Ultimate 2026 guide to Microsoft DevOps Engineer Expert (AZ‑400) Guide

Published: February 6, 2026 | 5 min read

If you’re aiming to level up your cloud engineering or development career, the Microsoft Certified: DevOps Engineer Expert certification is one of the most respected ways to prove you can build secure, reliable, and scalable delivery pipelines on Azure using both GitHub and Azure DevOps. In this guide, we’ll walk through everything you need to know—from prerequisites and exam scope to a practical study plan, real-world lab ideas, exam-day tips, and how to renew—so you can earn the badge with confidence and turn it into career momentum.

As of this writing, the certification is earned by passing one exam, AZ‑400: Designing and Implementing Microsoft DevOps Solutions, and the English exam content was most recently refreshed in mid‑2024. You’ll also need one prerequisite certification (AZ‑104 or AZ‑204) to be awarded the credential.

Let’s get you ready—step by step.

What is the Microsoft Certified: DevOps Engineer Expert?

The Microsoft Certified: DevOps Engineer Expert recognizes professionals who can design and implement end-to-end DevOps practices on Azure. That means you can unify people, processes, and technology to optimize flow from planning and source control through CI/CD, security automation, and observability—on real, production-grade systems. You’ll work across both GitHub and Azure DevOps, understand branching and PR policies, build YAML pipelines, secure secrets, use Infrastructure as Code (IaC), and instrument applications with telemetry for continuous improvement.

Actionable takeaway:

Put “both ecosystems” at the center of your prep. Build the same pipeline twice: once with GitHub Actions and once with Azure Pipelines. This dual fluency is core to AZ‑400 and extremely attractive to hiring managers.

Who should pursue this certification?

This certification is ideal for:

Azure administrators or developers who want to lead or modernize delivery pipelines.
DevOps engineers, SREs, and platform engineers building developer platforms on Azure.
Team leads and architects standardizing CI/CD, IaC, and DevSecOps practices across multiple teams.

Microsoft recommends you have experience administering and/or developing on Azure and hands-on familiarity with both Azure DevOps and GitHub. This matches the exam’s cross‑platform emphasis.

Actionable takeaway:

If you’re transitioning from pure development or operations, schedule two “lab weeks” to set up both an Azure DevOps project and a GitHub repository, and wire each to Azure for build, test, and deploy.

Prerequisites and eligibility

To be awarded the DevOps Engineer Expert certification, you must already hold at least one of:

Azure Administrator Associate (AZ‑104)
Azure Developer Associate (AZ‑204)

You can sit AZ‑400 first if you like, but Microsoft requires you to hold one of those associate certifications for the expert badge to be conferred. Many candidates find that the admin or developer associate background makes AZ‑400’s cloud and pipeline topics much smoother.

Actionable takeaway:

Choose the prerequisite that fits your background:
- If you manage Azure resources, identities, and networks, do AZ‑104 first.
- If you write and ship apps on Azure (APIs, functions, containers), do AZ‑204 first.

Exam AZ‑400: structure, content, and what’s changed

The exam is AZ‑400: Designing and Implementing Microsoft DevOps Solutions. It tests five domains with the following weightings:

Design and implement processes and communications (10–15%)
Design and implement a source control strategy (10–15%)
Design and implement build and release pipelines (50–55%)
Develop a security and compliance plan (10–15%)
Implement an instrumentation strategy (5–10%)

What “good” looks like (based on the official study guide):

