- Implement and configure Privileged Identity Management (PIM).
- Implement conditional access policies.
- Implement authentication methods, including MFA and passwordless.
- Implement identity for applications, manage OAuth consent, and configure managed identities for Azure resources.
Microsoft Cloud and AI Security Engineer Associate (SC-500)
Microsoft Cloud and AI Security Engineer Certification Training Course SC-500
Prepare for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, the associate credential that replaces AZ-500. Accumentum maps the course to Microsoft’s published skills measured.
Course focus: Entra ID, Key Vault, governance, storage, databases, networking, AI workload security (Purview DSPM, Entra Agent ID, Foundry guardrails), compute, Defender for Cloud, Sentinel, and Security Copilot.
Course Overview
Implement end-to-end security controls for cloud and AI workloads, not AZ-500-only Azure security.
Accumentum’s Microsoft Cloud and AI Security Engineer Certification Training Course (SC-500) prepares security engineers for Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, which leads to Microsoft Certified: Cloud and AI Security Engineer Associate. Exam SC-500 replaces AZ-500. Microsoft has stated that AZ-500 reaches end of life on 31 August 2026. Confirm current retirement details on Microsoft Learn.
Microsoft’s audience is a security engineer who protects organizational systems and data across cloud and hybrid environments and helps ensure that platforms, data, identities, and infrastructure used by AI workloads are securely implemented and monitored. Microsoft expects practical experience administering Azure and hybrid environments, strong familiarity with Microsoft Entra ID, and familiarity with Microsoft 365 administration.
This page uses Microsoft’s published skills measured. Accumentum does not invent exam prices or unofficial question counts.
Course Objectives
What you will be able to secure, implement, and monitor.
01
Identity, secrets, and governance
Secure access with Microsoft Entra ID, protect secrets with Azure Key Vault, and enforce security and regulatory compliance.
02
Storage, databases, and networking
Implement security for storage accounts, Azure SQL and database services, and Azure network services including Firewall, Private Link, and Entra Private Access.
03
Secure compute including AI
Secure AI workloads with Purview DSPM, Entra Agent ID, Foundry guardrails, and Defender for AI, plus servers, VMs, and application platform services.
04
Posture, Sentinel, and Security Copilot
Manage posture with Defender for Cloud, collect activity in Microsoft Sentinel, and implement Microsoft Security Copilot.
Who Should Attend
- Security engineers who implement end-to-end security controls across cloud, hybrid, and AI workloads.
- Azure security professionals moving from AZ-500 to SC-500, including AI security topics that were not on AZ-500.
- People who work with architects, administrators, engineers, analysts, and developers across Azure, Microsoft 365, identity, information protection, security operations, DevOps, applications, databases, and networks.
- Learners still on AZ-500-only Azure security should use this SC-500 outline for current associate work.
Prerequisites
- Practical experience administering Azure and hybrid environments, including compute, network, and storage.
- Strong familiarity with Microsoft Entra ID.
- Familiarity with Microsoft 365 administration.
- No Accumentum-invented hour counts. Confirm any Microsoft-stated prerequisites on Microsoft Learn.
Pathway Map
Twelve modules mapped to Microsoft SC-500 published skills.
Skills measured: manage identity, access, and governance 20 to 25%, secure storage, databases, and networking 25 to 30%, secure compute 20 to 25%, and manage and monitor security posture 20 to 25%.
1
Secure access with Microsoft Entra ID
2
Secure secrets and keys with Azure Key Vault
3
Governance, compliance, and RBAC
4
Implement security for storage accounts
5
Implement security for databases
6
Implement security for Azure network services
7
Implement security for AI
8
Implement security for servers and VMs
9
Implement security for application platform services
10
Manage security posture with Defender for Cloud
11
Implement activity and event collection in Microsoft Sentinel
12
Implement Microsoft Security Copilot
Course Content
- Deploy Key Vault and configure settings, access, and firewall.
- Manage keys, secrets, and certificates.
- Scan for secrets by using Defender CSPM.
- Implement Defender for Key Vault.
- Azure Policy, including built-in and custom definitions.
- Evaluate regulatory compliance and configure security controls in Microsoft Defender for Cloud.
- Resource locks, built-in and custom Azure and Entra roles, and remediate overprivileged RBAC.
- Azure Backup security features and security controls by using infrastructure as code.
- Configure security for storage accounts and Azure Storage firewall rules.
- Implement Defender for Storage threat protection configurations.
- Manage access to storage, including access policies.
- Platform-level security configurations in Azure SQL.
- Database auditing for Azure SQL Database and Azure SQL Managed Instance.
- Configure Defender for Databases protection across Azure database services.
