Certification guide
AZ-400Microsoft DevOps Engineer Expert: the honest guide
AZ-400 is the exam behind DevOps Engineer Expert, and it is a design exam rather than a product exam. It asks how you would structure branching for a described team, which release strategy fits a stated risk appetite, and where a gate belongs, across both Azure DevOps and GitHub.
It also has a gate of its own. Microsoft awards the expert certification only to candidates who already hold Azure Administrator Associate or Azure Developer Associate, so passing AZ-400 without one earns an exam result rather than a certification.
Who Azure DevOps Engineer is for
A good fit if
- You hold AZ-104 or the Azure Developer Associate certification and run delivery pipelines as part of the job.
- You are a developer or an administrator moving into a platform or DevOps role and want the credential that matches.
- Your team uses both Azure DevOps and GitHub, which is exactly the split this exam tests.
- Your employer needs certified staff against a Microsoft partner requirement.
Probably not, if
- You hold neither qualifying associate certification. The exam is open to you; the expert certification is not, and the route through AZ-204 closed when Microsoft retired that exam on 31 July 2026.
- You want to learn CI/CD from scratch. This exam assumes you have run pipelines and asks which design is right, not how a pipeline works.
- Your work is entirely infrastructure administration. AZ-104 is the exam that matches, and it is also the prerequisite for this one.
Is Azure DevOps Engineer worth it?
For somebody already delivering software on Azure, yes. The DevOps Engineer Expert badge is one of the few Microsoft credentials that reads as a role rather than a product, and the exam's emphasis on judgement over configuration is why it holds up in interviews.
The cost question has two halves. The exam is $165; the certification is $330 from a standing start because of the prerequisite. It is worth knowing that before you book rather than after you pass.
It is a poor fit if pipelines are somebody else's job. Fifty-four percent of the exam is designing and implementing build and release pipelines, and that weight is unforgiving to a candidate who has read about them rather than run them.
What the exam actually asks you to do
Multiple choice and multiple response, plus drag-and-drop ordering, hot area items where you click a region of a screenshot, and case studies that hold one scenario across several linked questions.
Item formats
- Multiple choice
- Multiple response
- Drag and drop
- Hot area
- Case study
The highlighted formats are the ones you cannot answer from memory alone. Microsoft Learn, exam duration and question types ↗
Domain breakdown and official weightings
From the official Microsoft Learn study guides. Design and implement build and release pipelines is the heaviest domain at 54 percent, followed by Design and implement processes and communications at 13 percent.
- Design and implement processes and communications13%
- Design and implement a source control strategy13%
- Design and implement build and release pipelines54%
- Develop a security and compliance plan13%
- Implement an instrumentation strategy7%
Study plans by experience level
Running pipelines daily, holds the associate
4 to 6 weeksat 6 hours
- 1Week 1: read the skills outline against your own organization's setup and mark what you have never had to choose, because the exam is mostly choices.
- 2Weeks 2 to 3: build and release pipelines, the 54 percent domain. Multi-stage YAML, environments, approvals, gates and deployment strategies, built rather than read.
- 3Week 4: the GitHub half. Actions, branch protection, code scanning and secret scanning, since most candidates are strong on one platform and thin on the other.
- 4Weeks 5 to 6: security and compliance planning and the instrumentation strategy, then the free practice assessment twice, a week apart.
Administrator moving into DevOps
10 to 12 weeksat 8 hours
- 1Weeks 1 to 2: source control properly. Branching strategies, pull request policies, and why a repository layout is a delivery decision rather than a preference.
- 2Weeks 3 to 6: pipelines end to end, on the free tier. Build, test, artifact, release, environments and approvals, with at least one pipeline you broke deliberately.
- 3Weeks 7 to 8: dependency management, artifact feeds and container registries, which administrators rarely touch and the exam expects.
- 4Weeks 9 to 10: security and compliance, including secret management and scanning in the pipeline rather than beside it.
- 5Weeks 11 to 12: instrumentation with Application Insights and Azure Monitor, then the practice assessment.
