Microsoft Azure DevOps Engineer (AZ-400): What's Actually Tested

The Microsoft AZ-400 is the exam that earns you the Azure DevOps Engineer Expert certification. It runs 100 minutes, costs $165, has roughly 40 to 60 questions, and requires 700 out of 1000 to pass. One critical detail before you register: passing AZ-400 alone does not award the Expert cert. You must also hold either AZ-104 (Azure Administrator Associate) or AZ-204 (Azure Developer Associate). If you do not have one of those already, earn it first. The exam questions assume you are already comfortable operating Azure at associate level. Most candidates with that foundation need 8 to 12 weeks of focused study to pass.

The 90-second answer

Take AZ-400 if you are already an AZ-104 or AZ-204 holder and you work in, or want to move into, a DevOps or platform engineering role on Azure. The exam is heavy on Azure Pipelines and GitHub Actions, Git strategy, Infrastructure as Code, and pipeline security. It validates exactly the skills those job postings ask for, and it is the only Microsoft cert that explicitly owns the DevOps Engineer Expert title.

Skip AZ-400 if you do not yet have AZ-104 or AZ-204. Go earn one of those first because you need it anyway. If you are new to Azure entirely, start with AZ-900 then work toward AZ-104 or AZ-204 before touching this exam. If your DevOps focus is on AWS, the AWS DevOps Engineer Professional (DOP-C02) is the better match for your stack.

What does the AZ-400 actually test?

AZ-400 covers five domains. The build-and-release-pipeline domain is enormous and dominates the exam. Everything else is real but secondary to pipeline fluency.

Domain	Weight	What it covers
Design and implement processes and communications	10 to 15%	Agile and DevOps practices, work traceability, metrics and dashboards, notifications, Azure Boards and GitHub integration with Teams
Design and implement a source control strategy	15 to 20%	Git branching models, repository structure, monorepos, Git LFS, pull-request workflows, code review policies
Design and implement build and release pipelines	40 to 45%	Azure Pipelines and GitHub Actions, YAML pipelines, self-hosted and Microsoft-hosted agents, deployment patterns (blue/green, canary, rings), ARM/Bicep/Terraform IaC, Azure Artifacts package management, secrets and quality gates
Develop a security and compliance plan	10 to 15%	Securing pipelines and secrets via Key Vault, dependency and code scanning, GitHub Advanced Security, least-privilege service connections
Implement an instrumentation strategy	5 to 10%	Application Insights and Azure Monitor telemetry, log queries and alerts, feedback loops, site reliability practices

The pipeline domain is nearly half the exam on its own. If you are not comfortable writing YAML pipelines from scratch, fixing broken stage dependencies, and wiring in Key Vault secret references, that gap will show on exam day. The exam tests pipeline mechanics at a real depth, not just conceptual awareness.

Case-study sections appear in many AZ-400 sittings. Once you submit answers inside a case-study and move on, Microsoft does not let you return to those questions. Read each case-study scenario carefully before answering anything in it.

The branching strategy questions go deeper than most candidates expect. You should understand trunk-based development, Gitflow, GitHub Flow, and the tradeoffs for large teams and release-train models. Monorepo design and Git LFS also show up, especially in the source control domain.

How hard is the AZ-400?

AZ-400 is a difficulty 4 out of 5. It is an expert-level cert by design, and Microsoft positions it above all Associate certs. The breadth is the main challenge: you need real fluency across culture and process, source control, CI/CD pipelines, infrastructure as code, pipeline security, and monitoring, all within one exam. Community surveys suggest first-time pass rates for candidates who studied 8 or more weeks sit somewhere in the 55% to 70% range, though Microsoft does not publish official figures.

The hard parts are specific:

• YAML pipeline syntax at depth. Multi-stage pipelines with environments, approvals, variable groups, and Key Vault linkage are common question territory. You cannot bluff YAML mechanics with conceptual understanding.
• Infrastructure as Code scope. ARM, Bicep, and Terraform all appear. You do not need to be an expert in all three, but you need to recognize correct syntax and understand the deployment model for each.
• Case-study no-return rule. Once you advance past a case-study section you cannot go back, so misreading the scenario burns points you cannot recover.
• The security domain is narrower than a dedicated security cert but tricky. Questions on GitHub Advanced Security features, service connection permissions, and Key Vault secret scoping are easy to confuse if you lack hands-on time with them.

