Microsoft AZ-500: Certification Guide for Azure Security Engineers
AZ-500 in perspective: transferable Azure security engineering skills Microsoft retired AZ-500 on August 31, 2026. This guide preserves a practical view of what its former security-technology objectives taught, not a registration pathway. Azure engineers still need to verify identity permissions, understand packet paths, protect data, investigate threats and recover from erroneous changes. The exercises that follow demonstrate both permitted and denied access, one traceable network path, usable incident evidence, and an actual recovery procedure.
On this page
Read the old certification as a historical skills map
The former assessment combined identity and access, platform protection, security operations and data/application safeguards. These remain useful categories of work, but the exact retired exam objectives, scores and appointment procedures do not represent a current Microsoft exam. Treat archived course descriptions as dated evidence, not a purchasing recommendation.
Begin by choosing the work you need to perform: protect a tenant, restrict access to an application, diagnose a network-policy failure or respond to a credible alert. Write a measurable outcome and identify the service owner before picking study modules.
SC-200 is an investigation-oriented credential. Compare its assessed work through the existing Microsoft SC-200 listing and current Microsoft study guide, rather than treating the retired AZ-500 as bookable.
Separate authentication from permission
A successful Microsoft Entra sign-in is not proof that an identity may read a secret or modify a resource group. Compare session controls, Azure RBAC management-plane roles and service-specific data-plane permissions. A safe test grants one narrow role, proves an allowed read and verifies a denied write in an isolated subscription.
When administrative access is required, examine eligible versus standing privilege, activation requirements and emergency recovery. Design a time-limited assignment and retain enough audit evidence to explain who received which access, at what scope and why. These boundaries matter regardless of exam branding.
Security architecture is a separate responsibility from day-to-day incident investigation. The Microsoft SC-100 pathway concerns architecture decisions; verify its current issuer objectives before choosing it.
Trace the actual network path
Azure virtual networks, NSGs, Azure Firewall and private endpoints control different layers of connectivity. Start with a named source and target, determine DNS resolution, inspect effective routes and confirm the first applicable network rules. A security rule may be correct while a missing route prevents the request from reaching it.
For a lab, allow one test connection and deny a second. Capture the observed client result and relevant flow evidence. Then introduce a safe configuration error, diagnose the resulting failure from the appropriate layer and restore the known-good configuration.
Protect compute, storage and secrets
A VM, container workload, managed app and storage account have different identities and exposure points. Examine how encryption keys are managed, which network paths are available and which principal may access the underlying data. Do not assume a portal success toast proves that a security control works.
Use a synthetic storage document and two test identities. Confirm that the approved identity can retrieve it, that an unauthorized principal cannot, and that logs can distinguish the two attempts. When using Defender for Cloud recommendations, validate the setting against the actual workload before remediation.
Investigate evidence, not just alert color
Cloud security operations need event source, affected resource, time, severity and an owner for the next action. Microsoft Sentinel, Defender for Cloud, Microsoft Entra and Azure Monitor may contribute different records; none alone proves an incident. Correlate the activity across systems before deciding whether a resource was exposed or compromised.
A useful tabletop exercise starts with an identity-risk alert and an unexpected storage request. Determine which logs would substantiate access, which changes require approval and how to retain relevant evidence. Document both the response and the remaining uncertainty.
Choose modern certification study by role
Current credentials must be selected from the issuer’s actual live skills guides. A candidate whose work is security investigation may compare an active SC-200 pathway; an engineer concerned with cloud and AI workload protection can consider the current Microsoft SC-500 assessment and then verify its officially published objectives. Do not map old AZ-500 domain percentages one-to-one onto either.
Practice tests for a retired exam may still identify a conceptual gap, but they cannot establish readiness for a new code. Use official dates, language options, relevant labs and updated service documentation before allocating a study budget.
Maintain a reproducible security skills portfolio
Keep a compact record of the goal, initial system state, change, evidence, denied case and rollback for every lab. Redact secrets and real customer details. A portfolio showing why a rule was created and how a mistake was recovered is more informative than a set of screenshots of successful clicks.
Skills persist when their evidence can be repeated as services evolve. Preserve the historic AZ-500 label for educational provenance, but express present work using current Microsoft product names, supported security controls and verifiable outcomes.