Recently, I found myself thinking about certification exams again.
It had been several months since I last sat for a major certification exam, and while reviewing some of Microsoft’s newer AI certifications, I started asking myself a simple question: What should I take next?
That led me down a rabbit hole of reviewing Microsoft’s current certification catalog and mapping out a learning plan for the next year or two. Along the way, I realized just how much Microsoft’s certification ecosystem has changed, particularly in the areas of cybersecurity, cloud, automation, and artificial intelligence.
It also made me think about how many certification exams I have taken throughout my career.
For years, I would casually estimate the number at around fifty. After taking a closer look recently, I think that estimate was low. Between Microsoft, Cisco, CompTIA, CISSP, GIAC, insurance and financial services designations such as CPCU and ChFC, securities licensing exams, and various other certifications accumulated over the years, the real number is probably somewhere between 70 and 80 professionally proctored exams (if you include failed attempts).
Some were passed on the first attempt. Some were not. That’s simply part of the process.
One lesson I learned long ago is that certifications are not really about collecting credentials. They are about creating a structured learning path. The certification itself has value, but the knowledge gained along the way is usually far more important than the badge.
Three or four years ago, if someone had asked me to create a certification roadmap for cybersecurity professionals, artificial intelligence would barely have appeared on the list. Today, I believe that position would be difficult to defend.
Whether you work in a SOC, design security architectures, perform incident response, build automation, or lead security programs, AI is now a required skill. The professionals who understand AI will increasingly differentiate themselves from those who do not.
That does not mean every security practitioner needs to become a machine learning engineer. It does mean that understanding how AI systems work, how they are built, how they are secured, and how they can be used to improve security operations is becoming an important career skill.
Before diving in, it’s important to note that this roadmap is designed primarily for cybersecurity professionals working in Microsoft-focused environments. If you work in a multi-cloud environment or support a broader technology stack, this roadmap should be viewed as one component of a larger professional development strategy.
Start with the Fundamentals
Every Microsoft security professional should understand the platform they are protecting.
I generally recommend starting with:
- AZ-900: Azure Fundamentals
- SC-900: Security, Compliance, and Identity Fundamentals
- AI-900: Azure AI Fundamentals
These certifications establish a common vocabulary and foundational understanding that becomes useful throughout the rest of your certification journey.
Build Infrastructure Knowledge
My next recommendation is:
- AZ-104: Azure Administrator Associate
AZ-104 remains one of the most valuable certifications in the Azure ecosystem because it teaches networking, identity, storage, governance, subscriptions, virtual machines, and operational management.
Even if you never intend to become an Azure administrator, understanding these concepts will make you a better security professional.
For professionals supporting hybrid environments, the Windows Server Hybrid Administrator certifications are also worth consideration.
Establish Core Security Expertise
Once the fundamentals are in place, I would focus on Microsoft’s security certifications.
Recommended progression:
- SC-300: Identity and Access Administrator Associate
- SC-200: Security Operations Analyst Associate
- AZ-500: Azure Security Engineer Associate
- SC-100: Cybersecurity Architect Expert
Together these certifications cover identity, threat detection, incident response, cloud security, governance, Zero Trust architecture, and enterprise security design.
Of these, SC-100 is probably the certification I recommend most frequently to experienced security professionals. It focuses less on products and more on security architecture and strategy.
Add AI Skills Early
This is where my recommendations differ from what I might have suggested a few years ago.
Today I believe every cybersecurity professional should strongly consider:
- AI-900: Azure AI Fundamentals
- AI-102: Azure AI Engineer Associate
Even if you never plan to become a full-time AI engineer, understanding concepts such as prompt engineering, retrieval-augmented generation (RAG), vector databases, agents, model selection, and responsible AI will become increasingly important.
The future security architect will need to understand both security and AI.
Learn Automation and Development
This is where professionals can begin to distinguish themselves from their peers.
Two certifications stand out:
- GitHub Copilot Certification
- PL-900: Power Platform Fundamentals
Some readers may be surprised to see these certifications ranked so highly.
