Certifications
SC-500 study guide: Cloud and AI Security Engineer
Every skill area broken down, including the AI security objectives that no existing study material covers properly.
What this exam is
SC-500 replaces AZ-500 and validates the ability to design, implement and manage end-to-end security controls across Azure, hybrid and AI-enabled environments. It became generally available in July 2026, and AZ-500 retired on 31 August 2026.
Microsoft expects practical experience administering Azure and hybrid environments across compute, network and storage, strong familiarity with Entra ID, and working knowledge of Microsoft 365 administration. It is a 120-minute exam and the passing score is 700 out of 1000.
The four skill areas
Microsoft publishes these as weighted ranges. Midpoints shown.
- Storage, databases, networking28%
- Identity, access, governance23%
- Secure compute23%
- Posture and monitoring22%
Weightings are ranges rather than fixed values. Treat these as planning guidance, not a guarantee.
The AI security objectives, which are the new part
Purview DSPM for AI
Data Security Posture Management applied to Copilot: understanding which sensitive data Copilot can surface, and how oversharing in SharePoint becomes an AI problem rather than a permissions one.
Copilot Studio agent protection
Real-time protection applied to custom agents, and the controls that stop an agent becoming an unmonitored data path out of the tenant.
Entra Agent ID
Applying Conditional Access to agent identities. Agents authenticate, which means they are subject to identity governance like any other principal, and most people have not thought about this yet.
AI Gateway in API Management
Token limits, semantic caching and content safety policies applied at the gateway rather than in each application.
Defender for AI Service
Threat protection for AI workloads, plus Azure AI Foundry guardrails and evaluations.
Microsoft has not released a practice assessment yet
As of writing there is no official practice assessment for SC-500. Microsoft usually publishes these within about eight weeks of an exam going generally available. Until then, treat third-party question banks with more scepticism than usual: nobody has had time to build a good one.
A realistic study plan
If you already hold AZ-500 or work in Azure security daily, budget three to four weeks. The first three skill areas will be substantially familiar and your effort belongs almost entirely in the AI objectives, which are unlike anything on the previous exam.
If you are coming from Microsoft 365 rather than Azure, budget six to eight weeks and start with networking. The storage, databases and networking area is the largest single block, and it is where M365-native engineers consistently lose marks.
Study resources
What we would actually use. Microsoft Learn is free and comes first for a reason.
Microsoft Learn, the official skills-measured outline
- Best for
- Everyone, before anything paid. It is free and it is the source the exam is written from
- Watch out for
- It teaches the product, not the exam technique. Pair it with scenario practice
MeasureUp practice tests
- Best for
- Exam-realistic question style, as Microsoft's official practice partner
- Watch out for
- The most expensive option, and coverage for brand new exams lags behind release
Tutorials Dojo practice exams
- Best for
- Low cost, detailed answer explanations, good for a final readiness check
- Watch out for
- Stronger on AWS than Microsoft. Check the specific exam is covered before buying
Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.
The verdict
Worth taking, and worth taking early
It is the current credential for cloud security engineering, and the AI security scope is genuinely differentiating right now because almost nobody holds it yet. That advantage shrinks every month.
Skip it if you do not administer Azure. SC-200 or SC-300 is a better fit for security operations or identity specialists, and SC-500 assumes hands-on infrastructure experience you cannot fake in the case studies.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.