At the end of July 2026, Microsoft moves all four Security Specializations (Cloud Security, Data Security, Identity & Access, Threat Protection) to a paid, third-party audit model, replacing customer references.

Until now, partners qualified for Microsoft's Security Specializations by citing customer references; from end of July an independent auditor tests them hands-on in a real environment every two years, and the partner foots the bill. For an SMB choosing a Microsoft security or M365 partner, the specialization badge now means something closer to a real skills exam than a marketing claim, so it becomes a genuine filter rather than a checkbox. If your current IT partner drops a specialization after this change, that is worth asking about directly.