Processes and communications: Connect work tracking (Boards/Projects) to repos and pipelines, and visualize flow (lead time, MTTR, deployment frequency). Encourage team collaboration policies and metrics-informed retrospectives.
Source control: Choose trunk/release/feature branch models; enforce PR requirements, code owners, reviews, approvals, and commit policies; scale repos (including monorepos), LFS, and permissions.
Build and release pipelines: Author YAML-first pipelines; compose reusable templates; set up approvals and environments; manage self-hosted runners/agents; publish and consume artifacts; implement test strategies and quality gates; adopt blue/green, canary, or ring-based deployment; enable feature flags and safe rollbacks; incorporate IaC (ARM/Bicep) and configuration management; optimize for cost and concurrency.
Security and compliance: Manage identities and service connections; centralize secrets (Azure Key Vault) and pipeline secrets; automate SAST/SCA/secret scanning and compliance checks; integrate GitHub Advanced Security and Microsoft Defender for Cloud DevOps Security.
Instrumentation: Wire up Azure Monitor and Application Insights; add alerts; use KQL for basic troubleshooting and trend analysis.

Actionable takeaway:

Use the study guide as your single source of truth. Convert each bullet into a hands-on task in your personal lab and check it off only after you’ve implemented it at least once.

Exam format: timing, question types, languages, and scoring

Microsoft typically presents about 40–60 questions on role-based exams. Exam time is usually about 100 minutes (120 minutes seat time); if labs are included, plan for ~120 minutes exam time (140 minutes seat time). Labs, when present, generally appear at the end. The official passing score is 700 on a 1–1000 scale. The exam and certification are offered in multiple languages including English, Japanese, Simplified Chinese, Korean, German, French, Spanish, Portuguese (Brazil), Traditional Chinese, and Italian.

Question types commonly include multiple response, case studies, drag‑and‑drop, and sometimes hands-on labs in the actual cloud environment. To get comfortable, practice in Microsoft’s free “exam sandbox” to experience the interface and question styles ahead of time.

Actionable takeaway:

Treat labs as likely. Practice logging into Azure, working with Azure DevOps/GitHub, and completing tasks under time pressure. Build muscle memory with the UI and CLI you’d use in real work.

A practical 8‑week study blueprint

This plan assumes you’ve already earned AZ‑104 or AZ‑204 (or have equivalent experience). Adjust pacing as needed.

Week 1 — Scope and setup

Read the official AZ‑400 study guide end-to-end; list every skill bullet.
Create both a GitHub repo and an Azure DevOps organization/project. Wire each repo to a sample app (API, web app, or container).
Connect work items (GitHub Projects or Azure Boards) to commits and PRs.
Deliverable: A personal “AZ‑400 Lab” repository and Azure DevOps project with initial issues/backlog.

Week 2 — Source control at scale

Design a branching strategy (trunk or release branches + short-lived features).
Enforce PR policies: required reviewers, code owners, status checks, build validations, and security scanning checks.
Explore monorepo considerations (directory structure, pipeline path filters).
Deliverable: Documented branching and PR policy; a protected main branch with required checks.

Week 3 — CI foundations in both ecosystems

Author an equivalent CI pipeline in GitHub Actions and Azure Pipelines using YAML.
Add caching, parallel jobs, and matrix builds; publish artifacts.
Encapsulate common steps into reusable templates/workflows.
Deliverable: Two CI pipelines (Actions + Pipelines) that build the same app, with at least one reusable template each.

Week 4 — Release strategies and environments

Add multi-stage pipelines with approvals and environments.
Implement canary or ring-based deployment; practice blue/green with swap/rollback.
Introduce feature flags (e.g., Azure App Configuration) to decouple deploy from release.
Deliverable: A multi-stage YAML pipeline with approvals; documented release strategy and rollback steps.

Week 5 — IaC and configuration management

Provision infrastructure using Bicep/ARM from your pipelines; enforce desired state where relevant.
Parameterize environments; ensure idempotent deployments; reuse modules.
Optimize pipeline concurrency and agent/runners for speed and cost.
Deliverable: A pipeline that provisions infra then deploys app code. Include a README on idempotency and rollback.

Week 6 — DevSecOps guardrails

Integrate Azure Key Vault and pipeline secret stores; rotate secrets.
Enable code, dependency, and secret scanning (e.g., GHAS code scanning, Dependabot; Defender for Cloud DevOps Security recommendations).
Gate releases on security and compliance checks.
Deliverable: Security‑gated pipelines and a dashboard highlighting outstanding security findings.

