Microsoft Azure Security Engineer: the honest guide
Everything Microsoft Azure publishes about AZ-500, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from AZ-500’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
Practise AZ-500 questions in the meantimeWhat the exam actually asks you to do
Multiple choice and multiple response, plus drag-and-drop ordering, hot area items where you click a region of a screenshot, and case studies that hold one scenario across several linked questions.
- Multiple choice
- Multiple response
- Drag and drop
- Hot area
- Case study
The highlighted formats are the ones you cannot answer from memory alone. Microsoft Learn, exam duration and question types ↗
Domain breakdown and official weightings
From the official Microsoft Learn study guides. Manage identity and access is the heaviest domain at 28 percent, followed by Manage security operations at 28 percent.
- Manage identity and access28%
- Secure networking22%
- Secure compute, storage, and databases22%
- Manage security operations28%
Where to focus: Identity and security operations are 56 percent together. Build a lab tenant and configure conditional access and Defender for Cloud yourself; the exam asks what happens, not what the feature is called.
What comes after passing
AZ-500 is valid for 1 year. Free online renewal assessment on Microsoft Learn each year.
Costs across the full renewal cycle are on the AZ-500 cost page.
Frequently asked questions
Do I need AZ-104 before AZ-500?
Not formally, but AZ-500 assumes you can already build and operate the things it asks you to secure. If virtual networks, managed identities, and RBAC are unfamiliar, AZ-500 will feel like two exams at once.
What is the hardest part of AZ-500?
Most candidates report the networking domain, because it demands exact behaviour: which NSG rule wins, what a service endpoint does that a private endpoint does not, and where a firewall rule applies. Guessing does not survive contact with those questions.
How much of AZ-500 is Entra ID?
Identity and access is 28% on its own, and identity turns up again inside the compute and operations domains through managed identities and Key Vault access. Study it first and it pays back twice.
Is AZ-500 still worth taking?
For anyone running security in an Azure estate, yes. It is the credential that maps most directly to the day job, and the free annual renewal makes holding it cheap once you have it.
Keep reading
Every guide and cost breakdown, by vendorPractise AZ-500 for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free AZ-500 questions