The most common failure pattern is candidates who know Azure Pipelines from using it but have never written a YAML pipeline from a blank file, managed a variable group with Key Vault linkage, or configured an environment with approval gates. Knowing how a CI/CD tool works at a user level is not the same as knowing how to design and secure one. Build that gap in your study plan before you book the exam.

How long should you study for AZ-400?

Microsoft recommends having the AZ-104 or AZ-204 associate cert plus practical experience with Azure DevOps and GitHub before sitting this exam. That is the right baseline. For actual study time from that starting point:

• With daily hands-on Azure Pipelines and GitHub Actions work: 6 to 8 weeks at 8 to 10 hours per week
• With AZ-104 or AZ-204 but limited pipeline experience: 10 to 12 weeks at 8 to 12 hours per week
• With an associate cert and some pipeline exposure but not deep YAML experience: 12 weeks, weighted toward the pipeline domain in weeks 4 through 9
• Switching from AWS DevOps or another cloud's CI/CD tooling: 8 to 10 weeks, mostly to learn Azure-specific pipeline mechanics and IaC tooling

The single biggest study mistake is treating this as a read-heavy cert. Azure Pipelines and GitHub Actions reward hands-on reps. Create a free Azure DevOps organization, build multi-stage YAML pipelines, deploy to environments with approval gates, link a variable group to Key Vault, and run a Bicep or Terraform deployment from a pipeline stage. These tasks take an hour each to set up, and they make the exam questions feel concrete rather than abstract.

A realistic week-by-week pace for a 10-week plan looks like:

1. Week 1: DevOps culture, Agile practices, Azure Boards and GitHub integration, work traceability and metrics
2. Week 2: Git fundamentals review, branching strategies (trunk-based, Gitflow, GitHub Flow), pull-request policies, code review configuration
3. Week 3: Monorepo design, Git LFS, repository scaling approaches
4. Week 4: Azure Pipelines foundations, classic vs YAML, agents, triggers
5. Week 5: Multi-stage YAML pipelines, environments, approvals, gates
6. Week 6: GitHub Actions, reusable workflows, secrets, runner types, comparison with Azure Pipelines
7. Week 7: IaC with ARM, Bicep, and Terraform; pipeline-driven deployments; deployment patterns (blue/green, canary, rings)
8. Week 8: Azure Artifacts, package management, upstream sources, feed permissions; quality gates and test result integration
9. Week 9: Pipeline security, Key Vault integration, service connections, GitHub Advanced Security, dependency scanning
10. Week 10: Application Insights, Azure Monitor, log alerts, feedback loops; full timed practice exams and case-study drills

Most failures trace to weeks 4 through 7. If your YAML pipeline skills are weak, double the time there and cut from the monitoring week, which is the lightest domain on the exam.

What does the AZ-400 cost?

The exam itself is $165 USD plus any applicable local taxes. Total cost depends on how you study:

Component	Range	Notes
Exam fee	$165	One attempt. Retake requires a 24-hour wait after a fail.
Microsoft Learn	$0	The official AZ-400 learning path is free and covers all five domains
Study course	$0 to $50	Many instructors publish AZ-400 courses on Udemy at $12 to $15 on sale
Practice questions	$0 to $40	NerdExam has 619 AZ-400 questions if you want a structured practice option
Azure DevOps org	$0	Free Azure DevOps organization with Basic plan for labs; Azure free tier for resource deployments
Total realistic spend	$165 to $250	Cheapest viable path: $165 (exam only, using free Microsoft Learn content and free Azure DevOps)

Microsoft certification prices vary by country. The $165 figure is the US price; check the Microsoft Learn certification page for your region before registering. Microsoft occasionally offers exam vouchers through partners, learning challenges, and Microsoft events such as Ignite and Build, so watch for promotions before paying full price.

One cost that is easy to forget: the annual renewal. Unlike CompTIA or Cisco certifications with multi-year cycles, Microsoft role-based certifications expire after one year. Renewal is free and unproctored via a short online assessment on Microsoft Learn, available within 6 months of your cert expiry date. Set a calendar reminder. A lapsed cert means the Expert badge disappears from your transcript until you renew it.

What salary can you expect after passing?