Week 7 — Observability and continuous improvement

Add Application Insights and Azure Monitor logging; define SLIs/SLOs with your team.
Configure alerts for deployment failures and performance regressions.
Use basic KQL to investigate trends and link findings to work items for improvement.
Deliverable: Dashboards for release health (lead time, failure rate, MTTR, deployment frequency) and a sample KQL workbook.

Week 8 — Readiness, practice, and booking

Take Microsoft’s free Practice Assessment; analyze weak areas by domain.
Watch Exam Readiness Zone episodes aligned to the skill domains.
Practice in the Exam Sandbox to reduce test-day friction.
Book the exam and block revision time with 2–3 focused review sprints.

Actionable takeaway:

Keep a “lab diary.” After each week, write down what worked, what broke, and how you fixed it. This reflection cements learning and mirrors the exam’s scenario-style thinking.

Hands-on labs that mirror exam scenarios

Lab 1 — Two pipelines, one app

Build and test the same app in both GitHub Actions and Azure Pipelines.
Add caching and matrix builds; publish artifacts; enforce code coverage.
Why it matters: Demonstrates cross‑tool fluency, YAML reuse, and CI performance optimization.

Lab 2 — Progressive delivery with safe rollback

Implement canary or ring‑based release in a multi‑stage pipeline; add approvals for environment promotion; include an automated rollback task.
Why it matters: These release strategies are explicitly measured and crucial for reliability.

Lab 3 — IaC + app deployment

Provision Azure infrastructure using Bicep/ARM in a pipeline; deploy the latest build; tear down and reprovision to test idempotency.
Why it matters: IaC and environment management are core AZ‑400 topics.

Lab 4 — DevSecOps guardrails

Store secrets in Key Vault and pipeline secret stores; configure SAST/SCA and secret scanning; fail a release when critical findings are present.
Why it matters: Security and compliance gates are central to modern pipelines.

Lab 5 — Full-stack observability

Add Application Insights; create alerts for error spikes and slow dependencies; use KQL to diagnose a simulated incident; link findings to a backlog item.
Why it matters: Instrumentation and continuous improvement close the DevOps loop.

Actionable takeaway:

Record and publish your labs (repo + screenshots + README). A polished GitHub or Azure DevOps portfolio multiplies the career impact of your certification.

Cost, scheduling, retakes, and renewal

Pricing: Exam fees vary by country and are shown during scheduling (taxes may apply). Watch for student pricing and seasonal promotions.
Scheduling: Book through Pearson VUE from the exam page. You can typically schedule up to 90 days in advance and keep at most two Microsoft certification exams scheduled at any time. Choose a test center or online proctored delivery.
Retake policy: If you don’t pass, wait 24 hours before your second attempt. After that, you must wait 14 days between attempts, up to five attempts in 12 months. Each attempt is paid unless you’ve purchased a retake offer.
Renewal: Role-based certifications expire annually, but renewal is free via an online assessment available during the 6‑month window before your expiry date. Complete it to extend for another year.

Actionable takeaway:

Set calendar reminders for: 1) scheduling your exam, 2) retake window if needed, and 3) renewal window (start 5 months before expiry).

Career value and ROI

Why this certification moves the needle:

Demonstrated impact: Large-scale research from Pearson VUE shows 63% of certified candidates received or expected a promotion and 32% received a raise; organizations also reported improved work quality and productivity from certified staff. For learners, confidence and mobility increased notably.
Hiring signals: Leaders increasingly want platform-minded engineers who can standardize CI/CD patterns, enforce policy-as-code and security gates, and run multi-team delivery platforms. AZ‑400’s cross‑tool coverage (GitHub + Azure DevOps) speaks to exactly that.

