Domain 1: Manage identity, access, and governance
- Use Microsoft Entra Privileged Identity Management (PIM) to make privileged roles eligible rather than permanently assigned, requiring just-in-time activation with approval, justification, and time limits to reduce standing access.
- Enforce access with Conditional Access policies that combine signals (user, device compliance, location, risk) with grant controls such as requiring multifactor authentication or a compliant device.
- Prefer phishing-resistant, passwordless authentication (FIDO2 security keys, Windows Hello, passkeys) and manage methods through the authentication methods policy.
- Secure application identities: register apps, manage service principals, and control OAuth permission grants and consent settings so users cannot consent to risky third-party apps.
- Use managed identities (system-assigned or user-assigned) so Azure resources authenticate to services like Key Vault without stored credentials.
- Protect secrets, keys, and certificates in Azure Key Vault with the RBAC access model, firewall/private endpoint network restrictions, soft-delete and purge protection, and scan for exposed secrets using Defender CSPM.
- Enforce governance with Azure Policy: built-in and custom definitions and initiatives, and effects such as deny, audit, and deployIfNotExists to prevent or remediate noncompliant resources.
- Evaluate regulatory compliance and apply security standards (Microsoft Cloud Security Benchmark and regulatory frameworks) in Microsoft Defender for Cloud, tracking secure score.
- Apply least privilege with Azure RBAC: use built-in roles where possible, create custom roles with specific Actions/NotActions, scope assignments narrowly, and remediate overprivileged access.
- Protect backups from ransomware with Azure Backup security features - soft delete, immutable vaults, and multi-user authorization (Resource Guard) - and use resource locks to prevent accidental deletion.
Domain 2: Secure storage, databases, and networking
- Harden storage accounts: require secure transfer (HTTPS) and a minimum TLS version, disable public blob access, disable shared-key authorization in favor of Microsoft Entra, and restrict access with storage firewall rules and private endpoints.
- Control storage data access with shared access signatures (SAS) bound to stored access policies, or Entra-based RBAC data roles, and rotate keys; enable Microsoft Defender for Storage for malware scanning and sensitive-data threat detection.
- Secure Azure SQL Database and SQL Managed Instance with Transparent Data Encryption (service- or customer-managed keys), Microsoft Entra authentication, Always Encrypted, dynamic data masking, firewall rules, and private endpoints.
- Enable auditing for Azure SQL (to Log Analytics, storage, or Event Hubs) and turn on Microsoft Defender for Databases for threat alerts and vulnerability assessment across SQL, open-source databases, and Cosmos DB.
- Control east-west and inbound traffic with network security groups and application security groups, using priorities and service tags; use Azure Virtual Network Manager for centralized security admin rules that override NSGs.
- Secure connectivity to platform (PaaS) services with private endpoints and Azure Private Link, and disable public network access so traffic stays on the virtual network.
- Deploy Azure Firewall (with Firewall Policy, threat-intelligence-based filtering, and IDPS) for centralized network filtering, and know when to use Azure Firewall versus an NSG versus a Web Application Firewall.
- Secure remote and hybrid connectivity with site-to-site and point-to-site VPNs (certificate or Entra authentication) and Microsoft Entra Private Access for zero-trust access to private apps.
- Protect internet-facing workloads with Azure DDoS Protection and diagnose connectivity and effective security rules with Azure Network Watcher.
- Secure a Virtual WAN with a secured virtual hub and routing intent so branch and virtual-network traffic is inspected by an integrated firewall.
Domain 3: Secure compute, including AI
- Identify data overexposure in SharePoint and assess risks that AI surfaces (for example Microsoft 365 Copilot referencing oversharing) using Microsoft Purview Data Security Posture Management (DSPM) for AI.
- Protect Microsoft Copilot Studio agents with real-time protections and content moderation, and manage AI agents from the Microsoft 365 admin center.
- Govern non-human AI identities with Microsoft Entra Agent ID: apply Conditional Access to agents, manage their access, and analyze an agent's blast radius using Microsoft Defender XDR.
- Secure model and agent workloads with an AI Gateway in Azure API Management for Microsoft Foundry, guardrails for agent security in Foundry, and Microsoft Defender for AI Service in Defender for Cloud, monitored via the Data and AI security dashboard.
- Protect servers and VMs with disk encryption, Azure Bastion for portal-based RDP/SSH without public IPs, and just-in-time VM access to open management ports only when needed.
- Onboard servers (including hybrid and multicloud via Azure Arc) to Microsoft Defender for Servers for endpoint detection and response, vulnerability scanning, agentless scanning, and file integrity monitoring.
- Use trusted launch VM features - secure boot, virtual TPM, and integrity monitoring - and enforce configuration with Azure Machine Configuration.
- Secure containers with Microsoft Defender for Containers for misconfiguration and runtime threat detection, and apply AKS, Azure Container Registry, and Container Apps security controls.
