Microsoft’s security certification portfolio now covers far more than \u201cAzure security.\u201d Identity, security operations, information protection, cloud workload protection, architecture, compliance and AI security all have distinct places in the current credential map. That breadth is useful, but it also makes the portfolio easy to misread. A SOC analyst does not need the same certification as an identity administrator, and a cloud security engineer should not choose an exam designed around Microsoft Purview simply because both sit under the security banner.<\/p>\n
The most useful way to choose is by operational responsibility. The broader cybersecurity certification landscape<\/a> compares vendors and career paths, while Microsoft’s family goes deeper into the products and roles used across Entra, Defender, Sentinel, Purview, Azure and Microsoft 365. The current priority set in the ExamTopics plan includes SC-500, SC-300, SC-200, SC-401, SC-100, SC-900 and the retired AZ-500 transition.<\/p>\n One important 2026 change should be clear from the start: AZ-500 retired on August 31, 2026, and Microsoft has moved the cloud security engineer role to SC-500, the Cloud and AI Security Engineer Associate certification. Older AZ-500 material still has historical value, but new candidates should not plan a current certification path around a retired exam.<\/p>\n SC-900<\/a> validates foundational knowledge of security, compliance and identity across Microsoft services. It is appropriate for newcomers, students, business stakeholders and IT professionals who need a common vocabulary before moving into deeper operational work. Its scope includes Zero Trust, identity concepts, Microsoft Entra, Microsoft security services and Microsoft Purview.<\/p>\n That makes SC-900 valuable when a candidate is genuinely new to the ecosystem. It is much less valuable when an experienced security engineer takes it simply because it appears first numerically. A SOC analyst with hands-on Sentinel experience does not need to collect a fundamentals exam before pursuing SC-200. Likewise, an experienced identity engineer can move directly toward SC-300 if the job already involves authentication, Conditional Access, identity governance and privileged access.<\/p>\n The exam is scheduled for another English-language update later in October 2026, so candidates should confirm the current skills outline close to booking. The conceptual categories are stable, but Microsoft is increasingly incorporating topics such as agent identity, newer security services and evolving compliance capabilities into its foundation-level view.<\/p>\n For candidates who want an approachable narrative of the entry point, the existing SC-900 newcomer experience<\/a> can provide useful context. It should be treated as supporting editorial content, not a replacement for the current exam blueprint.<\/p>\n SC-300<\/a> maps to the Identity and Access Administrator Associate role. This is the right Microsoft security credential when your work is centered on Microsoft Entra, identity lifecycle, authentication, authorization, Conditional Access, identity governance and privileged access.<\/p>\n Identity is often described as the new security perimeter, but SC-300 makes that idea operational. Candidates need to understand how identities are created and governed, how access policies are enforced, how applications and resources use authentication, and how privileged access can be limited without making the environment unusable. The job combines security with administration and user experience because identity controls have to work for real people and applications.<\/p>\n SC-300 is a poor substitute for a network-security exam and an equally poor substitute for a SOC credential. It belongs to professionals who actually own access decisions. That includes identity engineers, Entra administrators, IAM specialists and security engineers whose daily work revolves around authentication and authorization.<\/p>\n The ExamTopics inventory includes useful concept-level material on Microsoft Entra Conditional Access<\/a> and role-based access control<\/a>. Those topics help explain the difference between learning identity as theory and operating it as a security control.<\/p>\n SC-200<\/a> maps to the Security Operations Analyst Associate role. It is built around the work of reducing risk through monitoring, triage, incident response, threat hunting and detection engineering across Microsoft Sentinel, Defender XDR and related security services.<\/p>\n This is the strongest Microsoft path for candidates who want to work inside a SOC or adjacent detection-and-response team. KQL matters because analysts need to investigate telemetry and hunt for patterns rather than only configure products. Automation matters because mature SOC teams cannot manually handle every repetitive action. Incident context matters because a collection of alerts is not the same thing as understanding an attack.<\/p>\n SC-200 therefore sits on the opposite side of the security lifecycle from some architecture credentials. An architect decides how capabilities should fit together; a security operations analyst uses those capabilities to detect and respond when something goes wrong. Both need security judgment, but their day-to-day outputs differ.<\/p>\n The current ExamTopics library already contains an SC-200 preparation<\/a>. Candidates should still verify the live blueprint because Microsoft has another English exam update scheduled for October 2026 and the operational role continues to absorb changes in Defender, Sentinel, AI agents and Copilot-assisted security work.<\/p>\n SC-401<\/a> maps to the Information Security Administrator Associate role. Its center of gravity is sensitive data: information protection, data loss prevention, retention, insider risk, security alerts and the controls used to protect data across Microsoft 365 and AI-enabled services.<\/p>\n This track is particularly relevant to administrators and security professionals who work with Microsoft Purview rather than spending most of their time on firewall rules, vulnerability management or SIEM detections. It requires collaboration with governance teams, workload owners and security stakeholders because information protection is both a technical and policy problem.<\/p>\n SC-401 can be confused with generic compliance certification because Purview is heavily involved. The actual role is more operational. Candidates have to translate policy into technical controls\u2014labels, DLP, retention, risk workflows and related protections\u2014then monitor whether those controls are functioning as intended.<\/p>\n The distinction from SC-300 is also important. SC-300 governs who or what can get access. SC-401 focuses more on what happens to sensitive information once people and systems are using Microsoft 365 and connected services. In mature environments, identity and information protection reinforce each other, but the two certifications still represent different owners.<\/p>\n SC-500 is Microsoft’s Cloud and AI Security Engineer Associate certification. It replaces the role previously associated with AZ-500 and expands the job beyond traditional Azure infrastructure security. The candidate is expected to implement end-to-end controls across identity, Key Vault, governance, storage, databases, networking, compute, AI workloads and security posture management.<\/p>\n The current ExamTopics inventory does not yet contain an approved SC-500 primary exam URL, so this article intentionally avoids inventing one. The certification still belongs centrally in the family because it is now the obvious route for security engineers responsible for Azure and hybrid workloads. Its AI-security emphasis also reflects a real change in the job: cloud security engineers increasingly have to protect model access, AI infrastructure, data paths and agentic workloads rather than treating AI as someone else’s concern.<\/p>\n For readers coming from older material, AZ-500<\/a> should be treated as a retired exam, not the current goal. The existing Azure network security principles<\/a> can still explain durable concepts, but certification planning should move to SC-500.<\/p>\n This transition is a good example of why certification pages need current-status context. The technical skills did not vanish on August 31. Network security, Key Vault, Defender for Cloud and access control remain relevant. What changed is the certification Microsoft uses to represent that engineering role.<\/p>\nSC-900 is the foundation, not a miniature security-engineer exam<\/h2>\n
SC-300 is the identity and access path<\/h2>\n
SC-200 is for detection, investigation and response<\/h2>\n
SC-401 covers information security and Microsoft Purview<\/h2>\n
SC-500 is the current cloud and AI security engineering route<\/h2>\n
SC-100 is for cybersecurity architecture<\/h2>\n