- NSGs, ASGs, and Azure Virtual Network Manager access policies.
- Virtual WAN, VPN, Microsoft Entra Private Access, private endpoints, and Private Link.
- Azure Firewall.
- Evaluate effective security rules with Azure Network Watcher diagnostics.
- Identify SharePoint data overexposure and Copilot / AI app risks with Microsoft Purview DSPM.
- Real-time protection for Microsoft Copilot Studio agents. Conditional Access and blast-radius analysis for Microsoft Entra Agent ID.
- AI Gateway in Azure API Management for Microsoft Foundry, Defender for AI Service, Foundry agent guardrails.
- Monitor AI security with the Data and AI security dashboard in Defender for Cloud. Manage agents in Microsoft 365 admin center.
- Disk encryption, Azure Bastion, and just-in-time VM access.
- Extend controls to hybrid and multicloud servers with Azure Arc.
- Onboard servers to Defender for Servers, including vulnerability scanning, EDR, and agentless scanning.
- Secure boot, vTPM, integrity monitoring, and Azure Machine Configuration.
- Defender for Containers and security controls for AKS, Container Registry, Container Instances, and Container Apps.
- Security controls for Azure Functions, Logic Apps, and App Service.
- Azure Web Application Firewall.
- Security policies for back-end API protection by using API Management.
- Identify security risks with Defender CSPM and evaluate compliance frameworks.
- Enable Defender for Cloud workload protection plans.
- Connect hybrid, AWS, and GCP environments.
- Microsoft Defender Vulnerability Management and Microsoft Defender External Attack Surface Management (EASM).
- Create and connect workspaces and assign roles in Microsoft Sentinel.
- Content hub solutions and Microsoft data connectors for Azure resources.
- Syslog, CEF, Windows Security events with data collection rules, custom log tables, and data retention.
- Automation rules and playbooks. Query Microsoft Purview Audit in Defender XDR.
- Configure workspaces for Security Copilot.
- Manage permissions and roles.
- Enable and configure plugins.
- Enable and configure Microsoft agents and Security Store agents.
Course Features
Designed for SC-500 cloud and AI security engineering.
Skills-measured map
Twelve modules aligned to Microsoft SC-500 published skill domains.
AI security included
Secure compute includes AI workloads: Purview DSPM, Entra Agent ID, Foundry guardrails, and Defender for AI. Those topics were were not the AZ-500 center of gravity.
Public exam facts
Pearson VUE. Microsoft publishes a passing score of 700 or greater. Annual renewal on Microsoft Learn. No invented prices.
Prior exam context
AZ-500 is the prior Azure Security Engineer Associate exam. This course is SC-500.
Certification Exam
Prepare for the official Microsoft SC-500 exam.
SC-500 Exam Readiness
Accumentum SC-500 training prepares security engineers to implement end-to-end security controls for cloud and AI workloads.
The Microsoft Certified: Cloud and AI Security Engineer Associate exam is SC-500 (Implementing End-to-End Security Controls for Cloud and AI Workloads). Public facts from Microsoft: the exam is delivered through Pearson VUE, you need a score of 700 or greater to pass, and associate certifications expire annually and can be renewed on Microsoft Learn. Accumentum does not publish unofficial question counts or invented exam prices.
Skills measured: manage identity, access, and governance (20 to 25%), secure storage, databases, and networking (25 to 30%), secure compute (20 to 25%), and manage and monitor security posture (20 to 25%).
Exam SC-500 replaces AZ-500. Microsoft has stated AZ-500 end of life on 31 August 2026. Confirm current retirement, scheduling, and interactive-item details on Microsoft Learn and Pearson VUE.
Skills Measured
What Microsoft says SC-500 measures.
Microsoft lists the skills measured for Exam SC-500. Here are all 4 domains, 12 skill groups and 87 tasks in Microsoft's own wording. Our course maps a lesson or lab to each one.
