Security+ is the cert that gets a lot of us through the door. Then the question shows up: what do I stack on top of it to land a cloud security role? This week the answer got a little more urgent. CompTIA says Security+ V8 (exam SY0-801) launches on or around November 17, 2026, and Microsoft retired AZ-500 on August 31, 2026, so a lot of older cloud security certification path advice is now out of date. Here's the path I'd follow in 2027 if I were working in an Azure shop, with every exam code checked against the official pages this week.
TL;DR
If you're studying for Security+ right now, V7 (SY0-701) is still valid. The English exam retires June 11, 2027, so pick a version and commit.
For Azure-focused security roles, the core stack is AZ-104 (Azure Administrator), then SC-500 (Cloud and AI Security Engineer), which replaced AZ-500.
Going toward the SOC? Add SC-200 (Security Operations Analyst). CompTIA's CySA+ V4 (CS0-004) is the vendor-neutral equivalent.
For a vendor-neutral cloud credential, the CCSK v5 has no experience requirement. The CCSP needs five years of IT experience, though a CCSK can stand in for one of them.
SC-100 (Cybersecurity Architect Expert) is the capstone, and it requires one of SC-200, SC-500 or the Identity and Access Administrator Associate first.
What changed this year?
Two changes matter for anyone planning a security certification path right now.
Security+ V8 arrives next week. CompTIA lists SY0-801 with a launch date of November 17, 2026, a maximum of 90 questions in 90 minutes, and a passing score of 750 on a 100 to 900 scale. The domain weights shift: Security Operations is 27%, Threats, Vulnerabilities, and Attacks is 24%, and there's a new objective on the security risks of AI systems. The Security Architecture domain (19%) covers cloud, hybrid, on-premises and operational technology environments. V7 (SY0-701) stays available until June 11, 2027 for English.
AZ-500 is gone. Microsoft's AZ-500 study guide now carries a warning that the exam retired on August 31, 2026. Its replacement on the security engineer track is SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, which earns the Microsoft Certified: Cloud and AI Security Engineer Associate. I compared it to SC-200 in detail in SC-500 vs SC-200: Which Security Cert First?
Which cert should come right after Security+?
My honest answer: an Azure administration cert, not another security cert. Security+ teaches you the concepts. What cloud security hiring managers usually test in interviews is whether you can actually work the platform: identities, networking, storage, policy. Microsoft's own SC-500 page says candidates "should have practical experience in administration of Azure and hybrid environments, including compute, network, and storage" and "strong familiarity with Microsoft Entra ID."
That's exactly what AZ-104 covers. Its exam measures managing Azure identities and governance, storage, compute, virtual networking, and monitoring. If you need a plan, my 8-week AZ-104 study plan is a good starting point, and I compared the main practice-exam options in Best AZ-104 Practice Exams.
If you're brand new to Microsoft's security stack, SC-900 (Security, Compliance, and Identity Fundamentals) is a 45-minute exam covering Microsoft Entra, Microsoft security solutions and compliance solutions. It's optional. With Security+ already in hand, I'd only take it if your employer pays or you want a quick confidence check before the associate exams.
The 2027 cloud security certification path, step by step
Step | Cert (exam) | Why it's here | Official notes |
|---|---|---|---|
0 | CompTIA Security+ V7 (SY0-701) or V8 (SY0-801) | Core security concepts and vocabulary | Max 90 questions, 90 minutes, 750 to pass |
1 | Azure Administrator Associate (AZ-104) | Hands-on Azure platform skills every security role assumes | 100 minutes; renew every 12 months, free online |
2a | Cloud and AI Security Engineer Associate (SC-500) | Securing Azure workloads: Entra ID, Key Vault, networking, compute, AI, posture | 120 minutes; 700 to pass |
2b | Security Operations Analyst Associate (SC-200) | SOC work: Defender XDR, Sentinel, KQL hunting, incident response | 100 minutes; renew every 12 months, free online |
3 | CCSK v5 (Cloud Security Alliance) | Vendor-neutral cloud security breadth, multicloud credibility | 60 questions, 120 minutes, open book, 80% to pass |
4 | Cybersecurity Architect Expert (SC-100) or CCSP | Architecture and strategy level | SC-100 needs one associate prerequisite; CCSP needs 5 years' experience |
Exam details are from the official certification pages as of November 13, 2026. Microsoft exam prices vary by the country where you take the exam, so check the price on the exam page before you book.
Step 2: SC-500 or SC-200?
Pick based on the job you want, not the one that sounds harder.