Developer moving into DevOps
8 to 10 weeksat 6 hours
- 1Weeks 1 to 2: the operations half you have not owned. Environments, approvals, release gates and what a rollback actually involves.
- 2Weeks 3 to 5: the 54 percent pipeline domain across both Azure Pipelines and GitHub Actions.
- 3Weeks 6 to 7: infrastructure as code and configuration management, which is the material developers most often meet only through a platform team.
- 4Weeks 8 to 10: process, communication and instrumentation, then two runs at the free practice assessment.
Common mistakes
- Booking without the prerequisite certification
- Microsoft awards DevOps Engineer Expert only to candidates who already hold Azure Administrator Associate or Azure Developer Associate. Passing AZ-400 first is allowed and leaves you holding an exam result rather than a certification, and with AZ-204 retired the remaining route runs through AZ-104.
- Studying one platform
- The exam covers Azure DevOps and GitHub, and most candidates arrive fluent in one. Azure Pipelines expertise does not answer questions about branch protection rules, Actions workflows or GitHub Advanced Security, and the free tiers of both make this an avoidable gap.
- Treating it as a tools exam
- AZ-400 asks which design fits a described organization. Two answers usually work and one fits the stated constraints, so a candidate who has memorized YAML syntax without ever having chosen between two release strategies is preparing for a different exam.
- Underweighting the pipeline domain
- Build and release pipelines are 54 percent of the exam, more than the other four skill areas together. Instrumentation, at 7 percent, attracts study time out of proportion to its weight because it is easier to read about.
- Skipping the free practice assessment
- It is free on the exam page and it is the closest available match to how Microsoft phrases scenario questions. Candidates who skip it usually meet the multi-defensible-answer format for the first time under exam conditions.
What comes after passing
The certification is valid for one year and renews free through an unproctored assessment on Microsoft Learn, with the window opening six months before expiry.
You now hold two clocks. The prerequisite associate certification also renews annually, so plan for two short assessments a year rather than one.
The natural next moves are lateral rather than upward: SC-100 if security architecture appeals, or the Azure Solutions Architect route if design across the whole platform does.
The durable value is the vocabulary of delivery: gates, environments, drift, blast radius. It survives the certificate, and it is what makes a DevOps conversation with a sceptical operations team go well.
Costs across the full renewal cycle are on the Azure DevOps Engineer cost page.
Frequently asked questions
Do I need AZ-104 before AZ-400?
To earn the DevOps Engineer Expert certification, yes: Microsoft requires Azure Administrator Associate or Azure Developer Associate first. You may sit AZ-400 in either order, but the certification is only awarded once one of those associates is held, and the AZ-204 exam behind Azure Developer Associate retired on 31 July 2026.
Does AZ-400 cover GitHub or just Azure DevOps?
Both, and that catches people out. The skills outline covers GitHub Actions, branch protection, code and secret scanning alongside Azure Pipelines, Repos and Artifacts. Free accounts on both platforms are enough to close the gap.
How hard is AZ-400 compared with AZ-104?
Different rather than harder. AZ-104 asks whether you can configure Azure correctly; AZ-400 asks whether you can choose between two workable delivery designs given a described team and risk appetite. Candidates who prefer concrete right answers usually find AZ-400 the more uncomfortable of the two.
How long is the certification valid?
One year, renewed at no cost through an unproctored online assessment on Microsoft Learn. The renewal window opens six months before expiry, and a lapsed certification cannot be renewed: recovery means paying $165 and sitting the full proctored exam again.
Keep reading
- Azure DevOps Engineer practice questions
Free sample questions with the full explanation on every answer.
- Free Azure DevOps Engineer practice test
10 original questions, playable now. No account, no card.
- Azure DevOps Engineer exam format
How many questions, how long, what the items look like, and how long it stays valid.
- Azure DevOps Engineer passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is Azure DevOps Engineer?
An honest difficulty read from the format, the clock and the weights.
- What Azure DevOps Engineer costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice Azure DevOps Engineer for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free Azure DevOps Engineer questions