What is it?

What exactly is the Microsoft Certified: Azure Security Engineer Associate?

The Azure security engineer exam — retiring August 31, 2026, so sit it soon or target the SC-series successor.

Microsoft Certified: Azure Security Engineer Associate (AZ-500) validates the skills to implement security controls, maintain an organization's security posture, and identify and remediate vulnerabilities across Azure, multi-cloud, and hybrid environments. It is aimed at engineers who implement and manage security with Microsoft Defender for Cloud, Microsoft Sentinel, and Entra ID, and who align infrastructure to the Microsoft Cloud Security Benchmark. Candidates need practical Azure and hybrid administration experience plus strong familiarity with Entra ID, compute, network, and storage. Important: Microsoft has announced that AZ-500, its exam, and renewal assessments will retire on August 31, 2026; after that date you can no longer earn or renew the certification, though credentials already earned remain valid until their 12-month expiry. If your realistic test date is after retirement, plan for the active SC-series security successor instead.

The path in brief

1. Build Azure admin + security hands-on experience
2. Study the free AZ-500 Microsoft Learn paths
3. Schedule before the Aug 31 2026 retirement date
4. Pass with 700/1000 via Pearson VUE
5. If after retirement, target the SC-series successor

Before you book

Who is eligible to sit the Microsoft Certified: Azure Security Engineer Associate?

Open to all. Anyone may register and sit AZ-500 while it is still offered; after August 31, 2026 it is retired and cannot be scheduled.

Who it is for: Cloud security engineers, security architects, and Azure admins moving into security.

The test itself

What is the format of the Microsoft Certified: Azure Security Engineer Associate?

The Microsoft Certified: Azure Security Engineer Associate is administered by Pearson VUE and runs 100 minutes, contains 40–60 (includes hands-on lab tasks) questions and requires 700 / 1000 (scaled) to pass.

The fine print

What are the retake and renewal rules for the Microsoft Certified: Azure Security Engineer Associate?

Proctoring & delivery

Delivered by Pearson VUE. You can sit the exam at a Pearson VUE test center or take it online through OnVUE remote proctoring; the fee is the same for both. Online proctoring requires a quiet, private space, a working webcam, and a system check beforehand.

Retake policy

If you do not pass, you may retake the exam after 24 hours. A second failed attempt requires a 14-day waiting period, and any further attempts also require a 14-day wait between them, up to a maximum of five attempts in a 12-month period.

Score reporting

A pass/fail result is shown immediately after the exam. The official score report is emailed within about 24 hours and is also available in your Microsoft certification profile, with section-level feedback on how you performed.

Recertification

Microsoft role-based, specialty, and fundamentals certifications are valid for 12 months from the date earned. Renew at no cost by passing the shorter online renewal assessment on Microsoft Learn before the credential expires. Retired certifications cannot be renewed and must be re-earned through the active successor if one exists.

Refunds & rescheduling

Exam fees are generally non-refundable once a seat is purchased, but you can cancel or reschedule through Pearson VUE at no charge if you do so at least 24–48 hours before the appointment (exact window varies by region).

What it pays

How much does this credential pay?

$124,910 median for information security analysts, 29% projected growth (BLS, May 2024)

The occupation behind AZ-500 has the strongest outlook of any exam covered on this site, and that remains true even though the exam itself is being retired. Information Security Analysts (SOC 15-1212) reported a median of $124,910 in May 2024 and are projected to grow 29% between 2024 and 2034 — roughly six times the average across all occupations — with about 16,000 openings a year against a 2024 base of 182,800 jobs. Nothing about Microsoft reorganising its certification catalogue changes that demand curve. Two points of honesty belong here. The first is about the credential rather than the field. BLS notes that employers in this occupation may prefer candidates with professional certification, which is a rare thing for BLS to say and it is genuinely favourable to AZ-500's population — but the certifications that carry the most weight in hiring for senior security roles are still the vendor-neutral ones, and an Azure-specific credential is read as platform depth rather than as a security qualification in its own right. It pays best when it is stacked on top of something broader, or when the employer is specifically an Azure shop. The second point is about timing. Because the certification and its renewal assessment both retire on 31 August 2026, an AZ-500 earned in August 2026 will run for twelve months and then simply stop being renewable. That does not make it worthless — it is a dated, verifiable statement that you demonstrated these skills — but if your motivation is a credential to put on a CV for the next three years, the successor SC-500 is the better purchase of the same USD $165. If your motivation is that your employer's partner status or a contract clause requires the current credential now, AZ-500 still does that job for the next few weeks.

