SC-500 Exam Guide 2026: Cloud and AI Security Skills

This SC-500 exam guide explains what Microsoft measures in its cloud and AI security exam. According to Microsoft Learn, the study guide was last updated on 13 May 2026.

The exam asks you to implement security controls, not just name them. This guide covers the skill areas, who the exam suits and a four-week plan.

What is the SC-500 exam?

SC-500 is Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads. According to Microsoft Learn, it leads to the Microsoft Certified: Cloud and AI Security Engineer Associate certification.

A security engineer, in Microsoft’s description, protects systems and data across cloud and hybrid environments by implementing controls that help prevent unauthorized access. The role spans identity, network, application, data and compute.

It also includes AI. Microsoft says the engineer helps ensure that the platforms, data, identities and infrastructure used by AI workloads are securely implemented and monitored.

What skills does SC-500 measure?

The exam measures four skill areas, and storage, databases and networking is the heaviest at 25-30%. The study guide publishes these ranges.

Skill area	Weight
Manage identity, access, and governance	20-25%
Secure storage, databases, and networking	25-30%
Secure compute	20-25%
Manage and monitor security posture	20-25%

What is in the identity and governance area?

This area covers Microsoft Entra ID, Azure Key Vault and governance. The study guide lists Privileged Identity Management, Conditional Access, multifactor authentication, passwordless sign-in and managed identities.

Privileged Identity Management gives users time-limited, approval-based access to privileged roles. Governance topics include Azure Policy, resource locks, role assignments, custom roles and infrastructure as code.

What is in the storage, databases and networking area?

This area covers storage account security, database auditing and Azure network services. Named topics include storage firewall rules, Defender for Storage and Azure SQL auditing.

Networking is broad: network security groups, application security groups, Azure Virtual Network Manager, Virtual WAN, VPN, Microsoft Entra Private Access, private endpoints, Private Link and Azure Firewall.

What is in the secure compute area?

This area now includes AI security. According to the study guide, you should be able to identify overexposure of data in SharePoint and use Microsoft Purview Data Security Posture Management to find risks related to Copilot and AI apps.

It also lists Microsoft Entra Agent ID, the AI Gateway in Azure API Management for Microsoft Foundry, Defender for AI Services and guardrails for agent security in Foundry. Server, virtual machine, container and app platform security sit in the same area.

What is in the security posture area?

This area covers Defender for Cloud, Microsoft Sentinel and Security Copilot. Defender Cloud Security Posture Management finds risks and evaluates compliance, and the guide includes connecting AWS and GCP environments.

For Sentinel, expect workspaces, roles, data connectors, automation rules, playbooks and retention. Security Copilot topics include workspaces, permissions, plugins and agents.

Who is SC-500 for, and who is it not for?

SC-500 suits people who already administer Azure and want to specialise in security. Microsoft asks for practical experience with Azure and hybrid environments, strong Microsoft Entra ID familiarity and familiarity with Microsoft 365 administration.

It is a good fit for:

• cloud administrators who are taking on security responsibilities;
• security engineers who need to cover AI workloads and Copilot-related risks;
• security operations staff who want deeper Sentinel and Defender for Cloud configuration skills.

It is a weaker fit for:

• beginners with no Azure administration experience, who may prefer to start with a Fundamentals exam;
• developers who focus on application code, who may prefer the AI-200 exam changes.

How should you use this SC-500 exam guide? A 4-week plan

Plan around the weights and spend the most lab time on networking and compute. This plan assumes about six hours a week.

1. Week 1: identity and governance. Configure Privileged Identity Management, a Conditional Access policy, a managed identity and a Key Vault with access rules. Assign a built-in and a custom role.
2. Week 2: storage, databases and networking. Lock down a storage account with a firewall and a private endpoint. Enable auditing on an Azure SQL database and write network security group rules.
3. Week 3: secure compute and AI. Enable Defender for Servers on a test machine, use just-in-time access, and review the AI security topics in the study guide one by one.
4. Week 4: posture and timed practice. Connect a Sentinel data connector and read the Defender for Cloud recommendations. Then sit full timed practice tests and review every miss by skill area.

Mixed, spaced review works better than rereading, as our post on studying smarter explains.

Is there a practice assessment for SC-500?

Not at the time of writing. Microsoft’s certification page says the practice assessment is not currently available, and that these assessments usually appear within 8 weeks of an exam leaving beta.

That makes independent practice more important. Use the exam sandbox to learn the interface, and build the controls yourself in a test subscription.

How is SC-500 delivered?

The exam is proctored through Pearson VUE, and you have 120 minutes. Microsoft says it may include interactive components.

Price depends on the country or region where the exam is proctored. If you fail, Microsoft says you can retake it 24 hours after a failed attempt, and later waits vary.

Is SC-500 hard?

It is broad rather than deep in any single product. The same exam asks about identity, networks, virtual machines, containers, Sentinel and AI security, so gaps show quickly.

Microsoft also notes that most questions cover generally available features, though preview features can appear if they are commonly used. Read the skills list line by line and tick off each item you have done hands-on.

How do you know you are ready to book?

You are ready when you can take each line of the skills list and explain which control you would choose and why. Check the exam page first for the current practice assessment status.

Then sit at least two full timed SC-500 practice tests and look at your score by skill area. If one area trails, spend another week in the portal before you book.

Before you schedule, recheck the SC-500 study guide for any skills update.

Related reading

• AI-103 replaces AI-102: what changed for Azure AI engineers
• AI-200 replaces AZ-204: what changed for Azure developers
• What 8,600 practice questions reveal about exams
• All CertCrafter articles