AZ-400 Exam Guide: Designing and Implementing Microsoft DevOps Solutions

If you are moving from traditional system administration, networking, cloud operations, or software development into DevOps, the Microsoft AZ-400 exam is one of the more practical certifications in the Azure ecosystem. It is not simply an exam about memorizing Azure product names. It asks whether you can design a delivery process that takes code from an idea to production in a controlled, repeatable, observable, and secure way.

That distinction matters. A good DevOps engineer is not just the person who writes a YAML file or clicks the “Run pipeline” button. The role sits between development, infrastructure, security, testing, and operations. You need to understand how source control affects releases, how identity affects automation, how deployment strategies affect risk, and how telemetry feeds information back into the engineering process.

This guide is written for students, junior engineers, network engineers, cloud beginners, and IT professionals who want a technically serious introduction to Exam AZ-400: Designing and Implementing Microsoft DevOps Solutions. It reflects the Microsoft exam objectives that became effective for the English-language exam on July 27, 2026.

AZ-400 at a Glance

Important: passing AZ-400 is a major requirement for the Microsoft Certified: DevOps Engineer Expert credential, but the Expert certification also requires you to hold either the Azure Administrator Associate or Azure Developer Associate certification.

What Is AZ-400 Really Testing?

The easiest way to misunderstand AZ-400 is to think of it as an “Azure Pipelines exam.” Azure Pipelines is important, but the scope is wider. Microsoft expects a DevOps engineer to connect people, process, source control, automation, security, delivery, monitoring, and feedback.

A useful mental model is:

Plan → Code → Build → Test → Secure → Package → Deploy → Observe → Learn → Improve

Every stage affects the next one. For example, a weak branching strategy creates release pain. Poor secret management turns a convenient pipeline into a security risk. A deployment without telemetry may succeed technically while still creating a production incident that nobody notices quickly.

The current AZ-400 exam blueprint therefore combines GitHub, Azure DevOps, Azure services, infrastructure as code, DevSecOps practices, and observability. Microsoft also explicitly expects candidates to have experience with both GitHub and Azure DevOps.

Is the AZ-400 Certification Worth It?

For the right career path, yes. But its value is strongest when the certification sits on top of real hands-on work.

The AZ-400 certification path is useful because it validates a set of engineering skills that appear repeatedly in modern cloud environments: Git workflows, automated builds, testing, release governance, infrastructure as code, secrets management, secure authentication, deployment strategies, monitoring, and continuous feedback. Those skills transfer beyond a single Microsoft product.

The certification is particularly relevant for people targeting roles such as:

• DevOps Engineer
• Azure Cloud Engineer
• Platform Engineer
• Site Reliability Engineer (SRE)
• Build and Release Engineer
• Cloud Automation Engineer
• Senior Developer with deployment responsibilities
• Infrastructure Engineer moving toward cloud-native operations

It can also be valuable for network engineers. Modern networking is increasingly automated and API-driven. Once your environment includes Azure, containers, Kubernetes, infrastructure as code, identity-based access, and automated deployments, the boundary between “network,” “system,” and “application delivery” becomes much less rigid.

What AZ-400 will not do is replace experience. A candidate who can explain blue-green deployment but has never built a pipeline will struggle both in the exam and in a real engineering team. Treat the certification as a structured framework for learning DevOps engineering, not as a shortcut around it.

Current AZ-400 Skills Measured

The 2026 exam objectives are divided into five major domains:

The weighting tells you where to spend your time. More than half of the exam can relate to build and release pipelines. If you are comfortable with Git but weak in CI/CD design, deployment patterns, pipeline agents, testing, artifacts, and infrastructure as code, that is the area to fix first.

1. Processes, Communication, and Traceability

DevOps is often introduced as a set of automation tools, but the first objective reminds you that DevOps is also a way of organizing engineering work.

You should understand how to connect work items, source code, builds, tests, releases, bugs, and production feedback. In practical terms, this may involve GitHub Issues, GitHub Projects, Azure Boards, repositories, pull requests, dashboards, webhooks, Microsoft Teams integration, release notes, Markdown documentation, and Mermaid diagrams.

For a beginner, the key concept is traceability. If a production deployment fails, can you identify:

• which work item requested the change,
• which commit implemented it,
• which pull request reviewed it,
• which build produced the artifact,
• which test results were associated with it, and
• which deployment introduced it?

