TL;DR
AZ-900 is the vocabulary exam: cloud concepts, Azure services, governance basics, 45 exam minutes, no labs. SC-500 is the associate security exam: implementing end-to-end security controls for cloud and AI workloads across four assessed areas in 120 minutes. Take AZ-900 first if cloud is new; take SC-500 when you secure Azure for a living or want to. Skipping AZ-900 with experience is fine.
Who each exam is for
AZ-900 is for cloud beginners: students, career changers, non-technical stakeholders, and IT staff meeting Azure for the first time. It asks what things are and which service fits, never how to configure them. The cert never expires, which makes it a safe permanent early win.
SC-500 is for practitioners securing cloud and AI workloads: cloud admins adding security depth, SOC analysts in Azure shops, and security engineers formalizing their skills. Its official exam title names the job: implementing end-to-end security controls for cloud and AI workloads. It succeeds the retired AZ-500, so it also serves as the current Azure security associate stamp.
Side by side
- AZ-900. 45 exam minutes inside a 65-minute seat, passing score 700 on a 1 to 1000 scale, Microsoft exams generally running 40 to 60 questions. Three areas: cloud concepts, Azure architecture and services, management and governance. No labs. Fundamentals do not expire.
- SC-500. 120 minutes, passing score 700. Four assessed areas: manage identity access and governance; secure storage databases and networking; secure compute; manage and monitor security posture. Generally available since July 2026, successor to AZ-500 (retired 2026-08-31). Question counts, score scale details, and pricing are unverified for this exam, so confirm them on the Microsoft page; this guide states only the verified duration, pass score, and areas.
- Skill shape. AZ-900 rewards recognition: define, compare, select. SC-500 rewards implementation judgment: configure, secure, monitor. The verbs differ because the jobs differ.
- Hands-on demand. AZ-900 can be passed with reading plus light console clicking. SC-500 expects real Azure reps: identity policies, storage protections, network controls, posture monitoring. Candidates who never secured a subscription fail SC-500 the way drivers who never drove fail road tests.
- Study guide support. Microsoft publishes an official study guide for each exam linked from its certification page. Use the SC-500 guide as the syllabus spine; at the time of our check its practice assessment was not yet available, so plan on third-party practice plus labs for reps.
Where they actually differ
Vocabulary against implementation
AZ-900 asks which Azure service stores blobs. SC-500 asks how to protect that storage with access control, encryption posture, and network rules. Every AZ-900 topic reappears in SC-500 wearing work clothes. This is why AZ-900 first feels efficient: you learn the nouns before the exam that tests the verbs. Experienced Azure staff already own the nouns and can start directly at SC-500.
Identity as the center
SC-500 opens with identity, access, and governance for a reason: identity is the perimeter in cloud. AZ-900 introduces identity as one service family among many. If your identity knowledge stops at what SSO stands for, budget the biggest SC-500 study block there. Policies, conditional access concepts, and governance tooling decide more SC-500 questions than any compute topic.
AI workload coverage
SC-500 explicitly includes AI workloads in its scope, reflecting where Azure security work actually goes now. AZ-900 touches AI only as a service category to recognize. Candidates from general IT should not fear this: the exam tests security controls around AI workloads (access, data protection, posture), not model internals. Study it as cloud security with new asset types, not as data science.
The four SC-500 areas unpacked
Identity, access, and governance: policies that decide who reaches what, conditional access concepts, privileged access hygiene, and governance tooling that keeps subscriptions compliant. This area decides the most questions, so study it first and longest. Secure storage, databases, and networking: encryption posture, access control on data services, private endpoints, and network rules that shrink exposure. Think of it as putting the vault inside progressively smaller rooms. Secure compute: hardening virtual machines and containers, patch posture, and workload protections including the AI workloads the exam names. Manage and monitor security posture: the continuous side (posture tools, secure score concepts, monitoring and alerting) that turns one-time configuration into ongoing assurance. Map every lab you build to one of the four so coverage stays visible; an area with no lab reps is an area you will miss on exam day.
A lab project that covers all four
One project, four areas, four weekends. Weekend one: build a small subscription with an identity policy (MFA-style controls, least-privilege roles) and document who can reach what. Weekend two: add storage with restricted network access and verify from both allowed and denied locations. Weekend three: deploy a small workload, harden it, and record the before-and-after posture. Weekend four: turn on monitoring, generate the posture view, and write the one-page finding (evidence, conclusion, recommendation) as if briefing a manager. Total cost stays inside free-tier limits with care, total learning exceeds any video course, and the notes become your final review sheet. Photograph nothing with credentials; write everything as steps you could repeat.
The AZ-500 footnote for upgraders
If your study shelf still holds AZ-500 material, use it with a translation mindset. Identity, network, and compute protection concepts carry over; the exam code, emphasis, and AI-workload scope do not. Retired 2026-08-31, AZ-500 no longer books, so treat its books as background reading and the SC-500 study guide as law. Practice questions written for AZ-500 still drill useful reps, but verify every answer against current SC-500 guidance before trusting it. Upgraders with recent AZ-500 passes should move quickly: the shared base is fresh, and a short SC-500 run converts a retired credential into a current one.
Career weight
AZ-900 gets your resume past cloud-awareness filters and helps students sound credible. SC-500 signals employable cloud security skill to hiring managers in Azure shops. Neither replaces experience, but SC-500 plus a year of Azure admin work reads as a genuine security hire, while AZ-900 alone reads as a promising start. Match the exam to the claim you want your resume to make.
Which one first
Cloud is new to you: AZ-900 first, using the fundamentals framing in AZ-900 vs cloud fundamentals, then SC-500 after a few months of Azure reps. Already administer Azure or hold AZ-900: go straight to SC-500 with the official study guide as syllabus. Coming from another cloud: skim AZ-900 material for Azure names (a week or two), then commit to SC-500, since your concepts transfer and only the service vocabulary is new.
How to study for the one you pick
For AZ-900, read the official guide, click through every named service in a free subscription, and drill governance vocabulary until boring. For SC-500, build a lab subscription and implement each control the guide names (identity policies first), monitor posture tools weekly, and rehearse scenario judgment under the 120-minute clock. Both: verify readiness with mixed timed sets per readiness explained and review logistics in the exam-day checklist, since Microsoft check-in differs from CompTIA.
Sources
- Microsoft Azure Fundamentals page (owner)
- Microsoft SC-500 certification page (owner)
- Microsoft SC-500 study guide (official guide)
- Exam facts re-verified against published exam records 2026-10-18; SC-500 question counts and pricing omitted as unverified (check owner pages).
Editorial: this guide was written by the SecLern study team and checked against Microsoft Learn on 2026-10-18. Only verified SC-500 facts (duration, pass score, four areas, AZ-500 succession) are stated.