Engineers who secure Azure and Google Cloud have to choose between provider certifications that differ in level, scope, renewal model and, in Microsoft's case, a recent change of exam. Microsoft retired the Azure Security Engineer Associate certification and its AZ-500 exam on 31 August 2026 and now lists the Cloud and AI Security Engineer Associate (exam SC-500), alongside the Cybersecurity Architect Expert (exam SC-100). Google Cloud's equivalent is the Professional Cloud Security Engineer. This guide compares the three on audience, exam format, domains, prerequisites, renewal and career fit, using only the providers' own pages, checked on 27 October 2026. It is for cloud and security engineers, architects and managers planning training budgets. Fees and exam details change often: check current fees on the provider's page before booking. For the wider certification landscape see the Cybersecurity Certifications Guide.
Key takeaways
- AZ-500 is gone. Microsoft's page states the Azure Security Engineer Associate, its exam and renewal assessments were retired on 31 August 2026; the hands-on Azure security credential is now the Cloud and AI Security Engineer Associate (SC-500).
- Different levels. SC-500 and Google's Professional Cloud Security Engineer are engineering credentials; SC-100 is an expert architecture credential that requires a qualifying associate certification first.
- Renewal models differ sharply. Microsoft associate and expert certifications expire annually and renew through a free online assessment; Google's Professional certification renewal adds two years and uses a renewal exam opened 60 days before the inactive date.
- Identity is the first domain on both sides. SC-500 starts with managing identity, access and governance; Google's exam starts with configuring access. Both cover service principals or service accounts, which is where most cloud breaches begin.
- Choose by platform first. These are product certifications. Pair one with a vendor-neutral credential such as CCSP or CCSK if you need portability across providers.
Who the certification is for
| Certification | Provider level | Typical holder | What it proves |
|---|---|---|---|
| Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500) | Intermediate (associate) | Azure security or platform engineer | Implementing and operating security controls for Azure identity, storage, databases, networking, compute and posture management |
| Microsoft Certified: Cybersecurity Architect Expert (SC-100) | Expert | Security architect across Microsoft security technologies | Designing security solutions for operations, identity, compliance, infrastructure, applications and data |
| Google Cloud Professional Cloud Security Engineer | Professional | Google Cloud security engineer or architect | Configuring access, boundary protection, data protection, operations and compliance on Google Cloud |
Microsoft describes the SC-500 audience as having practical experience administering Azure and hybrid environments, including compute, network and storage, strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration. The SC-100 study guide describes candidates with expert skills in at least one area such as identity and access, platform protection or security operations. Google recommends three or more years of industry experience, including more than one year designing and managing solutions on Google Cloud. Deeper single-provider detail sits in the Microsoft Security Certifications Guide and the Google Professional Cloud Security Engineer Guide.
Exam format and domains
| Item | SC-500 | SC-100 | Google PCSE |
|---|---|---|---|
| Duration | 120 minutes | Not stated on the pages read | 2 hours |
| Questions | Proctored; may include interactive components | Not stated on the pages read | 50 to 60 multiple choice and multiple select |
| Passing score | Not stated on the page read | 700 or greater | Not stated on the page read |
| Delivery | Pearson VUE | Pearson VUE | Pearson VUE, online or test centre |
| Languages | English, Japanese, Chinese (Simplified and Traditional), Korean, German, French, Italian, Portuguese (Brazil), Spanish | Same ten languages | English, Japanese |
| Retakes | Retry after 24 hours, longer waits after that | Microsoft retake policy | Waiting periods vary; Professional exams allow 4 attempts in total |
Domains side by side
| Area | SC-500 skills measured | SC-100 skills measured (weight) | Google PCSE exam areas |
|---|---|---|---|
| Identity and access | Manage identity, access and governance | Design security operations, identity and compliance capabilities (25 to 30 percent) | Configure access |
| Network and boundary | Secure storage, databases and networking | Design security solutions for infrastructure (25 to 30 percent) | Secure communications and establish boundary protection |
| Data | Secure storage, databases and networking | Design security solutions for applications and data (20 to 25 percent) | Ensure data protection |
| Compute and workloads | Secure compute | Design security solutions for infrastructure | Covered within access, boundary and operations areas |
| Operations and posture | Manage and monitor security posture | Design security operations, identity and compliance capabilities | Manage operations |
| Strategy and compliance | Not a separate area | Design solutions that align with security best practices and priorities (20 to 25 percent) | Support compliance requirements |
Microsoft lists SC-100 skills as of 21 October 2026. The SC-500 page did not show domain weights or a practice assessment when checked; it says practice assessments usually appear within eight weeks of an exam leaving beta, which suggests SC-500 was not yet generally available. Check its study guide for the current outline before you plan study time.
Prerequisites and experience
- SC-500: no prerequisite certification listed.
- SC-100: requires at least one of Identity and Access Administrator Associate, Security Operations Analyst Associate or Cloud and AI Security Engineer Associate.
- Google PCSE: no prerequisites; three or more years of industry experience recommended, with more than one year on Google Cloud.
In practice, SC-100 assumes you have already done associate-level work. For a single engineer the usual route is SC-500 first, then SC-100 once you design across identity, operations and data.
Preparation plan
- Download the official outline (Microsoft study guide or Google exam guide PDF) and map each objective to your own experience: green (done in production), amber (done in labs), red (never done).
