Microsoft’s current security certification portfolio covers several distinct jobs: foundational security literacy, identity administration, security operations, information protection, cloud and AI security engineering, and cybersecurity architecture. SC-900 provides the broad concepts. SC-300 focuses on identity and access. SC-200 targets security operations. SC-401 covers information security administration in Microsoft 365. SC-500 is the current cloud and AI security-engineer route, and SC-100 validates expert-level cybersecurity architecture.
This is not one linear ladder. The associate credentials represent different operating domains, and the right choice depends on the controls and incidents you own. The expert architecture credential is the clearest point where Microsoft formalizes progression: Cybersecurity Architect Expert requires SC-100 plus at least one qualifying associate certification from Identity and Access Administrator, Security Operations Analyst, or Cloud and AI Security Engineer.
The other major 2026 change is the retirement of AZ-500. Azure Security Engineer Associate retired on August 31, 2026 and was replaced by SC-500. Older AZ-500 material remains useful for historical Azure security context, but it should not be presented as the active security-engineer destination.
SC-900 is the common language for the portfolio
SC-900 is designed for business stakeholders, students, and new or existing IT professionals who want to understand security, compliance, and identity concepts across Microsoft services. It provides vocabulary around zero trust, Microsoft Entra, security capabilities, compliance concepts, and the relationship between Azure and Microsoft 365 security.
That makes it a useful starting point for people who are unsure which security role fits them. It does not validate the depth expected from someone implementing Conditional Access, investigating a Sentinel incident, building data-loss-prevention policy, or securing a production Azure environment. Its job is orientation.
SC-900 fundamentals give newcomers a common vocabulary for identity, security, compliance, Zero Trust, Defender, Sentinel, and Purview before they commit to a specialist operating role.
SC-300 is the route for identity and access administration
SC-300 validates the design, implementation, and operation of identity and access management using Microsoft Entra. The role manages identities for users, devices, applications, and Azure resources; plans authentication and authorization; applies zero-trust principles; implements governance; and monitors identity activity.
Identity is a security control plane because so many other systems depend on it. A network can be segmented correctly and a database encrypted correctly while the environment is still exposed if privileged access is unmanaged. Identity administrators therefore work with authentication methods, access policies, workload identities, lifecycle, privileged roles, governance, risk, and monitoring.
Conditional Access turns identity signals into policy decisions about who can reach a resource, under which conditions, and with what authentication assurance.
SC-200 is built for detection, investigation, and response
Security Operations Analyst Associate is aimed at the people who work with security telemetry and active incidents. The role uses Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft Defender XDR technologies to investigate, search for, and mitigate threats. The operating rhythm is different from identity administration: analysts prioritize alerts, correlate evidence, hunt for activity, manage incidents, and decide what response is justified.
Microsoft Sentinel brings SIEM responsibilities into one operating surface through data ingestion, normalization, detection logic, analytics rules, queries, automation, investigation context, and incident handling.
SC-200 fits SOC analysts, threat hunters, incident responders, and security engineers whose daily work starts from evidence and operational response rather than from designing access architecture.
SC-401 owns the information-protection and governance operating layer
SC-401, Information Security Administrator Associate, focuses on information security inside Microsoft 365. The role works with information protection, data loss prevention, retention, risk, alerts, and activities. It is a data-centered security job: understand what information exists, how sensitive it is, where it moves, which controls should apply, and how policy behavior should be monitored.
Identity matters because labels, policies, and protected content still have to interact with users, groups, applications, and administrative roles. Security operations matter because data-protection events and risky activity can become investigation inputs. That overlap is real, but the center of gravity is information rather than identity infrastructure or threat detection.
Practical data-loss-prevention controls show how information policy has to work in applications people use every day, not merely in a compliance console.
SC-500 is the current cloud and AI security-engineer route
SC-500 validates end-to-end security controls across cloud, hybrid, and AI-enabled environments. Its responsibilities span identity, network, application, data, compute, compliance, posture, and AI workload security. This breadth makes it the operational engineering credential for people responsible for implementing controls across Azure and connected environments.
Microsoft positioned SC-500 as the direct replacement for the retired AZ-500 route. That transition expands the scope rather than simply renaming the old exam. Candidates still need strong Azure administration and security knowledge, but the modern role includes protecting platforms, data, identities, infrastructure, and AI workloads as part of one control system.