That chain of evidence is useful for troubleshooting, auditing, security, and continuous improvement.

You should also be familiar with delivery metrics. Microsoft specifically calls out concepts such as cycle time, lead time, and time to recovery. It is also useful to understand DORA-style delivery metrics because they give you a practical way to discuss delivery throughput and instability instead of simply counting how many pipeline runs occurred.

2. Source Control Strategy

Git knowledge is essential for AZ-400, but the exam goes beyond basic commands such as git add, git commit, and git push.

You should be able to choose and defend a branching strategy. That includes understanding when to use:

• Trunk-based development for small, frequent integrations and fast delivery.
• Feature branches when changes need isolation before review and integration.
• Release branches when a product needs parallel release maintenance or controlled stabilization.

The exam also expects knowledge of pull request workflows, branch policies, branch protection rules, permissions, tags, large-file management, repository optimization, Git recovery, and removing sensitive or unwanted data from source control.

A strong candidate does not memorize “trunk-based is best.” Instead, the candidate asks what the organization needs. A small SaaS team shipping many times per day has different constraints from an enterprise maintaining several supported release versions.

3. Build and Release Pipelines: The Core of AZ-400

This is the most important section of the exam and should receive the largest share of your study time.

Azure Pipelines and GitHub Actions

You should know how to select between GitHub Actions and Azure Pipelines based on repository location, organizational standards, existing investments, security requirements, integrations, and operational constraints.

You should also understand hosted versus self-hosted execution. In Azure DevOps that means thinking about agents; in GitHub Actions it means runners. The exam can require architectural judgment around cost, networking, installed tools, security, licensing, connectivity, and maintenance.

YAML Matters

For AZ-400, you should be able to read and reason about YAML without feeling lost. You do not need to memorize every property, but you should understand the hierarchy of triggers, stages, jobs, steps, tasks, variables, templates, conditions, environments, approvals, and dependencies.

A simplified Azure Pipelines structure might look like this:

trigger:
  branches:
    include:
      - main

stages:
- stage: Build
  jobs:
  - job: BuildApp
    pool:
      vmImage: ubuntu-latest
    steps:
    - checkout: self
    - script: echo "Build application"
    - script: echo "Run tests"
    - publish: $(Build.ArtifactStagingDirectory)
      artifact: app

- stage: Deploy
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeployProduction
    environment: production
    strategy:
      runOnce:
        deploy:
          steps:
          - download: current
            artifact: app
          - script: echo "Deploy application"

The important exam skill is not typing this from memory. It is understanding why a pipeline is divided into stages, where approvals belong, how artifacts move between stages, how conditions work, and how you would make the pipeline reusable and secure.

Testing Strategy

CI/CD without automated testing is simply automated risk.

You should know how local tests, unit tests, integration tests, load tests, test agents, code coverage, quality gates, and release gates fit into a delivery system. Expect scenario-based decisions: where should a test run, what should block a deployment, and what should happen when a quality threshold fails?

Artifacts and Packages

AZ-400 also covers dependency and package management. Review Azure Artifacts, GitHub Packages, feeds, upstream sources, semantic versioning (SemVer), calendar versioning (CalVer), and version strategies for pipeline artifacts.

A useful distinction is that a package is normally a versioned dependency intended for reuse, while a pipeline artifact is typically an output produced by a pipeline and consumed later in the delivery process.

Deployment Strategies

Deployment questions are often where real-world reasoning becomes more important than memorization. Know the trade-offs among:

• Blue-green deployment
• Canary deployment
• Ring-based deployment
• Progressive exposure
• Rolling deployment
• Deployment slots and slot swaps
• Feature flags
• A/B testing
• Hotfix paths

For example, a canary deployment reduces risk by exposing a new version to a small portion of traffic before expanding it. A feature flag separates feature exposure from code deployment. Blue-green deployment provides two environments and allows traffic to be switched between them. These techniques solve related problems, but they are not interchangeable.

Infrastructure as Code

Infrastructure as code (IaC) is a major DevOps skill because it turns infrastructure configuration into something versioned, reviewed, tested, and repeatable.

For Azure-focused work, understand ARM concepts and Bicep. Also understand the role of broader IaC tools such as Terraform, even though the exam blueprint specifically highlights Azure Resource Manager, Bicep, Azure Automation State Configuration, Azure Machine Configuration, and Azure Deployment Environments.

