SC-900 or SC-500? Where to start with Microsoft security certifications

If you are moving into security in a Microsoft environment, two exam codes come up early: SC-900, the fundamentals exam, and a role-based exam for security engineers. Until recently that second exam was AZ-500. Microsoft retired AZ-500 and its certification on August 31, 2026, and the engineering path now runs through SC-500, which adds the security of AI workloads to the cloud security topics AZ-500 covered.

This guide explains what each exam covers, who each one is for, and an order that makes sense for someone starting out. Every detail below comes from Microsoft Learn as of October 2026; check the official pages before you book, because Microsoft updates exams regularly.

The two exams at a glance

SC-900: Microsoft Security, Compliance, and Identity Fundamentals

• Level: fundamentals. No experience required.
• What it proves: you understand the core concepts and know what each Microsoft security, compliance and identity product is for. It is about recognizing and describing, not configuring.
• Validity: fundamentals certifications do not expire.

SC-500: Microsoft Certified: Cloud and AI Security Engineer Associate

• Level: intermediate (associate).
• What it proves: you can implement and monitor security controls in Azure across identity, networking, storage, databases and compute, including the platforms and data used by AI workloads.
• Validity: like other role-based certifications, it must be renewed every year with a free online assessment on Microsoft Learn.

Both exams require a score of 700 or more to pass, and both are offered in several languages, including Portuguese (Brazil). The price depends on the country where you take the exam.

What SC-900 covers

The SC-900 study guide splits the exam into four areas:

• Concepts of security, compliance and identity (10–15%): the shared responsibility model, defense in depth, Zero Trust, encryption and hashing, and identity basics such as authentication, authorization and federation.
• Capabilities of Microsoft Entra (25–30%): identity types, authentication methods, Conditional Access, and identity governance and protection.
• Capabilities of Microsoft security solutions (35–40%): Azure infrastructure security services such as Azure Firewall and network security groups, Microsoft Defender for Cloud, Microsoft Sentinel as a SIEM, and threat protection with Microsoft Defender XDR.
• Capabilities of Microsoft compliance solutions (20–25%): Microsoft Purview, data classification and protection, and compliance management.

Microsoft updated the skills list on October 21, 2026, with minor changes in the Entra and Defender XDR areas. The study guide lists each change.

What SC-500 covers

The SC-500 study guide has four areas of similar weight:

• Manage identity, access and governance (20–25%): Microsoft Entra ID, Privileged Identity Management, Conditional Access, authentication methods, app registrations and OAuth consent settings, managed identities and Azure Key Vault.
• Secure storage, databases and networking (25–30%): storage account and Azure SQL security, Defender for Storage, and network controls around those services.
• Secure compute (20–25%): virtual machines and application platform services, plus a large new block on AI: Copilot and AI app risks in Microsoft Purview, agent identities in Microsoft Entra, and guardrails in Microsoft Foundry.
• Manage and monitor security posture (20–25%): Microsoft Defender for Cloud and its posture management, compliance against security frameworks, multicloud connections, and data collection in Microsoft Sentinel.

Where SC-900 asks what does this product do?, SC-500 asks how do you configure it, and what happens if you get it wrong? Expect scenario questions that assume you have worked in the Azure portal.

Which one should you take?

Take SC-900 first if you are new to security or to Microsoft's cloud. It is short to prepare for, it gives you the vocabulary every later exam assumes, and it shows a hiring manager that you have done the groundwork. It will not, on its own, prove you can do a security job.

Go to SC-500 if you already administer Azure or plan to work as a cloud security engineer. Without hands-on time in a subscription it will be hard: the exam expects practical knowledge of how Azure services are configured.

Consider SC-200 instead if your goal is a SOC analyst role. SC-200 focuses on detecting and investigating threats with Defender XDR and Sentinel, which is the daily work of an analyst. Our SC-200 study plan covers it in detail.

A path that works for many career changers:

1. SC-900

   Learn the concepts and the product map. A few weeks of the free Microsoft Learn training is usually enough.

2. SC-200 or SC-500

   Choose by the job you want: SC-200 for detection and response, SC-500 for building and securing cloud environments.

3. Practice in a lab

   Whichever you choose, spend time in a real tenant or subscription. Exams reward hands-on experience, and so do interviews.

If you were studying for AZ-500

The AZ-500 exam can no longer be taken, and the certification can no longer be earned or renewed. Your study time is not lost: identity, Key Vault, network security and Defender for Cloud are all still central to SC-500. What is new is the focus on protecting AI workloads, so review that part of the SC-500 study guide carefully.

Microsoft says that practice assessments are usually published within about eight weeks after an exam leaves beta and becomes generally available. When we checked in October 2026, the SC-500 practice assessment was not yet available, so plan to rely on the study guide and hands-on practice for now.

Why it matters for a SOC analyst

Even if you never take SC-500, its topics show up in investigations: a Conditional Access gap, an over-privileged managed identity or an exposed storage account is often where an incident begins. SC-900 gives you the map, SC-200 teaches you to investigate, and SC-500 teaches you how the environment should have been built. Knowing all three makes you better at explaining not only what happened, but why.