AZ-500 is gone and SC-500 is what Microsoft replaced it with. If you work in a Microsoft security stack, it's worth taking. If you don't, it won't turn you into a security engineer on its own, and it was never going to.
What actually happened
Microsoft retired AZ-500, the Azure Security Engineer Associate exam, on 31 August 2026. If you already held it, it stays on your transcript. If you were halfway through preparing for it, that preparation isn't wasted, but the exam itself is no longer bookable.
The replacement is SC-500, which earns you the Cloud and AI Security Engineer Associate. The name change is honest about what changed. AZ-500 was Azure security. SC-500 is security controls across cloud and hybrid environments, with AI workloads now explicitly in scope. Microsoft's own syllabus covers identity, networking, applications, data, compute, securing AI solutions and managing security posture, built around Defender and the broader Microsoft security stack.
Who it's worth it for
You, if your day job touches Microsoft security tooling. If you're a security engineer, a cloud engineer with security duties, or an admin who's become the de facto security person, SC-500 structures what you already do and fills the gaps you're quietly aware of. The AI workload content is the part most people's jobs haven't caught up with yet, and it's the part employers will start asking about first.
It's also a reasonable target if you were aiming at AZ-500 and got caught by the retirement. The audience profile is the same person: a security engineer protecting cloud and hybrid environments. You're not starting over. You're sitting the current version of the exam you were already working towards.
Where it breaks
Three places, and I've seen all three.
First, treating it as an entry route. SC-500 is pitched at people already doing the work. If you're trying to break into security from support or from another career, this isn't your first cert. It assumes you can already find your way around Azure, identity and Defender. Without that, you'll memorise your way to a pass and be unable to answer the obvious follow-up question in an interview.
Second, collecting it as a badge next to four others. One current, relevant cert that matches your job is worth more than a stack of them. I've written about where that habit leads in cert stacking.
Third, assuming it feeds the expert level. It doesn't, yet. The Cybersecurity Architect Expert (SC-100) prerequisites still list the older associate certs, and Microsoft hasn't published a date for adding SC-500. If your plan is SC-100, check the current prerequisite list on Microsoft's site before you book anything, not a blog post about it. Including this one.
So is it worth it?
For a Microsoft-shop security engineer in 2026, yes. It's the current version of the cert your job description probably already names, and the AI content is genuinely useful rather than decorative. For everyone else, it's a tool-specific exam, and it should be weighed like one: does your environment run this stack, and will the person hiring you care that you can secure it?
If the answer to both is yes, book it. If you're not sure what your next role actually needs, that's the question to settle first, and no exam will answer it for you.