Job growth.29% projected growth 2024-2034 for information security analysts — much faster than average, with roughly 16,000 openings a year (BLS OOH)

Source: BLS Occupational Outlook Handbook — Information Security Analysts

Your schedule

How long should I study for it?

55-80 hours if you have Azure administration experience; substantially more if you do not, in which case sit SC-500 instead of focused study

Every other study plan on this site is a schedule. This one has to start as a decision, because the exam disappears on 31 August 2026 and a plan that ignores that is worse than no plan. Be blunt with yourself about which of three positions you are in. If you are starting from zero — no Azure administration background, no Defender for Cloud exposure — you are not going to be ready, and the honest advice is to stop reading this timetable and open the SC-500 study guide instead; there is no prize for failing an exam that then ceases to exist. If you have solid Azure administration experience and have already been studying, you can realistically make it, and the compressed plan below is the shape it should take. If you have been operating Azure security in production for a year or more, three focused weekends is a plausible run at it and your risk is unfamiliarity with exam format rather than with content. The official Microsoft Learn course for AZ-500 runs to roughly 23 hours of module content across four learning paths, which is content-consumption time only. The blueprint from 22 January 2026 is lopsided in a way that should drive your sequencing: Defender for Cloud and Sentinel together carry 30-35%, more than any other area and more than identity and access at 15-20%. Most candidates instinctively start with identity because it feels foundational, then run out of runway on the posture-management and SIEM material that is worth the most. Invert that. Start with Defender and Sentinel, and give them more time than feels proportionate.

1. Day 0 — the decision2-3 hrs

   Decide whether to sit AZ-500 at all, then book immediately if the answer is yes

   • Check the calendar honestly against the 31 August 2026, 11:59 PM CST cut-off and the retake intervals — 24 hours after a first failure, 14 days after a second
   • If you decide to go, book now and book early in the month so that one retake still fits inside the window
   • Take the free official Practice Assessment cold; if you are below roughly half on Defender for Cloud and Sentinel with no production exposure, seriously consider redirecting to SC-500
   • Confirm you have a subscription with Defender for Cloud enablement available and a Log Analytics workspace you can attach Sentinel to — you cannot learn either from documentation alone
2. Week 118-24 hrs

   Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (30-35%) — the heaviest area, deliberately first

   • Enable Defender for Cloud on a subscription, work through Secure Score, and understand how recommendations map to the Microsoft Cloud Security Benchmark
   • Turn on at least two Defender plans (servers and storage are cheap and instructive) and read what they actually alert on
   • Configure regulatory compliance standards in Defender for Cloud and generate a compliance report
   • Stand up Microsoft Sentinel on a Log Analytics workspace, connect two data connectors, and run analytics rules from a template
   • Write and read basic KQL — the exam expects you to interpret a hunting query and say what it returns, and to know which table holds which signal
   • Configure a workbook, an incident, and an automation rule with a playbook so the Sentinel vocabulary is concrete rather than abstract
3. Week 216-20 hrs

   Secure networking (20-25%)

   • Network security groups and application security groups: write rules, read effective rules, and understand priority evaluation cold
   • Azure Firewall and Firewall Manager, including DNAT, application rules versus network rules, and where a firewall sits in a hub-and-spoke topology
   • Private endpoints and Private Link versus service endpoints — this distinction appears on almost every form and candidates routinely conflate them
   • Web Application Firewall on Application Gateway and on Front Door, including managed rule sets and custom rules
   • DDoS Protection tiers, and securing VNet-to-VNet and hybrid connectivity
4. Week 316-20 hrs

   Secure compute, storage, and databases (20-25%)

   • Compute: Azure Bastion, just-in-time VM access, disk encryption options, secure boot and vTPM, and container security for ACR and AKS
   • Storage: shared access signatures and stored access policies, storage firewalls, encryption scopes, customer-managed keys, and immutable blob storage for compliance
   • Databases: Azure SQL authentication modes, Always Encrypted, Transparent Data Encryption with customer-managed keys, dynamic data masking, and SQL auditing
   • Key Vault as the spine of all of it: access policies versus Azure RBAC, soft delete and purge protection, key rotation, and managed HSM
   • Note the January 2026 change: the objective now reads "Plan and implement advanced security for compute" — read the current module rather than an older course
5. Week 416-20 hrs

