AZ-400 Exam: Complete Microsoft DevOps Solutions Guide
Current AZ-400 exam guide covering the $165 USD price, skills measured, certification prerequisites, GitHub, Azure DevOps, pipelines, and security.
AZ-400 exam at a glance
| Detail | Information |
|---|---|
| Exam name | Designing and Implementing Microsoft DevOps Solutions |
| Exam code | AZ-400 |
| Certification earned | Microsoft Certified: DevOps Engineer Expert |
| Cost | $165 |
| Duration | not described |
| Questions | Typically 40–60; Microsoft does not publish a fixed count |
| Passing score | 700 / 1000 (scaled) |
| Format | Proctored; may include interactive components or labs |
| Delivery | Test center or online proctored |
| Prerequisites | For the expert certification: Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) |
| Validity | 1 year |
| Renewal | Annual, free online assessment |
Domain breakdown
| Domain | Weight |
|---|---|
| Design and implement processes and communications | 10–15% |
| Design and implement a source control strategy | 10–15% |
| Design and implement build and release pipelines | 50–55% |
| Develop a security and compliance plan | 10–15% |
| Implement an instrumentation strategy | 5–10% |
Who should take the AZ-400 exam?
AZ-400 is for developers and infrastructure administrators moving into a DevOps engineering role. Strong candidates already deliver systems through automated build, test, security, deployment, monitoring, and feedback loops. They work across development, site reliability, Azure administration, and security rather than treating a pipeline as an isolated script.
Microsoft expects experience both administering and developing in Azure, with depth in at least one area. The current blueprint also expects hands-on work with both GitHub and Azure DevOps. If you have only used one platform, deliberately implement equivalent workflows in the other before attempting the exam.
There is no prerequisite to sit AZ-400. Earning the Microsoft Certified: DevOps Engineer Expert credential is different: you must also hold either Azure Administrator Associate or Azure Developer Associate. Plan the certification path around your experience instead of treating the prerequisite as a paperwork step.
Skills measured on AZ-400
Microsoft's official AZ-400 study guide lists five domains as of July 27, 2026. Build and release pipelines dominate at 50–55%, but the remaining domains supply the source, security, collaboration, and feedback controls that make those pipelines production-ready.
Design and implement processes and communications (10–15%)
You must design a traceable flow of work using GitHub Flow, GitHub Issues, GitHub Projects, Azure Boards, and repositories. Connect source changes, bugs, tests, quality evidence, and releases so a team can follow a requirement into production and feed results back into the backlog.
Metrics include cycle time, lead time, time to recovery, and measures for planning, development, testing, security, delivery, and operations. Know what each metric reveals and avoid dashboards that reward activity rather than outcomes. Communication objectives cover wikis, Markdown, Mermaid diagrams, release notes, API documentation, Git-based automation, webhooks, Boards-to-GitHub integration, and Teams integration.
Design and implement a source control strategy (10–15%)
Compare trunk-based development with feature and release branches, then implement pull request workflows through branch policies and protection rules. A strong strategy balances review, automated checks, release needs, hotfixes, and developer feedback speed rather than maximizing the number of branches.
Repository operations include permissions, tags, large files with Git LFS or git-fat, repository optimization with Scalar, and cross-repository sharing. Practice recovering specific data and removing sensitive material from history. Deleting a file in a new commit does not remove it from earlier commits.
Design and implement build and release pipelines (50–55%)
Package management covers GitHub Packages, Azure Artifacts, feeds, views, upstream sources, semantic versioning, calendar versioning, and artifact versioning. Testing covers local, unit, integration, and load tests plus code coverage, quality gates, release gates, test agents, and published results.
For pipelines, compare GitHub Actions and Azure Pipelines, hosted and self-hosted runners or agents, and integration between GitHub repositories and Azure Pipelines. Be comfortable writing YAML, triggers, multi-stage dependencies, parallel jobs, templates, variables, variable groups, task groups, environments, checks, and approvals. Understand the security, connectivity, licensing, maintenance, cost, and performance consequences of agent design.
Deployment strategies include blue-green, canary, rings, progressive exposure, A/B testing, feature flags, rolling deployments, load balancing, and deployment-slot swaps. Know how to order dependent deployments, include database changes, manage hotfixes, protect sensitive files, prevent secret leakage, and recover when a deployment fails.
Infrastructure as code is part of the same delivery system. Design source control, tests, deployment, configuration management, desired state, ARM or Bicep usage, Azure Machine Configuration, and Azure Deployment Environments. Finally, monitor pipeline failure rate, duration, flaky tests, concurrency, cost, artifact retention, and classic-to-YAML migration.
Develop a security and compliance plan (10–15%)
Authentication and authorization objectives span Microsoft Entra service principals, managed identities, GitHub Apps, GITHUB_TOKEN, personal access tokens, Azure DevOps service connections, roles, groups, teams, and access levels. Prefer short-lived or federated identity where supported and grant the narrowest permissions needed.
