AZ-500 Exam Guide: Azure Security Skills and Lab Plan

Microsoft retired the AZ-500 exam on August 31, 2026. Per the official certification page, you can no longer earn or renew the Azure Security Engineer Associate certification after that date.

That changes how you should use this guide. Read it to understand the skills, the exam format and a study plan. Do not buy a voucher before you confirm it can still be used.

What AZ-500 proved and who it was for

The credential was Microsoft Certified: Azure Security Engineer Associate. Microsoft lists it as Intermediate level, for the Security Engineer role, on the Azure product.

The holder implements, manages and monitors security for resources in Azure, multi-cloud and hybrid environments. That work uses Microsoft Defender for Cloud and other tools. It also aligns the infrastructure with standards such as the Microsoft Cloud Security Benchmark (MCSB).

Microsoft names three core responsibilities:

• Managing the security posture.
• Implementing threat protection.
• Identifying and remediating vulnerabilities.

The exam suited people with practical experience in Azure and hybrid administration. Microsoft also expected strong familiarity with Microsoft Entra ID, plus compute, network and storage in Azure.

Skills measured and their weights

The official study guide lists the skills measured as of January 22, 2026. Defender for Cloud and Sentinel carried the most weight.

Some topics from the guide show what "secure identity and access" meant in practice:

• Azure built-in and custom role assignments, including Microsoft Entra roles.
• Microsoft Entra Privileged Identity Management settings and assignments.
• Multi-factor authentication and Conditional Access policies.
• App registrations, service principals and managed identities.

Networking covered Network Security Groups, Application Security Groups, user-defined routes, VPN connectivity, Private Endpoints, Azure Firewall, Application Gateway, Front Door and Web Application Firewall. Compute included Azure Bastion, just-in-time VM access and securing Azure Kubernetes Service.

Exam format, score and retakes

The exam was proctored. Microsoft says it may include interactive components. Here is what the sources state.

Microsoft also offered a free practice assessment and an exam sandbox. Use the study guide page for those links. For exam length and the exam experience, Microsoft points to its exam duration page.

Price, voucher terms and refunds

Microsoft's published list price was $165.00 USD (source: Microsoft official exam price, as published by the vendor). Our AZ-500 voucher is listed at $44.99. It is valid for 12 months and redeemed with Pearson VUE.

Because Microsoft retired the exam, ask our support whether the voucher can still be redeemed before you order. Our AZ-500 voucher page has the current listing.

Our store terms:

• The code is emailed within 12 hours of payment and shown in your account.
• You can cancel for a full refund before delivery.
• A delivered code is non-refundable. The exception is when the test provider rejects it as invalid, already used or expired on first use.
• In that case, contact support within 14 days with the order number and a screenshot. The code is replaced or refunded.

Full details are in the refund policy and delivery policy.

What to do now: a decision table

A 6-week plan to learn the same skills

Plan on 8–10 hours a week. You need an Azure subscription for hands-on practice. Use the study guide's skill list as your checklist.

1. Week 1: Identity. Practice role assignments, PIM, MFA and Conditional Access. Create an app registration and a managed identity.
2. Week 2: Virtual network security. Build NSGs, ASGs and user-defined routes. Set up peering and a VPN gateway.
3. Week 3: Private and public access. Create a Private Endpoint and an Azure Firewall policy. Put a WAF in front of a test app.
4. Week 4: Compute, storage and databases. Use Azure Bastion and just-in-time VM access. Review AKS network isolation. Then work through every storage and database item under "Secure compute, storage, and databases" in the study guide. Tick each one off after you configure it in your subscription.
5. Week 5: Defender for Cloud. This area carried the most weight. Work through recommendations, secure score and regulatory compliance views.
6. Week 6: Sentinel and review. Connect a data source, write a simple analytics rule and take Microsoft's free practice assessment. Redo your weakest area.

Worked example: block RDP from the internet

This tests NSGs, one of the most common networking skills. Create a deny rule, then check what applies to a VM.

az network nsg rule create --resource-group rg-sec --nsg-name nsg-web --name Deny-RDP-Internet --priority 100 --direction Inbound --access Deny --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 3389

az network nic list-effective-nsg --resource-group rg-sec --name nic-web01

Then open the VM through Azure Bastion instead. Note which rule won by priority. Lower numbers are evaluated first.

Common mistakes

• Reading without a lab. Portal screens and CLI output stay in memory far better than notes.
• Skipping Defender for Cloud. It carried 30–35% of the weight, so don't leave it until last.
• Confusing Azure roles with Microsoft Entra roles. The study guide lists both under custom roles.
• Mixing up Service Endpoints and Private Endpoints. Know what each does to traffic and DNS.
• Relying on third-party "dumps". They break exam rules and often teach outdated answers.

Related reading

If you are comparing Azure exams, see our AZ-204 guide on another retired exam. Browse more security credentials in our cybersecurity category.

Originally published at BuyExamVouchers.