   Secure identity and access (15-20%) + final consolidation

   • Microsoft Entra ID: users, groups, administrative units, external identities, and Entra Domain Services
   • Conditional Access as a design tool — build policies with named locations, device state and sign-in risk, and understand report-only mode
   • Privileged Identity Management: eligible versus active assignments, approval workflows, access reviews
   • Managed identities and application access — the January 2026 blueprint renamed this objective to "Manage Microsoft Entra application access and managed identities", so cover managed identities explicitly
   • Re-take the official Practice Assessment, compare with your Day 0 baseline, and spend every remaining hour on the weakest of the four areas
   • Rehearse the interface in the free sandbox at aka.ms/examdemo so no format costs you time

What to buy

Which study resources are worth paying for?

Buy nothing with a long payback period. With the exam retiring on 31 August 2026, a subscription you would need six months to exploit is a bad purchase, and any AZ-500 product still being sold on an annual licence should be weighed against the fact that the exam will not exist for most of that licence. The free official material plus a live subscription is the right core.

Prices checked 2026-08-04 and expressed as USD list prices before regional adjustment, sales, employer discounts or student pricing. Given the 31 August 2026 retirement, weigh licence length as heavily as price on anything AZ-500 specific. We take no commission from any provider listed and the ordering reflects our editorial judgement of usefulness, not any commercial relationship.

What you'll face

What question types will I see?

AZ-500 is an associate role-based exam and draws on Microsoft's full item library: multiple choice and multiple response, drag-and-drop and build-list, hot area, active screen, repeated-scenario yes/no sets, possible case studies, and on some forms a live lab. Microsoft does not publish a question count and it varies by form; published duration for associate role-based exams is 100 minutes without a lab and 120 minutes with one, with 120 or 140 minutes of seat time respectively, and you learn which applies when the exam launches. What distinguishes AZ-500 from its Azure siblings is not the format list but where the formats land. Hot-area items on this exam are frequently rendered blades from Defender for Cloud, Microsoft Sentinel, Key Vault or a network security group rule set, and they reward having genuinely used the product rather than having read about it — a Sentinel analytics rule configuration screen is not something you can reason your way through from first principles. Expect at least one item that puts a KQL query in front of you and asks what it returns or which table it should target. Expect the repeated-scenario yes/no format to be used for Conditional Access and NSG rule evaluation, where three plausible-sounding proposed solutions are judged independently and all three can be wrong. Because this is an associate role-based exam the Microsoft Learn panel is available — the learn.microsoft.com domain minus Q&A, practice assessments and your profile, split-screen, clock running, no extra time. Rehearse every format free at aka.ms/examdemo. Most items cover generally available features; preview features appear only where commonly used, which in a security context means you are not expected to track every Defender plan announced last quarter.

Samples are written by our editors to illustrate the published AZ-500 skills outline (skills measured as of 22 January 2026). They are not real exam items, are not drawn from any question bank, and no live Microsoft exam content is reproduced anywhere on this page. AZ-500 retires on 31 August 2026; the item formats carry over to Exam SC-500.

Reference

What are the key facts about the Microsoft Certified: Azure Security Engineer Associate?

Microsoft Certified: Azure Security Engineer Associate is a certification credential; awarded by Microsoft; the exam fee is $165 USD; typical preparation is 2–4 months of study; holders typically earn $110,000 – $155,000.

In short

Is the Microsoft Certified: Azure Security Engineer Associate worth it?

• AZ-500 is the Azure Security Engineer Associate exam covering identity, networking, compute/storage, and Defender for Cloud/Sentinel.
• The exam is 40–60 questions (with labs) in about 100 minutes; the passing scaled score is 700/1000.
• Microsoft's published weights are identity 15–20%, networking 20–25%, compute/storage 20–25%, and Defender/Sentinel 30–35%.
• AZ-500 retires on August 31, 2026 — sit it before then or plan for the active SC-series successor.

Trust

Where does this information come from?

Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.

• Microsoft Awarding body
• Official Microsoft Certified: Azure Security Engineer Associate exam page Exam page
• Microsoft certification programme Programme rules

Research confidence: high · Last reviewed 2026-08