Microsoft Defender for Cloud joins posture management, workload protection, and continuous assessment so security engineers can compare architectural intent with the actual security state of deployed resources.
SC-100 moves from implementing controls to designing the security system
SC-100 is the expert architecture exam. It asks candidates to design security solutions aligned with best practices and priorities across operations, identity, compliance, infrastructure, applications, and data. The architect has to reason across multiple technical domains and translate business risk into a security strategy that other teams can implement.
Microsoft’s current prerequisite model reinforces that progression. To earn Cybersecurity Architect Expert, candidates must earn at least one of three associate certifications: Identity and Access Administrator, Security Operations Analyst, or Cloud and AI Security Engineer. That means SC-300, SC-200, and SC-500 represent three legitimate technical foundations for the architecture role.
SC-100 architecture becomes most meaningful after a candidate understands at least one operating domain deeply enough to recognize real implementation constraints and the trade-offs behind control placement.
AZ-500 is now historical context, not a current destination
AZ-500 previously validated Azure Security Engineer Associate and remains relevant to people researching the history of Azure security skills. However, it retired on August 31, 2026. New candidates should use SC-500 for the current Microsoft security-engineer path.
This distinction matters because old search results can make a retired exam look current long after registration has ended. A certification path should preserve the historical relationship without telling a candidate to pursue a credential that can no longer be earned.
Security professionals should also avoid assuming that every old AZ-500 topic became irrelevant. Identity, network protection, Defender for Cloud, compute security, storage security, governance, and monitoring remain central concepts; the current credential simply places them inside a broader cloud-and-AI security role.
Choose the route by the asset or decision you protect
A sound training plan should therefore name the operating responsibility first, then select the credential. That makes later progress easier to evaluate: the candidate can point to stronger incident handling, tighter access governance, better information controls, safer cloud configurations, or clearer architectural decisions rather than treating exam completion itself as the security outcome.
The portfolio becomes easier to navigate when the starting point is the control surface you work with. Identity administrators spend their time on authentication methods, access policies, privileged roles, lifecycle processes, and identity governance. Security operations analysts work from telemetry, detections, incidents, hunting, and response. Information security administrators focus on classifying and governing data, enforcing protection, and reducing risky information movement. Cloud security engineers implement controls across cloud and hybrid infrastructure. Cybersecurity architects connect those domains into a defensible end-to-end design. Those responsibilities cooperate in one security program, but they are not interchangeable jobs.
That distinction matters when planning more than one credential. A SOC analyst who moves toward architecture should first strengthen the identity, cloud-control, and governance areas that are outside day-to-day incident work. An identity specialist moving into a cloud security-engineering role needs to add network, compute, storage, posture, and workload-security depth rather than simply studying more authentication features. An information-protection specialist moving toward architecture needs a broader understanding of threat detection, cloud control placement, and organizational risk. Progression is therefore the process of closing responsibility gaps, not merely selecting the next exam code in numerical order.
Organizations can use the same map to build team coverage. A mature security function needs people who can prevent and govern, people who can detect and respond, and people who can design how those controls fit together. Concentrating all training in a single domain can leave blind spots: excellent detection without strong identity governance produces recurring incidents, while strong preventive controls without operational monitoring can allow failures to remain invisible. Microsoft’s current role-based credentials are most useful when they are treated as lenses on a shared security system rather than as competing certifications.
Current-versus-legacy status deserves its own check before any study plan is approved. AZ-500 is a particularly important example because many existing articles, job postings, and training materials still refer to Azure Security Engineer Associate. That historical material can explain concepts and prior responsibilities, but the live cloud-security engineering direction has moved to SC-500. Using the current credential avoids building a plan around an exam that can no longer be scheduled.
If you need broad security vocabulary, start with SC-900. If your responsibility is identity, authentication, authorization, governance, and privileged access, choose SC-300. If you investigate alerts and incidents, choose SC-200. If you administer information protection, DLP, retention, and information-risk controls, choose SC-401. If you implement end-to-end cloud and AI security controls, choose SC-500. If you design security strategy across all of those domains, build toward SC-100.
The wider Microsoft certifications landscape matters when security intersects with Azure administration, networking, Microsoft 365, data, or DevOps. Security work rarely stays inside one product boundary, and strong professionals understand which neighboring role owns the control they depend on.
The durable path is not “collect every security badge.” It is to build depth in the operating domain you own, then add neighboring skills when your responsibilities genuinely expand.