- Secure serverless and web workloads: restrict Azure Functions and App Service with authentication and network access rules, and protect web apps with Azure Web Application Firewall on Front Door or Application Gateway.
- Protect back-end APIs behind Azure API Management using subscription keys, validation policies, and JWT/OAuth token validation.
Domain 4: Manage and monitor security posture
- Use Defender Cloud Security Posture Management (Defender CSPM) to find risks with attack path analysis and the cloud security explorer, and track improvement with secure score and governance rules.
- Evaluate compliance against frameworks and enable the right Microsoft Defender for Cloud workload protection plan for each resource type (servers, storage, databases, containers, key vault, and AI).
- Connect AWS and GCP accounts to Defender for Cloud with cloud connectors to get multicloud posture and threat protection in one place.
- Discover internet-facing and unmanaged assets with Microsoft Defender External Attack Surface Management (EASM), and manage VM vulnerabilities with Microsoft Defender Vulnerability Management.
- Onboard Microsoft Sentinel by connecting a Log Analytics workspace, assign Sentinel roles (Reader, Responder, Contributor), and install content hub solutions for connectors and rules.
- Ingest data into Sentinel with Microsoft data connectors, syslog and CEF via the Azure Monitor Agent, and Windows Security events using data collection rules and Windows Event Forwarding.
- Automate response in Sentinel with automation rules and playbooks (Logic Apps) for SOAR, and manage cost and compliance with the right data retention and archive tiers (analytics, basic, and auxiliary logs).
- Create custom log tables and use KQL to hunt across data, and query Microsoft Purview Audit in Microsoft Defender XDR for investigations.
- Configure Microsoft Security Copilot: set up workspaces, assign permissions and roles, enable plugins, and add Microsoft and Security Store agents to accelerate investigation and response.
- Treat posture management as continuous: alert on drift, failed protections, and new recommendations so the environment stays compliant, not just configured once.
SC-500 exam tips
- SC-500 is AZ-500 plus AI security. If you know AZ-500, focus your new study on domain 3's AI topics - Microsoft Purview DSPM for AI, Copilot Studio agent protection, Microsoft Entra Agent ID and its blast-radius analysis in Defender XDR, AI Gateway in API Management for Foundry, Defender for AI Service, and the Data and AI security dashboard.
- Learn the Microsoft security product map cold and which tool owns which job: Defender for Cloud (posture, workload protection, multicloud, EASM), Microsoft Sentinel (SIEM/SOAR - connectors, DCRs, playbooks, retention), Microsoft Purview (data governance and DSPM), Microsoft Entra (identity, PIM, Conditional Access), and Security Copilot (AI-assisted investigation).
- For identity, default to least privilege and just-in-time: PIM eligible roles over standing assignments, Conditional Access with MFA and device compliance, managed identities over stored secrets, and Key Vault with RBAC plus private endpoints.
- For networking, distinguish the layers precisely: NSG/ASG for subnet/NIC filtering, Azure Firewall for centralized L3-L7 filtering and IDPS, Web Application Firewall for L7 web protection, and Private Link/private endpoints to keep PaaS traffic off the public internet.
- Use current Microsoft names on the exam - Microsoft Entra ID (not Azure AD), Microsoft Defender for Cloud, Defender CSPM, Microsoft Sentinel, Microsoft Purview, Microsoft Security Copilot, and Microsoft Foundry - and note that most questions cover generally available features.
Study guide FAQ
What is the format of the SC-500 exam?
SC-500 is a 120-minute exam with roughly 40-60 questions (multiple choice and multiple response, plus Microsoft's interactive item types). Passing is a scaled score of 700 out of 1000, and results are reported by skill area. Microsoft does not publish an exact question count.
How is SC-500 different from AZ-500?
SC-500 (Cloud and AI Security Engineer Associate) is the successor to AZ-500 (Azure Security Engineer Associate), which retires on August 31, 2026. It keeps the core Azure security content - identity, storage/database/network, compute, and posture - and adds a significant focus on securing AI workloads (Microsoft Purview DSPM for AI, Copilot Studio agents, Microsoft Entra Agent ID, Defender for AI, and Microsoft Foundry guardrails).
Should I take AZ-500 or SC-500?
Take SC-500. AZ-500 is retiring on August 31, 2026, so new candidates should target its replacement. If you already hold AZ-500, SC-500 is the natural refresh, and your main new study area is the AI-security content in the secure-compute domain.
What experience does SC-500 assume?
It assumes hands-on experience administering Azure and hybrid environments (compute, network, and storage), strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration. It is an intermediate, associate-level engineer certification rather than an entry-level one.
Is CertGrid's SC-500 practice official Microsoft material?
No. CertGrid is an independent practice platform and is not affiliated with or endorsed by Microsoft. These questions are original and written to mirror the official SC-500 skills outline and difficulty so you can rehearse the objectives and find gaps. Always confirm the current skills measured on the official Microsoft Learn exam page before test day.