Secure access to resources by using Microsoft Entra ID
Part of Manage identity, access, and governance (20 to 25%)
- Implement and configure Privileged Identity Management (PIM)
- Implement conditional access policies
- Implement and configure authentication methods, including multifactor authentication (MFA) and passwordless
- Implement and configure identity for applications, including enterprise applications and app registrations
- Manage OAuth permission grants and consent settings
- Implement and configure managed identities for Azure resources
Secure secrets and keys by using Azure Key Vault
Part of Manage identity, access, and governance (20 to 25%)
- Deploy Key Vault
- Configure Key Vault settings
- Configure access to Key Vault
- Configure firewall settings on Key Vault
- Manage keys, secrets, and certificates
- Scan for secrets by using Defender Cloud Security Posture Management (Defender CSPM)
- Implement Defender for Key Vault
Implement governance to enforce security and regulatory compliance
Part of Manage identity, access, and governance (20 to 25%)
- Implement and configure security controls by using Azure Policy, including built-in and custom policy definitions
- Evaluate regulatory compliance by using Microsoft Defender for Cloud
- Implement and configure security controls in Defender for Cloud, including security standards and recommendations
- Implement resource locks
- Manage Azure built-in role assignments
- Manage custom roles, including Azure roles and Microsoft Entra roles
- Evaluate and remediate overprivileged access assignments by using Azure role-based access control (RBAC)
- Configure security controls for backup protection by using Azure Backup security features
- Implement and configure security controls by using infrastructure as code
Implement security for storage accounts
Part of Secure storage, databases, and networking (25 to 30%)
- Implement and configure security for storage accounts
- Configure Azure Storage firewall rules
- Implement Defender for Storage threat protection configurations
- Manage access to storage, including access policies
Implement security for databases
Part of Secure storage, databases, and networking (25 to 30%)
- Implement platform-level security configurations in Azure SQL
- Configure database auditing for Azure SQL Database and Azure SQL Managed Instance
- Configure Defender for Databases protection across Azure database services
Implement security for Azure network services
Part of Secure storage, databases, and networking (25 to 30%)
- Implement and manage network security groups (NSGs) and application security groups (ASGs)
- Implement and configure network access policies by using Azure Virtual Network Manager
- Configure security for an Azure Virtual WAN
- Implement and configure security for virtual private network (VPN) connections
- Implement and configure Microsoft Entra Private Access
- Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources
- Configure Azure Private Link services to secure access to network resources
- Implement and configure Azure Firewall
- Evaluate effective security rules by using Azure Network Watcher diagnostics
Implement security for AI
Part of Secure compute (20 to 25%)
- Identify overexposure of data in SharePoint
- Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM)
- Enable and configure real-time protection for Microsoft Copilot Studio agents
- Implement conditional access for Microsoft Entra Agent ID
- Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR
- Manage Entra Agent ID access
- Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry
- Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud
- Configure guardrails for agent security in Foundry
- Monitor AI security by using the Data and AI security dashboard in Defender for Cloud
- Manage agents in Microsoft 365 admin center
Implement security for servers and virtual machines (VMs)
Part of Secure compute (20 to 25%)
- Implement and configure disk encryption
- Plan and implement Azure Bastion
- Enable and enforce use of just-in-time (JIT) VM access
- Extend security controls to hybrid and multicloud servers by using Azure Arc
- Onboard servers to Defender for Servers in Defender for Cloud, including hybrid and multicloud scenarios
- Configure Defender for Servers settings, including vulnerability scanning, and endpoint detection and response (EDR)
- Implement and manage agentless scanning for VMs in Defender for Servers
- Configure security features on a VM, including secure boot, virtual Trusted Platform Module (vTPM), integrity monitoring, and security type
- Enforce security configuration of Azure-managed servers by using Azure Machine Configuration
Implement security for application platform services
Part of Secure compute (20 to 25%)
- Detect misconfigurations and runtime risks in container workloads by using Defender for Containers
- Implement and configure security controls for Azure Kubernetes Service (AKS)
- Implement and configure security controls for Azure Container Registry
- Implement and configure security controls for Azure Container Instances and Azure Container Apps
- Implement and configure security controls for Azure Functions, including authentication and network access
- Implement and configure security controls for Azure Logic Apps
- Implement and configure security controls for Azure App Service
- Implement and configure Azure Web Application Firewall
- Implement security policies for back-end API protection by using API Management
Manage security posture by using Defender for Cloud
Part of Manage and monitor security posture (20 to 25%)
- Identify security risks by using Defender CSPM
- Evaluate compliance against security frameworks by using Defender for Cloud
- Enable and configure Defender for Cloud workload protection plans
- Connect hybrid cloud and multicloud environments to Defender for Cloud, including Amazon Web Services (AWS) and Google Cloud Platform (GCP)
- Configure Microsoft Defender Vulnerability Management settings for Azure VMs
- Discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management (EASM)
Implement activity and event collection in Microsoft Sentinel
Part of Manage and monitor security posture (20 to 25%)
- Create and connect workspaces in Microsoft Sentinel
- Assign roles in Microsoft Sentinel
- Implement and use content hub solutions
- Configure and use Microsoft data connectors for Azure resources
- Implement and configure syslog and Common Event Format (CEF) event collections
- Implement and configure collection of Windows Security events by using data collection rules, including Windows Event Forwarding (WEF)
- Create custom log tables in the workspace to store ingested data
- Implement automation rules and playbooks in Microsoft Sentinel
- Implement data retention in Microsoft Sentinel data stores
- Query Microsoft Purview Audit in Defender XDR
Implement Microsoft Security Copilot
Part of Manage and monitor security posture (20 to 25%)
- Configure workspaces for Security Copilot
- Manage permissions and roles in Security Copilot
- Enable and configure plugins
- Enable and configure Microsoft agents and Security Store agents
Study Plan
Turning the SC-500 outline into a plan.
