AZ-500 just had a major update, with many new topics added in, as well as the removal of quite a few topics. The changes to the skills at a glance and a weighting change help to start explaining some of the chance.

New skills at a glance

  • Secure identity and access (15–20%)
  • Secure networking (20-25%)
  • Secure compute, storage, and databases (20–25%)
  • Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (30–35%)

Previous skills at a glance

  • Manage identity and access (25-30%)
  • Secure networking (20–25%)
  • Secure compute, storage, and databases (20–25%)
  • Manage Security Operations 30–35%)

The first thing to note here is that the identity section name and weighting has changed. The word change to secure from manage is aligned the exam moving to have less of an emphasis on general identity management with Entra ID, instead focusing on certain security elements. Quite a few topics have been removed, which is why the weighting has been dropped. I’ll dig into the changes below, but for now let’s jump to the next change.

Manage Security Operations has now become Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel. This change really emphasizes the focus of the objective domain, making it less vague. There have also been some changes in this section, along with the others, so let’s take a look at them.

What’s been added to the exam?

  • Azure Virtual Network Manager
  • Azure Key Vault network settings
  • Security controls to protect backups
  • Security controls for asset management
  • Manage security posture by using Microsoft Defender for Cloud (new section with multiple topics)
  • Microsoft Defender for Cloud DevOps Security
  • Data collection rules (DCRs) in Azure Monitor

What’s been removed?

  • Configure Microsoft Entra Verified ID
  • Passwordless authentication
  • Password protection
  • Single sign-on (SSO)
  • Single sign on (SSO) and identity providers
  • Modern authentication methods
  • Role management and access reviews in Microsoft Entra
  • Microsoft Entra Application Proxy
  • Secure Microsoft Entra users
  • Secure Microsoft Entra groups
  • Recommend when to use external identities
  • Secure external identities
  • Implement Microsoft Entra ID Protection
  • Access to Azure tables
  • Access to Azure queues
  • Microsoft Purview governance portal
  • Azure Blueprints
  • Landing zones
  • Dedicated Hardware Security Module
  • Alerts and incidents in Microsoft Sentinel

Here’s where I get to give my usual disclaimer – just because something has been removed from the exam description, it doesn’t necessarily mean that it won’t be referenced somewhere in the exam. I view it as the audience profile section tends to give some insight into the overall breadth of additional skills, knowledge and exposure the exam candidate should have, with some previously singled out topics basically becoming core skills any candidate should have without it needing to be specified.

If you are already familiar with Microsoft Entra ID P2 functionality, whether through Azure of through Microsoft 365 related services, you should be good shape for the identity related portions of this exam. There is an exception here though – make sure you spend extra time in the managing application access section, this isn’t something you may have had exposure to. If you don’t have much Entra experience, then you will need to spend time here understanding the capabilities of Entra ID P2, not just the free edition that’s included with Azure subscriptions by default.

If you are approaching this exam with a fairly solid understanding of networking concepts including subnets, routing, appliances etc. you are off to a strong start with the advanced network security section. The most important thing here is for you to understand how the Azure native versions of the services may differ from those of other solutions from other vendors. If you don’t have much or any networking in your prior experiences, make sure you spend some time going through some basics of TCP/IP and networking including what’s mentioned earlier in this paragraph, and then focus on the technologies in the exam objectives.

During the early days of this exam, understanding how to protect Azure virtual machines worked would have covered you quite well in the advanced security for compute section, but now you can’t just know what acronyms like ACI, ACR, AKS etc. stand for, you also need to how to secure them, including their networking configuration. At this stage it’s most likely you’re familiar with these container related technologies if you have Linux experience, but over the last few years I’ve seen more Windows centric exam takers having some exposure to these technologies as well. This update has had some major changes in the container and serverless related objectives so expect to see more questions on those.

The final thing here is to make sure you have an understanding of what’s in Microsoft Defender for Cloud, and the additional features you get when you move up to workload protections in Microsoft Defender for Cloud. Use the additional workload protections to help drive your understanding of the workloads that you aren’t familiar with. Defender for Servers and Defender for SQL do get mentioned specifically, so they are the ones to focus on.

Sentinel, along with Azure monitor and DCRs have continued to take a bigger role in this exam as well.

The examples I’ve just provided don’t cover all of the different combinations of exam preparation scenarios based on your skills, but hopefully they give you some idea of what I see catch people out.

Secure identity and access (15–20%)

Manage security controls for identity and access

Manage Microsoft Entra application access

Secure Networking (20-25%)

Plan and implement security for virtual network

Plan and implement security for private access to Azure resources

Plan and implement security for public access to Azure resources

Secure compute, storage, and databases (20–25%)


Plan and implement advanced security for compute

Plan and implement security for storage

Plan and implement security for Azure SQL Database and Azure SQL Managed Instance


Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (30–35%)


Implement and manage enforcement of cloud governance policies

Manage security posture by using Microsoft Defender for Cloud

Configure and manage threat protection by using Microsoft Defender for Cloud

Configure and manage security monitoring and automation solutions