Microsoft Just Retired Its Flagship Security Exam for an AI One

October 8, 2026

Jillian, CMO— AI-assisted and reviewed prior to publication.

Microsoft is retiring AZ-500, its long-standing Azure Security Engineer exam, and replacing it with SC-500, a credential that bakes AI workload security into the core exam instead of treating it as an add-on. CompTIA is making similar changes to Security+ and SecurityX. The practical effect is that a certification you already hold may no longer test, or signal, what employers now assume it does.

Why Is Microsoft Retiring AZ-500 for SC-500?

Microsoft is not adding an AI module to AZ-500. It is replacing the exam outright. According to Microsoft's announcement of the new credential, the new Cloud and AI Security Engineer Associate certification validates the ability to design and implement end-to-end security controls across cloud environments using current, enterprise-ready security patterns, and requires passing Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads.

The official SC-500 study guide describes the role directly: you help ensure that platforms, data, identities, and infrastructure used by AI workloads are securely implemented, alongside the identity, network, application, data, and compute domains AZ-500 already covered. AI security is not a separate section bolted onto old material. It is threaded through the same domains a security engineer was already responsible for.

This is not an isolated change. Analysis of Microsoft's 2026 credential changes counts twelve role-based certifications retiring between June and September, which certificationcamps.com describes as the largest overhaul since Microsoft moved to role-based certifications in 2019. AZ-500 is one of four Azure certifications in that wave, each replaced by a credential with an AI-focused successor rather than a simple rename.

Is CompTIA Doing the Same Thing to Security+ and SecurityX?

Yes, and it is worth separating this from the launch of a standalone AI credential. CompTIA released SecAI+ as a new, dedicated AI security certification, but it is also rewriting the exams professionals already hold. CompTIA's own blog on closing the AI security skills gap frames the problem as a mismatch between AI-enabled threats and the ability of the existing workforce to secure AI systems and use AI safely in defense, which is exactly why the fix touches more than one exam.

SecurityX, the successor to CASP+, is the clearer example. Its objectives were consolidated from twenty-eight down to twenty-three, and the reduction was not simplification. As an independent review of the SecurityX objectives notes, AI and machine learning content was added, including AI threat modeling that had no real presence when CASP+ first launched. That is a foundational, vendor-neutral advanced security certification changing its center of gravity, not adding a chapter.

The pattern across both vendors is the same. AI security competency is moving from optional elective to required core content in the certifications security professionals were already expected to carry.

What Does This Mean If You Already Hold the Old Certification?

Your credential does not disappear and your resume line does not become false. But the skill signal behind it quietly shifts under you. Someone hiring for a security engineer role in 2027 who sees "AZ-500" on a resume is increasingly likely to wonder whether that certification predates the exam's AI workload content, since AZ-500 itself is scheduled for retirement rather than an in-place update.

This matters more than it might seem, because employers are already leaning on certifications as a trust shortcut in a crowded and uncertain hiring market. Fortinet's 2025 Global Cybersecurity Skills Gap report found that 89% of IT decision-makers prefer candidates with professional certifications, and that certifications function as a way to validate understanding of modern, AI-enabled security technologies specifically, not security in general. A certification whose content is known to predate that shift does less work for you in that screening moment, even if it is technically still valid.

There is also a demand-side reason this matters beyond resume optics. The ISC2 2025 Cybersecurity Workforce Study, cited in OffSec's analysis of the AI security skills gap, found that 59% of organizations report critical or significant skills gaps, up 15% from the prior year, and that 73% of cybersecurity professionals believe AI will create more specialized skills requirements going forward. Vendors are not restructuring exams speculatively. They are responding to a gap employers are already reporting.

Here is a simplified view of the wave affecting Microsoft's security track specifically:

Should You Wait for the New Exam or Certify Now?

If you are early in planning, target the new exam rather than the one being phased out. Sitting for an exam that is already scheduled for retirement means the certification you earn will read, within a year or two, as the older version even if you pass it next month. SC-500 is currently in beta, and CompTIA's SecurityX and Security+ updates are rolling out on their own timelines, so check the current objectives before you register rather than assuming the version you studied from last year still matches what ships.

If you already hold AZ-500, CASP+, or an older Security+ version, you are not starting over. The core domains, identity, network, data, cloud architecture, carry forward almost entirely. What you are adding is a specific, teachable layer: how AI workloads get provisioned, where model and data exposure actually happens, and how existing controls like access governance and posture management extend to cover them. That is a narrower gap to close than a full recertification, and it is the gap employers are actually asking about in interviews now, not a hypothetical one.

A practical way to approach it:

• Map which of your current certifications sit on a vendor's retirement or major-refresh list before renewing or letting a recert window pass unused.
• Prioritize the AI-inclusive successor exam over the outgoing one if you have not started studying yet, since the study time difference is usually small.
• Treat AI workload security as a normal extension of your existing specialty, whether that is identity, cloud infrastructure, or governance, rather than a separate track to bolt on later.

Forge University's Cloud and AI Security Engineer Associate prep is built directly against the current SC-500 objectives, so you are not reverse-engineering a beta exam from scattered forum notes. If you want to see how the domain weighting breaks down before you commit exam fees, the certification resources hub walks through it objective by objective. And if you want a study plan built around the current version of the exam rather than the one about to be retired, you can start training now while the material is still fresh.

None of this means every certification you hold needs replacing overnight. It means the shelf life of a security credential is shorter than it used to be, not because the underlying skills changed completely, but because the parts employers now expect as standard, AI workload exposure among them, moved from optional reading to tested material. Checking where your current certifications sit in that cycle takes less time than earning them did in the first place.

Start training free at Forge University