Do not study IaC as “templates that create resources.” Study the lifecycle:

Define → Version → Review → Validate → Deploy → Detect drift → Update

That lifecycle is the DevOps value of IaC.

Pipeline Maintenance

Pipelines themselves are production systems and need maintenance. Microsoft expects you to understand pipeline health, duration, failures, flaky tests, concurrency, retention, reliability, and cost optimization. You should also understand the reasons for moving older Azure Pipelines implementations from Classic pipelines toward YAML-based pipelines.

4. Security and Compliance: DevSecOps, Not “Security at the End”

Security in modern DevOps should be built into the workflow rather than added after deployment. This is the core idea behind DevSecOps and “shift-left” security.

AZ-400 expects you to understand authentication and authorization across Azure DevOps, GitHub, and Azure. Important topics include:

• Microsoft Entra service principals
• System-assigned and user-assigned managed identities
• Azure DevOps service connections
• GitHub Apps
• GITHUB_TOKEN
• Personal access tokens (PATs)
• Permissions and security groups
• Least-privilege access

Prefer Short-Lived or Secretless Authentication Where Possible

One of the most important modern security ideas for CI/CD is to reduce dependence on long-lived secrets. Workload identity federation and OpenID Connect (OIDC) allow an automation platform to obtain short-lived credentials based on trusted identity claims rather than storing a permanent cloud secret in a repository or pipeline variable.

You still need to understand traditional secrets because real environments contain them. Azure Key Vault is central here. Know how pipelines retrieve secrets, how access is controlled, and why secrets should not be written to source code, YAML files, command-line arguments, or logs.

Automated Security Scanning

The current exam objectives include security and compliance scanning for:

• source code,
• dependencies,
• secrets,
• licenses,
• containers, and
• open-source vulnerabilities.

Review Microsoft Defender for Cloud DevOps Security, GitHub Advanced Security, CodeQL concepts, Dependabot alerts, secret scanning, dependency scanning, and container-image scanning.

From an exam perspective, always ask: How early can this problem be detected, and how can detection be automated without creating unnecessary friction?

5. Instrumentation, Monitoring, and Continuous Feedback

A deployment is not complete when the pipeline turns green. It is complete when you know the application and infrastructure are behaving as expected.

AZ-400 expects familiarity with Azure Monitor and related monitoring experiences, including Application Insights, VM Insights, Container Insights, storage monitoring, and network monitoring. You should also understand alerts from GitHub Actions and Azure Pipelines.

At the application level, learn the three basic observability signals:

• Metrics tell you what is changing numerically.
• Logs provide event and diagnostic detail.
• Traces show how a request moves across components.

Application Insights is especially relevant because it provides application performance monitoring and integrates with OpenTelemetry-based instrumentation.

You should also be able to work with basic Kusto Query Language (KQL). You do not need to become a KQL specialist for AZ-400, but you should be comfortable filtering, projecting, summarizing, and investigating telemetry.

requests
| where timestamp > ago(1h)
| summarize RequestCount = count(),
            AverageDuration = avg(duration)
          by resultCode
| order by RequestCount desc

The deeper DevOps lesson is that telemetry is not only for operations teams. Monitoring data should influence release decisions, incident response, capacity planning, reliability work, and future development priorities.

Technologies You Should Be Comfortable With

You do not need to be the world’s leading expert in every item below, but a serious AZ-400 candidate should be able to explain where each technology belongs in an end-to-end delivery architecture.

How Difficult Is AZ-400?

AZ-400 is an expert-level exam, and the difficulty comes from integration. A single question may combine source control, identity, pipelines, deployment strategy, and security.

A beginner often studies each service separately:

“This is Azure Key Vault. This is Azure Pipelines. This is GitHub Actions.”

The exam is more likely to ask:

“A pipeline must deploy to Azure without storing a long-lived secret, while access must be restricted to a specific repository and environment. Which authentication design should you use?”

That is a very different skill. You need to understand relationships and trade-offs.

Microsoft notes that successful candidates for its technical exams often invest substantial preparation time. Your personal requirement may be much lower or higher depending on your existing experience. If you are completely new to Git, Azure, and CI/CD, do not try to compress the entire journey into a weekend.

A Practical AZ-400 Study Plan

If you are building your own preparation roadmap, it can also help to keep a dedicated AZ-400 preparation resource alongside the official Microsoft study guide so that you can organize exam topics, technical concepts, and revision work around the same objective domains.