GitHub Copilot is not simply a coding certification. It teaches AI-assisted development, prompt refinement, productivity techniques, and modern software development workflows. As AI-assisted coding becomes commonplace, these skills will become increasingly valuable.
Similarly, Power Platform may not appear to be a security certification at first glance. However, many of the concepts closely align with Logic Apps, workflow automation, orchestration, low-code development, and deterministic process design.
For professionals interested in SOAR, security automation, AI-driven workflows, and custom security solutions, Power Platform knowledge can be extremely useful.
Optional Specializations
Depending on your interests, additional certifications may be worth pursuing.
For professionals interested in development:
- AZ-204: Azure Developer Associate
For professionals interested in AI engineering:
- AI application development certifications
- AI cloud development certifications
- MLOps certifications
For professionals interested in emerging AI architecture and governance:
- Agent administration certifications
- AI business solution architect certifications
These certifications may fall outside the scope of a traditional security role today, but they are worth monitoring because they provide insight into where Microsoft and the broader industry are heading.
Certification Costs and Budgeting
Certification costs can add up quickly.
Fortunately, many employers reimburse certification expenses or provide annual training budgets. Veterans may have access to discounts and educational benefits, and Microsoft frequently offers discounts, challenges, promotions, and free exam opportunities throughout the year.
One recommendation I often make is to budget for retakes.
Failing an exam occasionally is normal. In fact, if you are challenging yourself with increasingly difficult certifications, you should expect it from time to time.
The good news is that training has never been more accessible. Between Microsoft Learn, YouTube, community content, official documentation, and AI-powered study assistance, most candidates can prepare for certification exams at little or no cost.
A Few Certification Tips and Tricks
A few lessons stand out from years of certification testing:
- Schedule the exam early. Having a date on the calendar creates accountability and provides a target to work toward.
- It’s okay to fail. Every attempt provides feedback and helps identify knowledge gaps. Failure is part of the learning process.
- Budget for retakes. If you pursue enough challenging certifications, you will eventually fail some exams. Plan for it financially and mentally. I generally recommend expecting a 30 to 40 percent retake rate over the course of a long certification journey.
- Learn how to take exams. Technical knowledge matters, but so do time management, answer elimination, question interpretation, and test-taking strategy.
- Use AI as a study partner. AI can help create study plans, generate practice questions, explain concepts, identify weak areas, and test your understanding.
- Trust your instincts. One of the most common mistakes test takers make is changing a correct answer after second-guessing themselves.
- Pace yourself. Certifications are a marathon, not a sprint. Unless you are early in your career and trying to land your first role, there is usually little value in earning a large number of certifications in a single year. I generally recommend treating certifications as part of a long-term learning strategy and pursuing them at a sustainable pace, perhaps one every quarter.
At some point in your career, you may discover that you no longer list every certification on your résumé, business card, or LinkedIn profile. Instead, you highlight the certifications that are most relevant, most recent, or most impactful. That’s perfectly normal. The value comes from the knowledge gained along the way, not from maintaining an ever-growing list of acronyms after your name.
Beyond Microsoft
While this article focuses on Microsoft certifications for security professionals working in Microsoft-centric environments, certifications should not stop there.
As your career progresses, consider expanding into other technology ecosystems and industry-recognized certification programs. AWS and Google Cloud offer strong cloud certification tracks. Organizations such as ISC2, SANS, CompTIA, ISACA, and EC-Council provide respected cybersecurity certifications covering architecture, operations, governance, penetration testing, and incident response.
I also expect to see increasing numbers of certifications emerge from leading AI providers over the next several years. As AI continues to reshape the technology landscape, professionals who combine security expertise with AI knowledge will be particularly well-positioned.
Final Thoughts
Certifications remain one of the best ways to create structure around continuous learning, but they should never become the goal themselves.
Twenty years ago, a security professional could build an excellent career on infrastructure, networking, and security knowledge alone. Today, the most effective professionals increasingly combine security, cloud, automation, development, and AI.
The most successful professionals I know focus on building skills first and collecting certifications second. Use certifications to guide your learning, stay current with emerging technologies, and challenge yourself to keep growing.
If you do that consistently, the credentials will take care of themselves.