SC-300 vs SC-500: Which Exam First?

The short version

Take SC-300 if your job is identity and access in Microsoft Entra. Take SC-500 if your job is securing Azure workloads end to end, with identity as one part. If you are new to Microsoft security, SC-300 is the narrower and usually the easier first step, and its identity skills carry over into SC-500. Take both if you own identity and also cloud security, preferably SC-300 first. Facts below were checked on Microsoft Learn on October 22, 2026, and the order advice is ours.

The two exams side by side

Item	SC-300	SC-500
Full name	Microsoft Identity and Access Administrator	Implementing End-to-End Security Controls for Cloud and AI Workloads
Credential	Identity and Access Administrator Associate	Cloud and AI Security Engineer Associate
Level	Intermediate	Intermediate
Audience	Identity and access administrators	Security engineers across cloud, hybrid, and AI workloads
Exam time	100 minutes	120 minutes
Passing score	700 of 1,000	700 of 1,000
Questions	Not published	Not published
Delivery	Proctored, Pearson VUE	Proctored, Pearson VUE
Languages	10	10
Domains	4	4
Renewal	12 months, free online assessment	Microsoft’s page lists no renewal field; see below
Free practice assessment	Listed on the page	Page says not currently available
Formal prerequisites	None listed	None listed

Microsoft’s general policy says associate credentials expire annually and renew through a free assessment. The SC-500 page we read does not show a renewal frequency the way the SC-300 page does, so check your Learn profile for the real date.

What each exam covers

SC-300 domains:

Implement and manage user identities (20-25%)
Implement authentication and access management (25-30%)
Plan and implement workload identities (20-25%)
Plan and automate identity governance (20-25%)

SC-500 domains:

Manage identity, access, and governance (20-25%)
Secure storage, databases, and networking (25-30%)
Secure compute (20-25%)
Manage and monitor security posture (20-25%)

Notice the shape. Every SC-300 domain is about identity, so you go deep. SC-500 has one identity-related domain and three that are not: storage and networking, compute (including AI security), and posture and monitoring.

Where they overlap

Microsoft lists several topics in both skills outlines:

Privileged Identity Management
Conditional Access
Authentication methods, including multifactor and passwordless
Enterprise applications and app registrations
Managed identities
Microsoft Entra Private Access

The depth differs. SC-300 asks you to plan, configure, and troubleshoot these in detail, including hybrid sync, external users, access reviews, and entitlement management. SC-500 treats them as part of a larger security picture, and tests them next to Key Vault, Azure Policy, and resource locks. So SC-300 study time is not wasted if you go on to SC-500.

What only SC-500 covers

Azure Key Vault, storage account security, and Azure SQL security.
Network security: network security groups, Azure Firewall, private endpoints, VPN, and Virtual WAN.
Compute: virtual machines, containers, Kubernetes, app services, and Defender plans.
AI security: Copilot and agent protection, Entra Agent ID, and AI Gateway.
Posture and monitoring with Microsoft Defender for Cloud, Microsoft Sentinel, and Security Copilot.

What only SC-300 covers

Hybrid identity: Microsoft Entra Connect Sync, Cloud Sync, and migration from AD FS.
External identities: cross-tenant access, cross-tenant synchronization, and external identity providers.
Application Proxy, and app control through Microsoft Defender for Cloud Apps.
Entitlement management, access reviews, and identity monitoring with logs and KQL.
Global Secure Access beyond Private Access.

How to choose

Ask three questions.

What do you manage today? Sign-ins, guests, sync, and apps point to SC-300. Firewalls, key vaults, and Defender plans point to SC-500.
What does your next role ask for? Read job descriptions and look for the words, not the exam codes.
How broad is your Azure experience? Microsoft’s SC-500 audience text names practical administration experience across Azure and hybrid compute, network, and storage, plus strong Microsoft Entra ID familiarity. SC-300 asks for familiarity with Azure, Microsoft 365, and Active Directory Domain Services, plus PowerShell and KQL. If your Azure experience is mostly identity, SC-300 matches you better.

A note on AZ-500

Microsoft’s page for the older Azure Security Engineer Associate says that certification, its exam, and its renewal assessments retired on August 31, 2026. SC-500 is a different exam with different domains, so do not reuse AZ-500 material without checking the SC-500 outline.

Suggested order

Identity specialist: SC-300 only, then SC-500 later if your role grows.
Azure admin moving into security: consider SC-300 first for identity depth, then SC-500. Or go straight to SC-500 if your daily work is networks and workloads.
Fundamentals first: if the basics are new, consider our SC-900 guide. Microsoft requires neither exam as a prerequisite.

More guides for SC-300

Next step

Read the SC-300 overview and the SC-500 overview to see the domains in detail. Then check the SC-300 prerequisites or Is SC-300 worth it? for more help. Our practice sets are here: SC-300 practice tests and SC-500 practice tests.

Frequently asked questions

Is SC-500 harder than SC-300?

It is broader and longer, so many people find it more demanding. Difficulty depends on your background, and Microsoft publishes no pass rates for either.

Does SC-300 count toward SC-500?

No. They are separate exams and separate credentials. Skills overlap, but passing one does not give you the other.

Can I take both in the same month?

Microsoft sets no rule against it. The sensible limit is your study time, since each needs hands-on practice.

Browse the practice exams