Week 1: Build the Foundation

Review Git, pull requests, branch strategies, basic Azure architecture, Microsoft Entra identity concepts, and the overall DevOps lifecycle. If you cannot explain the difference between authentication and authorization, or between a commit and a pull request, fix those gaps first.

Week 2: GitHub and Azure DevOps Workflows

Create a small project. Track work in GitHub Issues or Azure Boards. Create branches, pull requests, protections or policies, and link work to code changes. The goal is to understand workflow, not just menus.

Week 3: CI with YAML

Build both an Azure Pipeline and a GitHub Actions workflow. Trigger them from source control. Run tests. Publish an artifact. Add variables. Break the pipeline deliberately and learn to read the logs.

Week 4: CD and Infrastructure as Code

Add multiple stages and environments. Configure approvals or checks. Deploy to a non-production Azure environment. Practice Bicep or another IaC tool. Compare rolling, canary, blue-green, and feature-flag approaches.

Week 5: Security and Observability

Move secrets into Key Vault. Review managed identities, service principals, workload identity federation, OIDC, service connections, repository permissions, and security scanning. Add Azure Monitor or Application Insights telemetry and write basic KQL queries.

Week 6: Scenario Practice and Weak-Area Repair

Use Microsoft’s free Practice Assessment, review the official study guide line by line, and revisit any objective you cannot explain without notes. Focus especially on architecture decisions: why one solution fits the requirement better than another.

How to Build a Useful Home Lab

You do not need a huge enterprise environment. A small lab can cover a surprising amount of AZ-400.

1. Create a simple application or use a small sample repository.
2. Store the code in GitHub or Azure Repos.
3. Create a work item or issue and link it to a branch and pull request.
4. Create a YAML CI pipeline.
5. Run automated tests and publish an artifact.
6. Use Bicep to define a small Azure environment.
7. Create a staging and production deployment path.
8. Add an approval or environment check.
9. Store sensitive values in Azure Key Vault.
10. Replace a long-lived secret with federated or managed identity where the scenario supports it.
11. Enable monitoring and alerts.
12. Create a failure on purpose and trace it from commit to pipeline to telemetry.

That final step is particularly useful. Real DevOps competence grows quickly when you stop treating failure as something to avoid in the lab and start treating it as something to diagnose.

Exam Strategy

AZ-400 questions often contain more information than you need. Read the requirement before selecting the technology.

• Look for constraints. Is the repository in GitHub or Azure Repos? Is the workload private? Is there a compliance requirement? Are long-lived credentials prohibited?
• Prefer least privilege. More access is rarely the better architecture.
• Prefer automation and repeatability. Manual production steps are usually a warning sign unless an explicit approval is required.
• Understand secretless authentication. Managed identities and workload identity federation are increasingly important patterns.
• Know deployment trade-offs. Do not treat canary, blue-green, slots, rings, and feature flags as synonyms.
• Spend extra study time on pipelines. They represent 50–55% of the current blueprint.
• Practice troubleshooting. Read logs, inspect dependencies, understand conditions, and identify where a pipeline failed.

Microsoft currently allows access to Microsoft Learn during eligible associate and expert role-based exams. The exam timer continues while you browse, so this should be treated as a reference tool for targeted lookups, not as a substitute for preparation.

Common Mistakes When Preparing for AZ-400

1. Studying Only Azure DevOps

Current objectives include GitHub and Azure DevOps. If you know Azure Pipelines well but have never worked with GitHub Actions, branch protection, GitHub authentication, or GitHub Advanced Security concepts, you have a real gap.

2. Memorizing Services Without Building Anything

Watching videos creates familiarity, but familiarity is not the same as operational understanding. Build pipelines, break them, fix them, and compare designs.

3. Ignoring Identity

Modern DevOps is full of machine-to-machine authentication. Service principals, managed identities, OIDC, workload identity federation, tokens, and permissions are not side topics; they are core automation concepts.

4. Treating Security as a Separate Team’s Problem

AZ-400 expects DevSecOps thinking. Code scanning, secret scanning, dependency analysis, container scanning, and secure pipeline design belong inside the software delivery lifecycle.

5. Skipping Monitoring

Many candidates spend almost all their time on CI/CD and then lose easy points on Azure Monitor, Application Insights, alerts, telemetry, and KQL. The instrumentation domain is smaller, but it is still part of the exam.

