AI-500
Multi-Agent AI Solutions Expert
A free, card-by-card guide to the AI-500 exam. Over half of it sits after the design is decided — building in Azure is 30–35% and evaluating, optimising and monitoring is another 20–25% — so the cards are weighted to match rather than split evenly by topic. Built from Microsoft Learn and re-checked against it in August 2026. The exam is currently in beta.
40 cards · 40 written up so far · free, no sign-up · leads to Microsoft Certified: Multi-Agent AI Solutions Expert
Architect
Card 01Decompose the goal: workflow, agent, tool
The order to try things in, the only three reasons a step earns its own agent, and why the more sophisticated design is usually the marked-wrong answer.
Card 02Specify an agent: persona, scope, boundary, autonomy
What each of the four actually controls, and the rule the whole exam leans on — constrain tools, not instructions.
Card 03The build shapes on Foundry, and how to choose
Prompt agent, hosted agent, Responses API and A2A — picked by what the scenario constrains, not by how complex the task sounds. Also where the LangGraph argument resolves.
Card 04MCP or A2A: which protocol, and why
One line separates them: MCP reaches a capability, A2A reaches an agent. Plus toolboxes, project-connection auth, background mode and private endpoints.
Card 05Memory: the three tiers, and what breaks in each
Session, shared team and long-term semantic memory, the four context verbs, and why memory is a security surface rather than a quality one.
Card 06Zero Trust for agents
Per-agent identity, lateral movement and compliance mapping — and why inbound private endpoints only solve half the problem.
Card 07Observability and monitoring components
Two different lists that get confused. Observability answers can I see inside it; monitoring answers is it still good.
Develop
Card 08Prompt engineering, and prompt lifecycle
The four named techniques, why the prompt is a deployable artefact, and why a defensive guideline is never the answer to a must-never requirement.
Card 09Context management: the four verbs
Accumulation, retrieval, injection, compaction — plus the desk, the filing cabinet and the tick-list, and the rule about what to pass across an agent boundary.
Card 10Diagnosing the four context window failures
Sliding-window amnesia, summary drift, vector-only recall and entity continuity — told by symptom, because from the outside all four look identical.
Card 11RAG: the levers, in the order to pull them
Filter, hybrid, rerank, then k. Which symptom names which lever, and why most RAG failures are metadata failures.
Card 12Azure AI Search: the vector mechanics
HNSW versus exhaustive KNN and the asymmetry between them, which parameters are index-time, why hybrid scoring is rank fusion, and the score that is not what it looks like.
Card 13Knowledge routing: copy or query
What copying buys you and what it costs, and the single most common way an agent quietly becomes an entitlement bypass.
Card 14Tools: integration, failure and validation
Four kinds of tool failure with four different answers, and why a tool result is untrusted input arriving after your input filter has run.
Card 15Building MCP servers on Azure
Functions, Logic Apps or API Management — chosen by what you already have. Plus why MCP is a tool protocol and not a security boundary.
Card 16Orchestration: two vocabularies, one decision
The syllabus and Agent Framework name the same five patterns differently. Answer by shape — and know the constraint that eliminates Group Chat outright.
Card 17Human-in-the-loop
Approval, override and edge cases — and why reversibility, not confidence, decides where the gate goes.
Card 18Caching: three kinds, three risks
Prompt caching is nearly free. Semantic caching saves the most and is the likeliest wrong answer — similar is not the same.
Card 19The frameworks, and what the exam expects
Agent Framework as the successor to Semantic Kernel and AutoGen, the four primary areas including the Harness Agent, and the language parity gap.
Card 20Middleware: reusable capability across agents
Logging, authorization and exception handling in one place — and the four points where middleware can intervene.
Evaluate
Card 21The evaluator families, and what each measures
Four families, and only one measures whether the job got done. Plus the four components the syllabus asks you to evaluate — note that answer quality is not one of them.
Card 22The eleven agent evaluators
System evaluation versus process evaluation, what each of the tool evaluators distinctly catches, and the tools they do not work with.
Card 23The evaluation set and human review
Three properties that matter more than size, why you sample the disagreement set rather than sampling randomly, and what turns a dashboard into a gate.
Card 24Drift and quality regression
Why live traffic cannot see drift, and why the only instrument that works has to have been running before the problem started.
Card 25Continuous improvement: the four loops
LLM-as-a-judge, synthetic data, semantic optimisation and user feedback — ranked by what each actually tells you.
Monitor
Card 26Tracing: where the data lives and how to query it
Traces land in Application Insights and you query them with KQL. The span attributes that matter, and the one decision that makes tokens-per-outcome computable at all.
Card 27The agentic monitoring signals
Loop count, tool-call failure, escalation and refusal rates — and the single metric that catches almost everything.
Optimize
Card 28Token and cost engineering
Where multi-agent cost actually comes from, the ladder to work in order, and why max iterations and max depth together are still not enough.
Card 29Cost management: what a budget can and cannot do
A budget alerts; it does not stop spend — and it evaluates once a day against day-old data. An agent in a loop outruns it completely.
Secure
Card 30Identity-based access and network boundaries
Why a dedicated agent identity is what makes the whole security domain possible, and why outbound is where the data actually leaves.
Card 31The five Foundry roles
The permission ladder including the least-privilege role most people miss, the rename that changed nothing underneath, and two roles named to look right that are wrong.
Card 32Agent-scope role assignments
Foundry has three scopes, not two — and the third is evaluated for exactly one thing, which is as testable as the capability itself.
Card 33Authentication flows: who does the call run as?
Two of the four preserve entitlement and two dissolve it. When an API key is genuinely correct, and when it is a bypass that works perfectly in testing.
Card 34Key Vault: two planes, and the role that misleads
Key Vault Contributor grants no access to secrets. The data-plane roles that do, and the escalation path Microsoft documents in its own words.
Card 35Rotation, certificates and encryption
Why long-running agents are unusually prone to breaking on rotation, and the rule about what must never reach a prompt or a tool result.
Govern
Card 36Guardrails: four interventions, five layers
Inputs, tool calls, tool responses and outputs — and why the forgotten one is where prompt injection actually arrives.
Card 37The AI Red Teaming Agent
PyRIT plus Foundry safety evaluations, the Attack Success Rate as a release-board number, and why zero ASR is not automatically good news.
