AZ-400: Designing and Implementing Microsoft DevOps Solutions is the exam for Microsoft Certified: DevOps Engineer Expert. It covers GitHub and Azure DevOps together: source control, pipelines, deployments, infrastructure as code, security scanning and monitoring. More than half the exam (50–55%) is build and release pipelines.
This guide follows Microsoft's study guide (skills measured as of 27 July 2026): every skill area with its weight, the YAML you should be comfortable with, a 6-week plan and 15 original scenario questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Exam | AZ-400: Designing and Implementing Microsoft DevOps Solutions |
| Certification | Microsoft Certified: DevOps Engineer Expert |
| Prerequisite | Azure Administrator Associate or Azure Developer Associate |
| Passing score | 700 |
| Renewal | Every 12 months, free online assessment |
| Price | Set by the country where you take the exam |
The prerequisite is a certification you must hold to receive the Expert badge. Most candidates in India take AZ-104 (Azure Administrator) first. AZ-204 retired in July 2026 (its successor is AI-200), so check the DevOps Engineer Expert page for the current list of accepted prerequisites before you plan.
Skills measured and weights
| Skill area | Weight |
|---|---|
| Design and implement processes and communications | 10–15% |
| Design and implement a source control strategy | 10–15% |
| Design and implement build and release pipelines | 50–55% |
| Develop a security and compliance plan | 10–15% |
| Implement an instrumentation strategy | 5–10% |
1. Processes and communications (10–15%)
- Flow of work with GitHub Flow, GitHub Issues and Projects, Azure Boards and their integration with repositories.
- Dashboards and metrics: cycle time, lead time, time to recovery, plus metrics for planning, development, testing, security, delivery and operations.
- Documentation: wikis with Markdown and Mermaid diagrams, release notes, API docs, documentation generated from Git history.
- Integrations: webhooks, Azure Boards with GitHub, GitHub or Azure DevOps with Microsoft Teams.
2. Source control strategy (10–15%)
- Branching: trunk-based, feature branches, release branches.
- Pull request workflows with branch policies (Azure Repos) and branch protection rules (GitHub).
- Large files (Git LFS), scaling repositories (Scalar), permissions, tags.
- Recovering data with Git commands, and removing sensitive data from history.
3. Build and release pipelines (50–55%)
The heart of the exam.
- Packages: GitHub Packages and Azure Artifacts, feeds, views and upstream sources; SemVer and CalVer versioning.
- Testing: quality and release gates, unit, integration and load tests in pipelines, code coverage.
- Pipelines: choosing GitHub Actions or Azure Pipelines; runners and agents (hosted vs self-hosted, cost, licences); YAML pipelines; triggers; multi-stage pipelines and parallel jobs; reusable YAML templates, variables and variable groups; checks and approvals with environments.
- Deployments: blue-green, canary, ring, progressive exposure, feature flags (Azure App Configuration Feature Manager), A/B testing; deployment slots and swaps; hotfix paths; database deployment tasks.
- Infrastructure as code: ARM, Bicep, Azure Automation State Configuration, Azure Machine Configuration, Azure Deployment Environments.
- Maintenance: pipeline health (failure rate, duration, flaky tests), cost and concurrency optimisation, retention, migrating classic pipelines to YAML.
YAML you should be able to read
# Azure Pipelines: build once, deploy to staging then production with approval
trigger:
branches: { include: [ main ] }
stages:
- stage: Build
jobs:
- job: build
pool: { vmImage: ubuntu-latest }
steps:
- script: dotnet test --collect:"XPlat Code Coverage"
- task: PublishPipelineArtifact@1
inputs: { targetPath: out, artifact: app }
- stage: Staging
dependsOn: Build
jobs:
- deployment: deploy_staging
environment: staging
strategy: { runOnce: { deploy: { steps: [ script: echo deploy to staging ] } } }
- stage: Production
dependsOn: Staging
jobs:
- deployment: deploy_prod
environment: production # approvals and checks are configured on this environment
strategy: { runOnce: { deploy: { steps: [ script: echo deploy to production ] } } }
Know the GitHub Actions equivalent too: workflows, jobs, needs, environments with required reviewers, and reusable workflows.
4. Security and compliance (10–15%)
- Service principals vs managed identities; GitHub Apps,
GITHUB_TOKENand personal access tokens; Azure DevOps service connections. - Permissions and roles in GitHub and Azure DevOps; stakeholder and outside-collaborator access.
