AZ-500, Microsoft Azure Security Technologies, retired on August 31, 2026. The exam described an important security engineering role: protecting identity, networks, compute, storage, applications and operational visibility across Azure. Microsoft now points candidates toward SC-500, Implementing End-to-End Security Controls for Cloud and AI Workloads. The newer program widens attention to modern workloads, so a candidate should not study the old AZ-500 topics under a replacement label without reviewing the current exam. The historical curriculum remains valuable to teams securing Azure deployments, provided its retirement is stated clearly and its technical lessons are separated from current certification instructions.

Identity controls must limit what compromise can achieve

A secure Azure estate begins with understanding human and workload identities. Authentication proves who is requesting access; authorization limits what they may do. Microsoft Entra ID, multifactor authentication, conditional access, privileged identity management and Azure RBAC address related but distinct parts of that chain. Giving an operator broad subscription ownership may solve a short-term deployment problem but expands the impact of a compromised account. Security design should reduce standing privilege and make elevated access time-bounded, justified and reviewable.

Suppose a contractor requires temporary access to troubleshoot a production service. The defensible approach is to grant the specific role at the narrowest practical scope and preserve evidence of who approved the elevation. Review session risks and deny unnecessary administrative paths. A managed identity for a workload should also receive only the permissions its function needs; it should not inherit the privileges of the developer who created it. Microsoft Entra administration supplies the resource-management background. The security engineer goes further by designing controls that contain credential theft and privilege misuse.

Protect network paths without confusing isolation and availability

Network security groups filter traffic under rule conditions, while Azure Firewall, application gateways, web application firewalls and DDoS protection address other layers and attack patterns. A private endpoint can help keep service access off public exposure, but DNS and routing must still direct clients correctly. Zero trust does not mean blocking every connection indiscriminately. The goal is to permit precisely required communication while making unexpected paths visible and difficult to exploit. Document which traffic must cross trust boundaries and why.

An internet-facing application might use a web application firewall at ingress, private connectivity for backend storage and separate controls for management access. If an engineer opens all outbound traffic to repair a failed connection, the configuration may function but violate the intended security model. Investigate DNS, routes, identities and allowed destinations before broadening access. Azure network security and visibility and the specialized AZ-700 network curriculum help explain how security controls interact with real traffic. A control is only effective when the application can still complete authorized work.

Secrets, keys and certificates need ownership and rotation

Azure Key Vault is commonly used for application secrets, encryption keys and certificates, but putting values in a vault is not the same as managing their lifecycle. Define access policies or RBAC assignments, rotation frequency, audit events and recovery procedures. Applications should use managed identities where possible, and private network controls should align with the intended client paths. Security reviews must distinguish a key protecting data from the permissions that allow someone to use or replace the key.

Imagine a business application whose TLS certificate is renewed successfully but whose service does not load the replacement. The failure may produce an outage rather than a direct compromise, yet it is still a security operations problem. Test certificate renewal end to end, including consumers and their deployment processes. For database or storage encryption, understand which recovery scenarios depend on the availability of a customer-managed key. Key Vault and secret protection remain relevant under SC-500 because application resilience and confidentiality both depend on credible key-management procedures.

Compute security includes the guest and the deployment pipeline

Virtual machines require operating system updates, endpoint protections, approved images and protected administrative access. Managed compute shifts some patching tasks to the cloud provider, but application vulnerabilities, identities and deployment configuration still belong to the customer. Container images introduce package and registry risks alongside runtime isolation. A security engineer should think about source provenance, build controls and workload identity rather than assuming a secure subnet makes arbitrary code safe.

Consider a function app that reads confidential documents. Even without an exposed VM, a poorly scoped managed identity could read far more than the application's purpose requires. Scan and review deployment artifacts, monitor for unusual access and block unauthorized configuration changes. Defender for Cloud can help surface posture concerns and workload threats, but remediation should be prioritized using exploitability and business impact. Simply eliminating every low-severity dashboard warning while ignoring one excessive permission is not a defensible security program.

