SC-500 validates that you can implement and operate end-to-end security controls across Azure, hybrid and multicloud estates — and, uniquely among Microsoft's security exams, across AI workloads and autonomous agents as well. It is a configuration-heavy engineering exam: most questions ask which control, at which scope, in which portal, with which role — not "what does this product do?".
How to use these notes
Start with Security Foundations to build the mental model — the Zero Trust pillars, the product map, the two RBAC systems and the scope hierarchy that every later answer depends on. Then work the four skill pages in outline order, keep the AI & agent security deep dive open once you reach Skill 3, and drill Exam tips & caveats in the final week. These notes are a companion, not a replacement: pair every section with hands-on time in the Azure portal, the Defender portal and the official Learn modules.
SC-500 is not AZ-500 with a new number
Roughly three quarters of SC-500 is recognisable Azure security engineering, and if you have studied AZ-500 that work carries over. The difference is the fourth quarter. Securing AI is a first-class sub-skill inside Skill 3, and it reaches into Skill 1 (Conditional Access for agent identities) and Skill 4 (the Data and AI security dashboard, Security Copilot). That material is new, it moves fast, and it is where most candidates are weakest — so it gets a page of its own on top of its coverage inside Skill 3.
The estate in one picture
Almost every SC-500 question lives somewhere on this diagram. If you can place a control on the right layer, you can usually eliminate two of the four answers before you finish reading them.
flowchart TB
ATT["Attacker — credential theft · lateral movement · data exfiltration · prompt injection"]
ATT --> L1
subgraph SEE["Scored and watched end to end — Defender for Cloud · Microsoft Sentinel · Security Copilot"]
subgraph GOV["Governed by one plane — Microsoft Entra ID · Azure RBAC · Azure Policy"]
direction TB
L1["Skill 1 · Identity and secrets — Conditional Access · PIM · managed identities · Key Vault"]
L2["Skill 2 · Data and network — storage and Azure SQL hardening · NSGs · Azure Firewall · Private Link"]
L3["Skill 3 · Compute and apps — disk encryption · Bastion and JIT · Arc · containers · App Service"]
L4["Skill 3 · AI workloads and agents — Foundry guardrails · Entra Agent ID · Purview DSPM · AI Gateway"]
L1 --> L2
L2 --> L3
L3 --> L4
end
endSkills measured at a glance
SC-500 is the most evenly weighted of Microsoft's security exams — every domain is worth between a fifth and a third of the marks. There is no domain you can safely skip, and the widest band, Skill 2, is only five points ahead of the others.
What the even weighting means for your schedule
On a lopsided exam you can trade a weak 10% domain for a strong 35% one. Here you cannot. Budget roughly equal time per skill, then add a block for AI security specifically — it is a slice of Skill 3 on paper, but it carries the newest and least-documented material, so it costs more hours per mark than anything else on the syllabus.
Suggested study order
flowchart TB F["Security Foundations — Zero Trust, the product map, the two RBAC systems"] --> S1 S1["Skill 1 · Manage identity, access and governance — 20–25%"] --> S2 S2["Skill 2 · Secure storage, databases and networking — 25–30%"] --> S3 S3["Skill 3 · Secure compute, including AI workloads — 20–25%"] --> S4 S4["Skill 4 · Manage and monitor security posture — 20–25%"] --> AI AI["AI and agent security deep dive — the cross-cutting material in one place"] --> T T["Exam tips and caveats — numbers, boundaries, traps, scenario lookup"]
Study pages
Security Foundations
The mental model everything else hangs off: the Zero Trust pillars, the Defender / Entra / Purview / Sentinel product map, the two RBAC systems, the management-group hierarchy and the renames that trip candidates up.
Start here →Skill 1 · 20–25%Manage identity, access, and governance
Entra ID hardening with PIM, Conditional Access, MFA and passwordless; app registrations, consent and managed identities; Key Vault deployment, access models and firewalls; and governance through Azure Policy, RBAC, locks, Backup and infrastructure as code.
Explore →Skill 2 · 25–30%Secure storage, databases, and networking
The heaviest domain: storage account hardening, SAS and access policies, Azure SQL platform security and auditing, Defender for Storage and Databases, and the full network stack — NSGs, Virtual Network Manager, Azure Firewall, Private Link, VPN and Entra Private Access.
Explore →Skill 3 · 20–25%Secure compute
Securing AI workloads and agents, servers and VMs — disk encryption, Bastion, JIT, Arc, Defender for Servers and trusted launch — plus the application platform: containers, AKS, ACR, Functions, Logic Apps, App Service, WAF and API Management.
Explore →Skill 4 · 20–25%Manage and monitor security posture
Defender CSPM, regulatory compliance and multicloud connectors; then Microsoft Sentinel end to end — workspaces, roles, content hub, data connectors, DCRs, custom tables, retention tiers, automation rules and playbooks — and Microsoft Security Copilot.
Explore →Deep dive · Cross-cuttingAI & agent security deep dive
The content that makes SC-500 more than a rebadged AZ-500, gathered in one place: oversharing and Purview DSPM for AI, Copilot Studio runtime protection, Entra Agent ID and blast radius, Foundry guardrails, Defender for AI Services and the AI Gateway in API Management.
Drill these →Final reviewExam tips & caveats
Key numbers, decision trees, the naming traps that cost marks, a scenario-to-answer lookup table and a pre-exam checklist for the night before.
Drill these →Before you book
Exam reality check
Expect multiple choice and multiple response, drag-and-drop ordering, "build list" sequencing, hotspot (dropdown) items, yes/no statement sets and possible case studies. The exam is proctored and may include interactive components. Most questions cover generally available features, though commonly used preview features can appear — and in the AI security space a great deal is still in preview, so know which side of the line each capability sits on. You can retake 24 hours after a first failed attempt.
There is no official practice assessment yet
At the time of writing, Microsoft's certification page states the practice assessment for SC-500 is not currently available, and that practice assessments generally appear within about eight weeks of an exam leaving beta. Until it lands, treat third-party question banks with real suspicion: most are recycled AZ-500 content and will teach you the wrong product names for the AI domain. Check the certification page again before you book.
Two habits that pay off more than extra reading
One: for every pair of neighbouring controls, be able to say in one sentence what one does that the other does not — service endpoint vs private endpoint, NSG vs security admin rule, Key Vault access policy vs Azure RBAC, Defender for Servers P1 vs P2, analytics tier vs data lake tier. The exam is built on those boundaries. Two: build one small estate end to end in a trial subscription — a VM behind Bastion with JIT, a storage account behind a private endpoint, Defender for Cloud on, and a Sentinel workspace collecting its logs. A single hands-on run teaches you the blades, role names and error messages that four chapters of reading will not.
Disclaimer
These notes are an independent study aid for learning purposes only and are not affiliated with or endorsed by Microsoft. Microsoft's security portfolio is renamed and re-scoped constantly, and the AI security surface in particular has changed several times since this exam launched — always verify every detail against the official Microsoft documentation linked throughout before relying on it.