Sensitive information belongs in controlled systems such as Azure Key Vault, secure files, or protected pipeline stores—not repositories or logs. Implement workload identity federation or OpenID Connect for secretless access when appropriate. Know how masking can fail and design pipelines so secrets never enter normal output.
Automated scanning covers code, dependencies, secrets, licenses, containers, and policy. The blueprint names Defender for Cloud DevOps Security, GitHub Advanced Security for GitHub and Azure DevOps, CodeQL, container analysis, and Dependabot. Integrate findings into the developer workflow instead of leaving them in a disconnected security dashboard.
Implement an instrumentation strategy (5–10%)
Configure Azure Monitor, Azure Monitor Logs, Application Insights, VM Insights, Container Insights, and monitoring for storage and networks. Connect alerts to GitHub Actions and Azure Pipelines and use GitHub insights and charts where appropriate.
Analysis includes CPU, memory, disk, network, usage, application performance, and distributed traces. Practice basic KQL queries over collected logs. Instrumentation is not just an operations concern: release health should determine whether deployment continues, pauses, or rolls back.
How to prepare for AZ-400
Build a production-style delivery path twice: once with GitHub Actions and once with Azure Pipelines. Include a compiled or containerized application, unit and integration tests, code coverage, Bicep infrastructure, an environment approval, federated authentication, Key Vault, a staged deployment, and Application Insights telemetry.
Add failure scenarios. Break a test, expose a vulnerable dependency in a safe sample, deny an identity, fail a deployment, and trigger a health regression. Diagnose the evidence and make the pipeline fail safely. This creates the judgment required for scenario questions.
Spend at least half your preparation on pipelines, matching the official weighting. Then cover Git operations, permissions, security tools, traceability, and KQL. A six- to eight-week plan is realistic for experienced Azure practitioners; allow longer if either GitHub or Azure DevOps is new.
AZ-400 practice questions
Use Microsoft's free Practice Assessment from the AZ-400 exam page to identify weak areas. For every scenario, state the constraint, choose the simplest solution that meets it, and explain why the alternatives fail on security, reliability, maintainability, cost, or delivery speed.
Use only objective-aligned practice material. Brain dumps and claims of live exam questions violate exam integrity and do not teach you to design or troubleshoot a delivery system.
Is AZ-400 worth it?
AZ-400 is valuable for engineers who own Azure delivery platforms or need to demonstrate depth across GitHub and Azure DevOps. The expert credential is strongest when paired with evidence such as reusable pipeline templates, secure identity patterns, deployment designs, and monitoring dashboards. It is less useful if your work does not involve Azure or Microsoft's DevOps ecosystem.
Exam-day notes
- Confirm the exact assessment and seat time shown during registration; Microsoft can vary timing when labs or other interactive components are included.
- Microsoft does not publish a fixed question count or guarantee particular question types.
- A scaled score of 700 or higher passes; it is not equivalent to 70% correct.
- Microsoft Learn may be available during the expert exam, but the timer continues.
- Schedule with a personal Microsoft account so your exam record remains portable.
AZ-400 FAQ
Is the AZ-400 exam hard?
Yes. AZ-400 is an expert-level exam that expects production experience across Azure, GitHub, Azure DevOps, source control, CI/CD, infrastructure as code, security, and monitoring. More than half of the blueprint can focus on build and release pipelines, so conceptual knowledge without implementation practice is usually insufficient.
What are the prerequisites for AZ-400?
You can take AZ-400 without first passing another exam. To earn the DevOps Engineer Expert certification, however, Microsoft requires the Azure Administrator Associate certification or the Azure Developer Associate certification in addition to AZ-400.
Should I take AZ-104 or AZ-204 before AZ-400?
Choose AZ-104 if your background and target work emphasize infrastructure, operations, identity, networking, and administration. Choose AZ-204 if you primarily build and deploy applications. Either credential satisfies the expert certification prerequisite, and AZ-400 expects awareness of both perspectives.
Does AZ-400 test both GitHub and Azure DevOps?
Yes. Microsoft's current audience profile says candidates should have experience implementing both GitHub and Azure DevOps solutions. The objectives explicitly name GitHub Actions, Azure Pipelines, GitHub repositories, Azure Boards, authentication, runners, agents, security products, and integrations between the platforms.
Does the DevOps Engineer Expert certification expire?
Yes. The certification is valid for one year and can be renewed during the six-month eligibility window by passing Microsoft's free, unproctored online renewal assessment before the expiration date.
Can I retake AZ-400 if I fail?
Yes. Microsoft requires a 24-hour wait after the first failed attempt and a 14-day wait after later failures, with no more than five attempts in a 12-month period. Retakes require payment unless a separate offer applies.
Prep resources
| Resource | Type | Provider |
|---|---|---|
| AZ-400 exam page official | Official guide | Microsoft Learn |
| Official AZ-400 study guide and skills measured official | Official guide | Microsoft Learn |
| DevOps Engineer Expert certification requirements official | Official guide | Microsoft Learn |
| Design and Implement Microsoft DevOps Solutions (AZ-400T00) official | Course | Microsoft Learn |