- Secrets: Azure Key Vault, secure files, and secretless authentication with workload identity federation (OpenID Connect).
- Scanning: dependency, code, secret and licence scanning; GitHub Advanced Security (also for Azure DevOps); Microsoft Defender for Cloud DevOps security; container scanning and CodeQL; Dependabot alerts.
5. Instrumentation (5–10%)
- Azure Monitor, Log Analytics, Application Insights, VM and Container Insights.
- Monitoring and alerts for GitHub Actions and Azure Pipelines.
- Distributed tracing, performance metrics, and basic KQL queries.
6-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | Boards, GitHub Projects, metrics, wikis; branching and PR policies | Repo with branch protection, PR template and linked work items |
| 2 | YAML pipelines, triggers, templates, variable groups | Multi-stage pipeline with a reusable template |
| 3 | Testing, gates, artifacts and package feeds | Publish a package to Azure Artifacts with SemVer |
| 4 | Deployment strategies, slots, feature flags; IaC with Bicep | Blue-green with App Service slots; Bicep deployment from a pipeline |
| 5 | Identity, OIDC federation, Key Vault, Advanced Security, Defender | GitHub Actions deploying to Azure with OIDC and no stored secrets |
| 6 | Monitoring and KQL; practice assessment twice; revise | Alert on pipeline failures; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. Production deployments must wait for a manager's approval. How in Azure Pipelines?
Use a deployment job targeting an environment, with an approval check configured on that environment.
2. GitHub Actions must deploy to Azure without storing a client secret. What do you use?
Workload identity federation (OpenID Connect) with a federated credential.
3. Ten pipelines repeat the same build steps. How do you reduce duplication?
YAML templates (or reusable workflows in GitHub Actions).
4. Release 10% of users to a new version first, then expand. Which strategy?
Canary or ring-based deployment, optionally with feature flags.
5. Swap a new version into production with near-zero downtime on App Service. How?
Deploy to a staging slot, warm it up, then swap.
6. A password was committed to Git history. What must you do?
Rotate the secret immediately, then remove it from history with Git tooling and enable secret scanning.
7. Get alerts on vulnerable open-source dependencies in GitHub. Which feature?
Dependabot alerts (with GitHub Advanced Security for code and secret scanning).
8. Packages from npmjs must be cached and versioned centrally. What do you configure?
An Azure Artifacts feed with an upstream source.
9. Builds need tools not available on hosted agents. What do you use?
Self-hosted agents or runners.
10. Merges to main must have two reviewers and a passing build. How?
Branch policies in Azure Repos, or branch protection rules in GitHub.
11. Turn a feature on for some users without redeploying. What do you use?
Feature flags with Azure App Configuration Feature Manager.
12. Track how long work takes from start to delivery. Which metric?
Cycle time or lead time on a dashboard.
13. A pipeline fails intermittently on the same tests. What do you monitor?
Flaky tests and pipeline failure rate in pipeline analytics.
14. Define Azure resources declaratively and deploy them from a pipeline. What do you use?
Bicep (or ARM templates) in source control, deployed by the pipeline.
15. Find failed requests per operation in the last hour. What do you write?
A KQL query in Application Insights or Log Analytics.
After AZ-400
- Interview practice: DevOps engineer interview questions.
- Pay: DevOps engineer salary in Hyderabad. Live roles: DevOps jobs.
- Architecture next: the AZ-305 Solutions Architect guide.
Cloud Soft Solutions in Ameerpet, Hyderabad runs DevOps training and Azure training with real-time projects. See all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
What is the prerequisite for the AZ-400 certification?
Microsoft lists Azure Administrator Associate or Azure Developer Associate. Check the DevOps Engineer Expert page for the current list, since AZ-204 retired in July 2026.
What is the AZ-400 passing score?
700.
Which AZ-400 area has the most weight?
Design and implement build and release pipelines, at 50–55%.
Does AZ-400 cover GitHub as well as Azure DevOps?
Yes. GitHub Actions, GitHub Advanced Security, branch protection and GitHub Projects appear alongside Azure Pipelines, Repos, Boards and Artifacts.
How often must DevOps Engineer Expert be renewed?
Every 12 months, through a free online assessment on Microsoft Learn.
When were the AZ-400 skills last updated?
The English exam's skills measured were updated on 27 July 2026.