Who Should Take AZ-400?

AZ-400 is a strong choice if you already have some Azure administration or development experience and want to move into automation, cloud delivery, platform engineering, or DevOps.

If you are completely new to cloud computing, start with foundational Azure concepts first. You will learn AZ-400 faster if virtual networks, resource groups, identities, subscriptions, storage, compute, and basic application deployment are already familiar.

For students, I would recommend treating AZ-400 as a project-based certification. Build something small and improve it every week. By the time you are ready for the exam, you should have a repository that demonstrates source control, CI, CD, IaC, secrets management, security checks, and monitoring. That portfolio may be as valuable in an interview as the certification badge itself.

Frequently Asked Questions

Is AZ-400 an expert-level exam?

Yes. It is the required exam for the Microsoft Certified: DevOps Engineer Expert certification path, combined with the required Associate-level prerequisite certification.

Do I need to know both GitHub Actions and Azure Pipelines?

Yes. The current Microsoft audience profile specifically expects experience implementing both GitHub and Azure DevOps solutions, and the exam objectives include both platforms.

What is the most important AZ-400 topic?

Build and release pipelines. The current objective weighting assigns 50–55% of the exam to this domain, including packages, testing, YAML pipelines, agents and runners, deployment strategies, infrastructure as code, and pipeline maintenance.

Does AZ-400 cover infrastructure as code?

Yes. You should understand IaC strategy, source control, automated validation and deployment, Bicep/ARM concepts, desired-state configuration, and Azure Deployment Environments.

Does AZ-400 include DevSecOps?

Yes. Security topics include identity, permissions, service connections, GitHub authentication, Azure Key Vault, secretless authentication, workload identity federation/OIDC, GitHub Advanced Security, Defender for Cloud DevOps Security, dependency scanning, secret scanning, and container scanning.

Is Microsoft Learn available during AZ-400?

Microsoft currently provides Microsoft Learn access during eligible associate and expert role-based certification exams. The timer keeps running, and some areas such as Q&A, Practice Assessments, and profile features are excluded. Always review Microsoft’s exam-experience page before your scheduled exam in case the policy changes.

How long should I study for AZ-400?

There is no universal answer. An engineer who already manages Azure Pipelines may need only focused review, while a student new to Git, Azure, CI/CD, and identity may need several months of regular practice. A six-week plan can work for candidates who already have basic Azure and Git skills, but hands-on competence matters more than a fixed calendar.

Final Thoughts

AZ-400 is one of Microsoft’s better certifications for learning how modern engineering systems fit together. It forces you to think beyond individual Azure resources and toward the whole delivery lifecycle.

If you prepare correctly, you should come out of the process able to answer questions such as:

• How should our team organize source control?
• How do we build and test every change consistently?
• How do we deploy with less risk?
• How do we avoid putting credentials in pipelines?
• How do we enforce security without stopping delivery?
• How do we define infrastructure in code?
• How do we know whether a release is actually healthy?

Those are not just certification questions. They are the everyday questions of a DevOps engineering team.

Use the official AZ-400 study guide as your source of truth, build a lab that covers the full delivery cycle, and spend most of your preparation time doing rather than watching. You can also use this AZ-400 Designing and Implementing Microsoft DevOps Solutions resource as an additional reference while organizing your preparation. If you can design the system, explain the trade-offs, and troubleshoot it when it fails, you will be preparing for more than an exam.

Official and Authoritative References

• Microsoft Learn – Exam AZ-400: Designing and Implementing Microsoft DevOps Solutions
• Microsoft Learn – AZ-400 Official Study Guide
• Microsoft Learn – Microsoft Certified: DevOps Engineer Expert
• Microsoft Learn – Azure Pipelines Documentation
• Microsoft Learn – Azure Pipelines YAML Schema Reference
• GitHub Docs – GitHub Actions
• GitHub Docs – OpenID Connect (OIDC) for GitHub Actions
• Microsoft Learn – Security in DevOps (DevSecOps)
• Microsoft Learn – Secrets in Azure Pipelines
• Microsoft Learn – Azure Monitor Overview
• Microsoft Learn – Application Insights and OpenTelemetry Overview
• DORA – Software Delivery Performance Metrics
• Microsoft Learn – Exam Duration and Exam Experience