We open with identity, access and governance, since every other control depends on who can do what. Microsoft Entra, privileged access and policy based governance come first.
Securing storage, databases and networking is the largest domain at 25 to 30 percent. You lock down storage accounts and databases, segment networks and set up firewalls and private access.
Next comes compute. We harden virtual machines, containers and app services, and look at how AI workloads change the attack surface.
We close with security posture, using Microsoft Defender for Cloud and related tools to find and fix gaps. The final week is review and the exam sandbox.
Exam Policies
How Microsoft runs the SC-500 exam.
SC-500 leads to Microsoft Certified: Cloud and AI Security Engineer Associate. Microsoft requires a score of 700 or greater to pass.
Microsoft notes that the bullets under each skill show how a skill is assessed, and related topics may also be covered. Most questions cover features that are generally available, but the exam can include Preview features if they are commonly used.
Before test day you can try the exam sandbox to see the exam interface. If you use assistive devices or need extra time, Microsoft lets you request an accommodation. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Microsoft associate certifications expire annually. You renew by passing a free online assessment on Microsoft Learn, and we show you how to keep SC-500 current.
Career Outlook
Where SC-500 can take you.
SC-500 replaces AZ-500, so it now fits the people who secure Azure and the AI workloads running on it. Titles include cloud security engineer, Azure security engineer, security administrator and AI security engineer. The work covers identity and access, securing storage, databases and networks, hardening compute and containers, and watching security posture over time.
For a sense of pay, BLS puts the May 2025 median annual wage for information security analysts at $129,180. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. Treat it as a reference point and not a promise. Location, experience and the employer drive what any one person earns. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for SC-500 training.
Accumentum is an Army CA and Air Force COOL Approved Vendor. If you're serving, start with your education center and read our Army CA and Air Force COOL pages for the steps. We'll help you line up the course with your request.
Paying on your own? SC-500 prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page has every other option, and you can always talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
SC-500 Cloud and AI Security Engineer training with Accumentum: scope, audience, skills measured, and public exam facts.
No. This is Exam SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, for Microsoft Certified: Cloud and AI Security Engineer Associate. AZ-500 is the prior exam.
Security engineers who protect cloud and hybrid environments and who secure platforms, data, identities, and infrastructure used by AI workloads.
Secure Entra ID, Key Vault, storage, databases, and networks. Secure AI, servers, and app platforms. And manage posture with Defender for Cloud, Sentinel, and Security Copilot.
Twelve modules mapped to Microsoft’s published SC-500 skill domains.
Identity, access, and governance 20 to 25%, storage, databases, and networking 25 to 30%, secure compute 20 to 25%, and manage and monitor security posture 20 to 25%.
Pearson VUE. Microsoft publishes a passing score of 700 or greater. Annual renewal on Microsoft Learn. No invented prices or unofficial question counts.
Use Accumentum registration for SC-500 training dates and enrollment support.
Microsoft requires a score of 700 or greater to pass.
Microsoft lists these domains:
- Manage identity, access, and governance, 20 to 25%
- Secure storage, databases, and networking, 25 to 30%
- Secure compute, 20 to 25%
- Manage and monitor security posture, 20 to 25%
Secure storage, databases, and networking is the largest at 25 to 30%. We give it the most lab time.
Microsoft lists 87 tasks across 12 skill groups. Our course covers all of them.
Microsoft associate certifications expire annually. You renew by passing a free online assessment on Microsoft Learn, and we show you how to keep SC-500 current.
Yes. Microsoft offers an exam sandbox that shows you the exam interface and question types.
Accumentum is an Army CA and Air Force COOL Approved Vendor. Start with your education center, and we'll help you with the rest.
Microsoft says most questions cover generally available features, but Preview features can appear if they are commonly used.
Yes. SC-500 prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee, and longer terms add 5% to 15%.
Enrollment
Enroll in Microsoft Cloud and AI Security Engineer Certification Training (SC-500) with Accumentum.
Enroll in Accumentum’s SC-500 training to prepare for Exam SC-500. For course dates and enrollment support, visit Accumentum’s registration page linked below.
Prepare for SC-500 cloud and AI security work.
End-to-end security controls for cloud and AI workloads. Not AZ-500.