How to maximize your return:

Pair the certification with a portfolio of live pipeline projects showcasing release strategies, IaC, and guardrails.
Tie your projects to DORA metrics and show real improvements (e.g., reduced lead time, fewer failed deployments).
Align the cert with your company’s goals (e.g., platform engineering, cloud cost optimization, DevSecOps) and propose a roadmap.

Actionable takeaway:

Add “before/after” metrics to your resume bullet points: “Cut build time 45% by caching and matrix builds; reduced change failure rate by adding automated quality gates and staged rollouts.”

Exam-day tips and mindset

Go slow to go fast: Skim through all questions quickly, flag the long scenario or lab items, and knock out the short, high-confidence items first.
Eliminate aggressively: Narrow down to two plausible answers and look for disqualifying phrasing (“must,” “only,” unsupported features) to pick the best fit.
Think “policy and pattern”: Many questions test whether you know the recommended, scalable way to do things—branching policies, YAML templates, secure service connections, and repeatable environment promotion.
Leave no blanks: There’s no penalty for guessing. Use your flags and return to tough items with fresh eyes.

Actionable takeaway:

Practice in Microsoft’s Exam Sandbox the day before your test so the interface is second nature.

Common mistakes to avoid

Over-focusing on just one tool: The exam expects fluency in both GitHub and Azure DevOps. Build pipelines in both.
Ignoring security: Secrets, identities, scanning, and compliance gates are major scoring opportunities.
Skipping IaC: Provisioning and configuring environments via pipeline are near‑mandatory for modern DevOps on Azure.
Neglecting telemetry: Without instrumentation, you can’t improve. Learn App Insights/Monitor basics and simple KQL.
Studying without building: You’ll retain more (and be faster on exam day) if you actually implement the skills.

Actionable takeaway:

For every concept you read, ask: “Where is this in my pipeline?” If you can’t point to it, add it to your lab.

Keep your skills current after you pass

Renew annually with the free online assessment—budget an hour to review updates and complete it within the 6‑month window before expiry.
Track platform updates that often land in AZ‑400 objectives (e.g., GitHub Actions features, Azure Pipelines changes, GHAS and Defender for Cloud DevOps Security enhancements).
Keep iterating on your portfolio: Add a new lab quarterly (e.g., container build cache optimizations, advanced deployment rings, policy-as-code).

Actionable takeaway:

Maintain an internal “pipeline cookbook”—a repository of reusable templates, security policies, and IaC modules. It’s both a study asset and a platform engineering accelerant.

FAQs

Q1: Do I need a prerequisite certification before taking AZ‑400?

You can sit AZ‑400 whenever you like, but to be awarded the DevOps Engineer Expert certification you must hold either AZ‑104 or AZ‑204.

Q2: How long is the exam and how many questions will I see?

Plan for about 40–60 questions. You’ll typically get ~100 minutes of exam time (120 minutes seat time). If labs are included, expect ~120 minutes of exam time (140 minutes seat time). Labs, when included, usually appear at the end.

Q3: What’s the passing score and what languages are available?

The passing score is 700 on a 1–1000 scale. Languages include English, Japanese, Simplified Chinese, Korean, German, French, Spanish, Portuguese (Brazil), Traditional Chinese, and Italian.

Q4: What happens if I fail the exam?

You must wait 24 hours before your second attempt and 14 days between subsequent attempts, up to five attempts in a 12‑month period. Each attempt requires payment unless you’ve purchased a retake bundle.

Q5: How do I keep the certification current?

Certifications are valid for one year. Renew for free via an online assessment during the 6‑month window before expiry. Passing extends your certification by another year.

Conclusion:
You’re not just studying to pass an exam—you’re building the muscle to ship software safely and quickly on Azure. The Microsoft Certified: DevOps Engineer Expert certification validates that you can design scalable pipelines, secure them with modern guardrails, and instrument everything for continuous learning. If you follow the 8‑week blueprint, build the five labs (in both GitHub Actions and Azure Pipelines), and practice with Microsoft’s official tools, you’ll go into AZ‑400 confident—and come out with a career-defining credential.