AZ-500 Retired: Historical Blueprint and Next Steps

Historical AZ-500 Scope

AZ-500, Microsoft Azure Security Technologies, remains available only until 2026-08-31. Its published domains cover Secure identity and access, Secure networking, Secure compute, storage, and databases, Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel. The final AZ-500 outline is unusually useful as a boundary map between resource-level Azure hardening and broader security operations. It shows where identity, network paths, workload configuration, posture management, and incident signals must be reasoned about together. Microsoft has not announced a successor; check the official Azure Security Engineer certification page for updates. This page keeps the dated blueprint useful while separating verified lifecycle facts from recommendations.

Who AZ-500 Was For

The original audience was Azure security engineers who implement controls across identity, networking, compute, storage, databases, Defender for Cloud, and Sentinel. Current candidates should choose AZ-500 only when preparation, scheduling, and any credential requirements can be completed before 2026-08-31; otherwise monitor Microsoft's official certification pages for post-retirement guidance.

Skills You Should Be Ready to Demonstrate

• Trace effective access across Azure roles, Microsoft Entra controls, and privileged workflows
• Design network and private-access controls around real workload dependencies
• Harden compute, storage, databases, and secrets without breaking operability
• Turn Defender for Cloud posture findings and Sentinel signals into corrective action

How to Reuse Your Preparation

Build one representative Azure environment and trace a control from identity assignment through network isolation, workload protection, policy evaluation, Defender findings, and Sentinel response. Candidates with enough time to test before the cutoff can finish AZ-500; longer plans should wait for Microsoft to publish a successor path before committing. Start with the dated Microsoft guide, map each objective to a task, decision, observable result, and failure mode, and use domain ranges to balance coverage rather than predict question counts. Keep notes labeled with the guide date so future product or blueprint changes do not silently contaminate the plan.

Historical Domain Guide

Secure identity and access: Historical Scope

Domain 1, Secure identity and access, organizes related decisions rather than isolated product facts. The current outline includes Manage security controls for identity and access; Manage Azure built-in role assignments; Manage custom roles, including Azure roles and Microsoft Entra roles. Practice by connecting the configuration or recommendation to prerequisites, downstream effects, evidence of success, and a safe correction when the expected result is not observed.

• Turn every Secure identity and access objective into a concrete task or decision you can explain
• Record the prerequisite, implementation choice, verification signal, and failure mode
• Mix this domain with adjacent domains so dependencies remain visible

Secure networking: Historical Scope

Domain 2, Secure networking, organizes related decisions rather than isolated product facts. The current outline includes Plan and implement security for virtual networks; Plan and implement Network Security Groups (NSGs) and Application Security Groups (ASGs); Manage virtual networks by using Azure Virtual Network Manager. Practice by connecting the configuration or recommendation to prerequisites, downstream effects, evidence of success, and a safe correction when the expected result is not observed.

• Turn every Secure networking objective into a concrete task or decision you can explain
• Record the prerequisite, implementation choice, verification signal, and failure mode
• Mix this domain with adjacent domains so dependencies remain visible

Secure compute, storage, and databases: Historical Scope

Domain 3, Secure compute, storage, and databases, organizes related decisions rather than isolated product facts. The current outline includes Plan and implement advanced security for compute; Plan and implement remote access to virtual machines, including Azure Bastion and just-in-time (JIT) VM access; Configure network isolation for Azure Kubernetes Service (AKS). Practice by connecting the configuration or recommendation to prerequisites, downstream effects, evidence of success, and a safe correction when the expected result is not observed.

• Turn every Secure compute, storage, and databases objective into a concrete task or decision you can explain
• Record the prerequisite, implementation choice, verification signal, and failure mode
• Mix this domain with adjacent domains so dependencies remain visible

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel: Historical Scope

Domain 4, Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel, organizes related decisions rather than isolated product facts. The current outline includes Implement and manage enforcement of cloud governance policies; Create, assign, and interpret policies and initiatives in Azure Policy; Configure Azure Key Vault network settings. Practice by connecting the configuration or recommendation to prerequisites, downstream effects, evidence of success, and a safe correction when the expected result is not observed.

• Turn every Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel objective into a concrete task or decision you can explain
• Record the prerequisite, implementation choice, verification signal, and failure mode
• Mix this domain with adjacent domains so dependencies remain visible