substantial: most of what AZ-500 tested is still the job. The final AZ-500 skills outline, dated January 22, 2026, divided the exam into four domains, and they map almost directly onto SC-500's core. Secure identity and access carried 15–20% and covered Microsoft Entra ID, Conditional Access, Privileged Identity Management, multi-factor authentication, managed identities, and app registrations. Secure networking carried 20–25% and covered network security groups, Azure Firewall, private endpoints and Private Link, VPN gateways, and web application firewalls. Secure compute, storage, and databases carried 20–25% and covered virtual machine hardening, Azure Bastion and just-in-time access, container and AKS security, storage access controls, and SQL encryption. The largest domain, securing Azure with Microsoft Defender for Cloud and Microsoft Sentinel, carried 30–35% and covered governance with Azure Policy, Key Vault, security posture management, threat protection, and Sentinel analytics rules and automation.
If you can already design a Conditional Access policy that blocks legacy authentication without locking out the service accounts, explain when a private endpoint beats a service endpoint, or write a Sentinel analytics rule and wire it to an automated response, you are not starting from zero. You are starting from the majority of the new exam. The gap is specific and learnable: AI workload security, Security Copilot, and a working familiarity with Microsoft 365 administration, which SC-500 expects in a way AZ-500 never did.
That gap is also the reason AZ-500 study material still has a use. The fastest way to find out how much of the old ground you actually own is to test yourself on it under exam-style conditions before you open the SC-500 syllabus — try the AZ-500 free practice test at https://study4pass.com/study-material/microsoft/az-500 and treat your score as a readiness check for the transition, not as preparation for an exam you can no longer take. Anything you miss in identity, networking, or Defender for Cloud is a gap you need to close anyway; anything you ace is a week of SC-500 study you do not need.
A four-week plan for moving from AZ-500 to SC-500
If you were mid-preparation when the retirement landed, do not throw your notes away and do not start over. Work in this order instead.
Week one is an audit. Run through the four AZ-500 domains above and grade yourself honestly on each. Spend your time on the weakest domain first, because SC-500's core is AZ-500's core and a shaky foundation in identity or networking will cost you more than any AI topic. Use practice questions to find the holes rather than re-reading chapters you already know.
Week two is the AI security block, and it is the genuinely new material. Learn what Purview DSPM for AI monitors, how Copilot Studio agents get their identities and permissions, what Foundry guardrails control, and where Entra Agent ID fits. Do this in the portal and in documentation, not just in theory, because the exam tests configuration decisions: which control stops a specific risk, not the definition of the control.
Week three is Security Copilot and Microsoft 365 administration. SC-500 expects you to know how Security Copilot assists incident response and where its limits are, and it assumes a baseline comfort with Microsoft 365 admin concepts that AZ-500 candidates could previously ignore.
Week four is exam simulation. Sit full timed practice sets, review every wrong answer until you can explain why the right answer is right and why your answer was wrong, and rehearse the scenario style SC-500 inherits from AZ-500: a described environment, a security requirement, and four plausible controls where only one fits the constraints.
The mistakes to avoid now
Three traps are catching people in this transition. The first is paying for AZ-500 preparation — courses, practice tests, or vouchers — without noticing the retirement date. Any seller still marketing AZ-500 as a live exam in late 2026 is either careless or dishonest; check the date before you check the price. The second is assuming your AZ-500 certification renews itself. It does not, and the renewal assessment is gone, so put the SC-500 date in your calendar before your current certification expires if you want continuous coverage. The third is the opposite error: assuming AZ-500 knowledge is obsolete and starting SC-500 from scratch. It is not obsolete. The identity, networking, and Defender for Cloud skills that made up most of AZ-500 are still the daily work of a cloud security engineer, and they are still tested.
One more thing worth saying plainly. AZ-500 had a good run — it was the standard proof of Azure security engineering skill since 2020 — and the engineers who earned it learned real skills that employers still need. Retirement is not a verdict on the people who hold it. It is Microsoft saying the job description changed. The right response is not to mourn the old code or to pretend it still exists. It is to carry the skills forward, close the AI gap, and sit the exam that certifies the job as it is now.
Bottom line
AZ-500 retired on August 31, 2026. You cannot take it, earn it, or renew it anymore. Its replacement, SC-500, went live on July 21, 2026, keeps most of the Azure security core, and adds AI workload security, Security Copilot, and Microsoft 365 administration. If you hold AZ-500, it stays valid until its expiry date and then lapses — so plan your SC-500 attempt before that date. And if you were studying for AZ-500, your time was not wasted: audit the four old domains, close the AI gap, and take the new exam with a head start most candidates will not have.
Top comments (0)