Data protection has more dimensions than encryption

Storage and database controls involve encryption in transit and at rest, authentication, network reachability, backup, retention and sometimes fine-grained row or column access. Encrypting an entire database cannot prevent a fully privileged compromised application from reading its contents. Distinguish the threat model for an external network attacker from the threat model for an insider with access rights. Data classification should guide which records require additional access reviews, logging and deletion controls.

A medical analytics project may need aggregate statistics for researchers while raw patient records remain restricted. Architect the access path so analysts cannot read sensitive source rows merely by issuing an alternative query. Monitor data exports and authorization changes, and test recovery from accidental deletion. The retired AZ-500 material remains useful here because security engineers must understand the services being defended. SC-500 adds broader cloud and AI security scope, but the principle is unchanged: reduce unnecessary exposure at every step where data may move or be copied.

Threat detection must support investigation and response

Security telemetry should combine identity events, workload signals, cloud configuration changes and network activity. Microsoft Defender for Cloud can identify posture and protection gaps; other security tools may correlate activity into incidents requiring human response. Detection rules should be validated against realistic behavior, because high alert volume with little investigative context produces missed threats. Define ownership, escalation, containment and evidence preservation before an incident occurs.

Suppose a service principal begins reading unusually large amounts of storage data after a permission change. Investigation needs the identity, time window, affected resources and explanation of the approved business activity. Revoking access immediately may be appropriate, but it may also interrupt a critical process; response should be proportionate to impact and confidence. Analysts need repeatable queries and reliable time correlation. A SIEM alert without the permissions and operational context needed to act is only a signal, not a complete security control.

Understand the scope shift from AZ-500 to SC-500

Microsoft retired the Azure Security Engineer Associate path and introduced the Cloud and AI Security Engineer Associate direction through SC-500. It covers security controls across cloud and AI workloads, so overlap in Azure identity and network technology does not imply identical objectives. An AI application introduces model endpoints, retrieval sources, prompt injection risks, agent tools and potentially new data flows. The control must consider what an authorized model or agent can be induced to do, not just whether a server has an open port.

The shift from AZ-500 to SC-500 security responsibilities calls for fresh preparation: SC-500 is the current examination, with an expanded cloud and AI workload emphasis. A candidate should study the official active blueprint and validate the current credential rules. Historical AZ-500 exercises remain appropriate for infrastructure review and incident practice, but should not be described as a current route to a new Azure security certificate.

A mature handover also needs a clear map between the old and new exam terminology. The retired AZ-500 emphasized Azure-specific configuration choices; SC-500 organizes many of those security principles around an expanded cloud and AI environment. Keep an inventory of the controls that still matter operationally, such as privileged access, network segmentation, secret management, threat detection and secure release practices. Then identify genuinely new subject areas rather than claiming every old AZ-500 practice question tests the successor curriculum. For teams preserving earlier Azure security playbooks, review product names, policy behavior and monitoring integrations against current documentation. The goal is continuity of protection without freezing the organization into an obsolete certification map.

Use legacy skills to strengthen a modern security review

Choose a small Azure workload and draw its complete trust path: user sign-in, application identity, ingress, backend service, key access, monitoring and backup. For each boundary, identify the most damaging misuse and the control that would reveal or prevent it. Introduce an incident such as leaked service credentials, a mistaken public access rule or an unapproved privileged role assignment. Then test whether the resulting telemetry can support containment and recovery without excessive disruption.

This exercise demonstrates the lasting value of AZ-500 while respecting its status as a retired exam. The current SC-500 curriculum builds on a broader security environment. AZ-104 remains useful for administrators operating the controls, but it does not substitute for the dedicated security engineer's analysis of attacker paths and business impact. The right output is an actionable security design, with measurable access limits, reviewable changes and a tested response plan, not a list of products advertised as protection.