- Build a lab tenant or project. Use a separate Azure subscription or Google Cloud project you can delete. Practise identity configuration first: Entra ID roles, managed identities and service principals on Azure; IAM roles, service accounts and organisation policies on Google Cloud. See the Azure RBAC and Service Principals Guide and the Google Cloud Security Guide.
- Use the provider's learning path. Google points to the Cloud Security Engineer learning path on Google Cloud Skills Boost and a sample question form; Microsoft links training and, once available, a free practice assessment from each certification page.
- Work the red items first, then the amber ones, with time-boxed labs per objective.
- Take the practice assessment or sample questions under timed conditions and review every wrong answer against the documentation, not against third-party dumps.
- Book the exam when practice results are consistently comfortable, leaving a week for review.
Budget six to ten weeks part time for an engineer already working on the platform, and longer if a large part of the outline is red. Clean up lab credentials when you finish: lab service account keys and client secrets left behind are a real exposure. See the Azure Managed Identities Security Guide and the Workload Identity Federation Guide for the keyless patterns both exams expect you to know.
Cost, renewal and continuing education
| Item | Microsoft (SC-500, SC-100) | Google PCSE |
|---|---|---|
| Exam fee | Varies by country; shown when scheduling. Check current fees | USD 200 plus tax where applicable. Check current fees |
| Validity | Associate, expert and specialty certifications expire annually | Renewal adds 2 years to the inactive date for Professional certifications |
| Renewal method | Free online assessment on Microsoft Learn | Renewal exam, available 60 days before the inactive date |
| Renewal cost | Free | Renewal exam fee; a 50 percent renewal discount code is issued on first certification |
| Continuing education alternative | Not applicable | Offered only for Professional Cloud Architect and Professional Data Engineer, not PCSE |
| Lapse | Certification expires if not renewed | Renew within 30 days after the inactive date to keep the Series ID; after that, retake the standard exam |
The annual Microsoft renewal is low cost but frequent, which suits fast-changing products. Google's two-year cycle needs fewer interventions but costs an exam each time. AZ-500 holders should note that renewal assessments for that certification were also retired on 31 August 2026, so the credential cannot be renewed; plan a move to SC-500. Track renewal dates with your other credentials using the Certification CPE and Renewal Guide.
Where it fits on the career path
| Situation | Suggested choice | Reason |
|---|---|---|
| Engineer on an Azure-first estate | SC-500 | Hands-on, matches daily work, prerequisite route to SC-100 |
| Engineer on Google Cloud | Google PCSE | Google's professional-level cloud security engineering credential |
| Architect across Microsoft 365, Entra and Azure | SC-100 after an associate | Design-level scope across operations, identity, data and applications |
| Multi-cloud engineer | Provider certification for the primary cloud plus CCSP or CCSK | Depth on one platform, portable concepts across all |
| Security manager or auditor | Vendor-neutral credential first | Provider exams test configuration detail rarely needed in oversight roles |
Small teams usually fund one certification on the primary cloud for the engineers who run it. Large organisations with several providers often map a provider certification to each platform team and a vendor-neutral credential to architects and governance staff. Compare with the AWS Certified Security Specialty Guide, the CCSP Certification Guide and the CCSK Certification Guide, and see the Cloud Security Engineer Career Guide for the role itself.
Where identity fits
Both providers put identity first in their outlines, and for good reason: misused credentials, over-permissioned roles and leaked keys are the common thread in cloud incidents. The parts of the outline that deserve extra study time are the machine identity topics, because they appear in production far more often than they appear in training labs.
- Azure (SC-500 identity, access and governance): the difference between service principals with client secrets or certificates and managed identities, role assignment scope (management group, subscription, resource group, resource), and governance features that review and remove standing access.
- Google Cloud (PCSE configure access): service accounts and their keys, impersonation versus downloaded keys, organisation policy constraints that restrict key creation, and federation for workloads outside Google Cloud.
- SC-100 design level: designing identity as the control plane across Microsoft 365, Entra ID and Azure, including how privileged and non-human identities are governed.
Engineers who already run a non-human identity inventory will find these objectives familiar. Those who do not should treat the exam as a prompt to build one. See the Cloud Workload Identity Guide.
Practitioner checklist
- Confirm on Microsoft Learn whether SC-500 is out of beta and download its current study guide.
- If you hold AZ-500, record that it can no longer be renewed and plan for SC-500.
- Check SC-100 prerequisites: one of the three listed associate certifications.
- Check the current exam fee on the provider's page when scheduling.
- Map every objective to your experience and build a disposable lab.
- Practise identity first: service principals, managed identities, service accounts and federation.
- Remove lab credentials, keys and projects after the exam.
- Diary the Microsoft annual renewal window or the Google 60-day renewal window.
- Pair a provider credential with a vendor-neutral one if you work across clouds.
Standards and references
- Microsoft Learn: Microsoft Certified: Cloud and AI Security Engineer Associate
- Microsoft Learn: Microsoft Certified: Cybersecurity Architect Expert
- Microsoft Learn: Study guide for Exam SC-100
- Microsoft Learn: Azure Security Engineer Associate (retired)
- Google Cloud: Professional Cloud Security Engineer
- Google Cloud Certification Help: Recertification
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Microsoft Security Certifications Guide · Google Professional Cloud Security Engineer Guide · Cloud Security Engineer Career Guide