SC-500 is the builder's exam. The study guide weights it as identity, access and governance (20 to 25%), storage, databases and networking (25 to 30%), compute (20 to 25%), and security posture monitoring (20 to 25%). It also has a real AI section: Purview Data Security Posture Management for Copilot, Entra Agent ID access, guardrails in Microsoft Foundry and Defender for AI Services. If you'll own landing zones, Azure Policy, private endpoints or Defender for Cloud, this is your exam.
SC-200 is the responder's exam: managing a security operations environment, responding to incidents, and threat hunting with Microsoft Defender XDR, Microsoft Sentinel and KQL. If you'll work in or near a SOC, start here.
Microsoft doesn't publish a practice assessment for SC-500 yet. Its certification page says practice assessments usually arrive within eight weeks of an exam leaving beta, so lean on the study guide and the exam sandbox for now.
Where does CySA+ fit?
CySA+ is the natural vendor-neutral step after Security+ for analyst roles. The new V4 (CS0-004) launched June 23, 2026 with up to 85 questions in 165 minutes, and CompTIA recommends about four years in a SOC or vulnerability analyst role. If you're mid-study on V3, note the dates: CompTIA says the English V3 exam retires December 22, 2026. For an Azure shop I'd still take SC-200 first, because it maps directly to the tools you'll use daily, but CySA+ is the better pick if your environment is mixed or your employer prefers vendor-neutral credentials.
CCSK or CCSP for vendor-neutral cloud security?
The CCSK v5 is the easier on-ramp. The Cloud Security Alliance says there's no work experience or prior qualification requirement, and the exam is online and open book: 60 multiple-choice questions in 120 minutes with an 80% pass mark. As of today CSA lists the exam at $445, which includes two attempts to use within two years. v5 added AI and generative AI, Zero Trust and expanded DevSecOps coverage across 12 domains.
The CCSP from ISC2 is the heavier credential. ISC2 requires five years of cumulative full-time IT experience, three of them in cybersecurity and one in a CCSP domain. A CCSK can be substituted for one year of that experience, which is a practical reason to take the CCSK first. If you pass the CCSP exam without enough experience, ISC2 makes you an Associate of ISC2 with six years to earn it.
How should you sequence it over the next 12 months?
Here's a realistic plan for a working IT pro with Security+ and some Azure exposure. Adjust it to your schedule.
Months 1 to 3: AZ-104. Build in a free or pay-as-you-go subscription and set a budget alert first. Do every lab yourself rather than watching someone else do it.
Months 4 to 6: SC-500 or SC-200. Use the official study guide as your checklist and turn each bullet into a lab. For SC-500, deploy Key Vault with a firewall, a private endpoint, an Azure Policy assignment and Defender for Cloud. For SC-200, connect a Sentinel workspace and write KQL hunting queries against your own lab logs.
Months 7 to 9: the other associate, or CCSK. Add breadth. SOC people benefit from SC-500, and engineers benefit from SC-200. If you work multicloud, take the CCSK instead.
Months 10 to 12: SC-100 or CCSP. Only once you're actually doing design work. Expert-level exams reward experience more than study hours.
Common pitfalls
Studying from AZ-500 material. Older courses and practice tests still circulate. The exam is retired, and SC-500's objectives are different, including a whole AI security section.
Registering with a work account. Microsoft strongly recommends a personal Microsoft account for exam registration, because records tied to an organizational account are lost if you leave the company.
Letting Microsoft certs lapse. AZ-104 and SC-200 renew every 12 months, and the renewal is a free online assessment on Microsoft Learn. Put a reminder on your calendar.
Collecting certs without labs. Interviewers for cloud security roles will ask what you've built. A small public repo of Bicep or Terraform with your hardened baseline is worth more than a fourth fundamentals badge.
Key takeaways
Security+ V8 (SY0-801) launches around November 17, 2026; V7 (SY0-701) stays valid in English until June 11, 2027.
After Security+, get hands-on Azure skills with AZ-104 before the security associates.
AZ-500 is retired. Its replacement is SC-500, the Cloud and AI Security Engineer Associate.
Choose SC-500 for engineering roles and SC-200 for SOC roles; CySA+ V4 is the vendor-neutral SOC option.
CCSK v5 is a no-prerequisite vendor-neutral credential, and it can cover one year of CCSP experience.
If you want to put the posture side of this into practice, my NIST CSF 2.0 to Azure mapping is a good companion to the SC-500 governance objectives.
Sources
Which cert are you working on next, and what's tripping you up? Drop a comment below. I read every one, and the best questions turn into future posts.