The short version
SC-500 is Microsoft’s intermediate security engineering exam for Azure, hybrid, and AI workloads. It tests whether you can implement and configure security controls, not just name them. Microsoft gives you 120 minutes, and you need a scaled score of 700 out of 1,000 to pass.
What the exam is
The full name is Implementing End-to-End Security Controls for Cloud and AI Workloads. Passing it earns the Microsoft Certified: Cloud and AI Security Engineer Associate credential, which Microsoft lists at intermediate level. The study guide on Microsoft Learn describes the candidate as a security engineer who protects systems and data across cloud and hybrid environments, and who also makes sure the platforms, data, identities, and infrastructure behind AI workloads are secured and monitored.
In practice, that means the exam asks you to pick the right control for a situation. You might be asked how to restrict a key vault, which Defender for Cloud plan covers a workload, how to collect firewall logs into Microsoft Sentinel, or how to control what an AI agent can access. Verbs like “implement,” “configure,” and “manage” run through the whole skills list.
This guide uses the study guide that Microsoft publishes on Microsoft Learn (the page shows a last-updated date of July 31, 2026, and we read it on October 18, 2026). Skills lists change, so check the live page before you book.
Who it is for
Microsoft’s audience description fits people who already work with Azure. It names practical experience in administering Azure and hybrid environments, including compute, network, and storage. It also asks for strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration. Typical readers are Azure administrators moving toward security, security engineers, and cloud engineers who now own security for their platform. The prerequisites page goes through what to know first.
Microsoft’s page for the older AZ-500 exam says that exam and its certification retired on August 31, 2026. If you studied for AZ-500, treat SC-500 as a different exam. Its domain names differ, and it includes a group of AI security skills that the AZ-500 page does not list.
Format at a glance
| Item | What Microsoft says |
|---|---|
| Exam code | SC-500 |
| Credential level | Intermediate |
| Time | 120 minutes |
| Passing score | 700 or higher on a scale of 1 to 1,000 |
| Delivery | Proctored, scheduled through Pearson VUE; may include interactive components |
| Languages | English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Italian, Portuguese (Brazil), Spanish |
| Number of questions | Not published for this exam; Microsoft says most exams have 40 to 60 |
The exam format page covers scoring, breaks, question styles, and retakes.
The four domains and their weightings
| Domain | Weighting |
|---|---|
| Manage identity, access, and governance | 20-25% |
| Secure storage, databases, and networking | 25-30% |
| Secure compute | 20-25% |
| Manage and monitor security posture | 20-25% |
Manage identity, access, and governance
Privileged Identity Management, Conditional Access, authentication methods, app registrations and enterprise applications, managed identities, Azure Key Vault, Azure Policy, role-based access control, resource locks, backup protection, and infrastructure as code.
Secure storage, databases, and networking
Storage account security and firewalls, Defender for Storage, Azure SQL security and auditing, Defender for Databases, network security groups, Virtual Network Manager, Virtual WAN, VPN, Entra Private Access, private endpoints, Private Link services, and Azure Firewall.
Secure compute
AI security (Copilot and agent protection, Entra Agent ID, AI Gateway, Defender for AI services), virtual machine protection (disk encryption, Bastion, just-in-time access, Defender for Servers, Azure Arc), and application platforms (containers, AKS, Functions, Logic Apps, App Service, Web Application Firewall, API Management).
Manage and monitor security posture
Defender for Cloud and Defender CSPM, multicloud connections, vulnerability management, Microsoft Sentinel data collection and automation, and Microsoft Security Copilot.
Official source
For Microsoft’s own wording, open the SC-500 study guide. It is the final authority if anything here differs.
More guides for SC-500
- SC-500 Study Plan: 4-Week and 8-Week
- SC-500 Sample Questions With Answers
- Is SC-500 Hard? An Honest Difficulty Check
- SC-500 Renewal and Retakes Explained
- Is SC-500 Worth It? An Honest Look
- SC-500 Cheat Sheet: Key Facts to Review
- SC-300 vs SC-500: Which Exam First?
Next step
Start with the domains explained page to see where your time should go. When you want to measure yourself, our SC-500 practice tests are original practice sets that cover all four domains.
Frequently asked questions
Does the SC-500 credential expire?
Microsoft says associate certifications are renewed each year. Renewal is free, and you take an unproctored, open-book online assessment during a six-month window before the expiry date. Passing extends the certification by one year.
Is there a Microsoft practice assessment?
Not at the moment. Microsoft’s exam page says the practice assessment for SC-500 is not currently available and usually appears within eight weeks of the exam being out of beta and generally available. Check the page for updates.
Can I take it in English only?
No. Microsoft lists ten languages. If the exam is not offered in your preferred language, Microsoft’s study guide says you can request an extra 30 minutes.