AZ-400 is an expert-level cert, and the associated roles sit at mid to senior levels. 2026 US salary estimates from job boards show:

• DevOps Engineer with AZ-400: $115,000 to $155,000
• Azure DevOps / Release Engineer with AZ-400: $110,000 to $150,000
• Senior DevOps or Platform Engineer: $145,000 to $185,000
• Cloud Engineer with DevOps focus: $120,000 to $160,000

The cert is a hiring signal for roles that already pay well. It will not turn a junior engineer into a senior one overnight, but it removes you from the automatic screen-out pile for mid-level DevOps roles, and it gives you a credible answer when a hiring manager asks how you know Azure pipelines. The salary impact is clearest when the cert is combined with two or more years of hands-on Azure DevOps or GitHub Actions work. On a resume with real project experience behind it, AZ-400 is a genuine differentiator for Azure-heavy employers.

What study resources actually work?

The candidates who pass on the first attempt tend to use a similar stack:

1. Microsoft Learn AZ-400 learning path for breadth. It is official, free, and maps to every exam domain. Treat it as your outline, not your only resource. The hands-on exercises in the labs are more valuable than the reading.
2. A personal Azure DevOps organization, used daily. Free to create. Build pipelines that fail, fix them, add environments and approvals, link Key Vault. Passive reading about YAML pipelines does not prepare you for writing one under exam conditions.
3. GitHub Actions practice. Create a free GitHub repository and replicate your Azure Pipelines workflows as Actions. The comparison between the two tools is a recurring exam theme, and hands-on experience with both makes those questions easy.
4. An IaC lab. Deploy a simple Azure resource via Bicep and via Terraform from a pipeline stage each. You do not need to be an IaC expert; you need to know how pipelines consume templates and what the deployment flow looks like for each.
5. At least 400 to 600 practice questions before exam day, including questions on pipeline security and case-study formats.
6. Two full timed practice exams in the final two weeks. If you are below 75% on the second one, postpone the real exam and spend the extra time in the pipeline domain.

Skip any site that claims to sell "real exam questions." Beyond the ethical issue, those dumps train you to recognize memorized answers, not to reason through a scenario you have never seen, which is exactly what AZ-400's case-study and design questions require.

For the practice question portion, NerdExam has 619 enriched AZ-400 questions with full explanations. Start practicing AZ-400 questions to see the question style and the reasoning the exam expects, particularly for pipeline design and IaC scenarios where the right answer hinges on a detail you can only internalize from doing the work.

Who should NOT take AZ-400?

The cert is wrong for these candidates:

You are	Take instead
No Azure associate cert yet	AZ-104 or AZ-204 first (you need one to earn the Expert cert anyway)
Brand new to Azure entirely	AZ-900 then AZ-104 or AZ-204 before AZ-400
AWS-focused DevOps engineer	AWS DevOps Engineer Professional (DOP-C02)
Only want CI/CD basics, no cert needed	Skip and learn Azure Pipelines or GitHub Actions directly on the job
Targeting Azure architecture, not DevOps	AZ-305 (Azure Solutions Architect Expert) is the better path

The prerequisite structure matters here more than on most exams. If you sit AZ-400 without an associate cert and somehow pass, you still do not earn the Expert certification. The badge requires both. That makes attempting AZ-400 without AZ-104 or AZ-204 a pure waste of a $165 exam fee. Get the associate cert first. It also ensures your Azure fundamentals are solid enough that the exam questions on resource configuration and access control do not slow you down.

What's next after AZ-400?

AZ-400 is already an expert-level cert, so there is no natural "next rung" on the same ladder. The paths from here depend on where you want to grow:

• Architecture track: AZ-305 (Azure Solutions Architect Expert) pairs naturally with a DevOps background. The overlap in IaC, networking, and security design is real, and many senior platform engineers hold both.
• Security specialization: the Microsoft Cybersecurity Architect (SC-100) or the AZ-500 (Azure Security Engineer Associate) if you want to deepen the pipeline security and identity work from AZ-400 into a dedicated security credential.
• Lateral depth: AI-900 or AI-102 if your team is adding AI workloads to the pipelines you already own. Not a deep technical extension, but useful for teams building ML deployment pipelines.
• Renewal, annually. Set the reminder now. Microsoft role-based certs expire after one year. The renewal assessment is free and unproctored on Microsoft Learn, but you have to do it. A lapsed Expert cert is surprisingly common and looks careless to hiring managers who check transcript dates.

The most direct value from AZ-400 comes from the 12 to 24 months after passing, when you are operating Azure DevOps environments at scale and the cert maps directly to what you do every day. The Expert badge earns its keep when a job posting lists it as preferred and you can click through on your Microsoft Learn transcript to prove it.

Ready to start? Browse AZ-400 practice questions on NerdExam or jump straight into the free per-question explanations. If you want the official exam outline before you plan your study path, the Microsoft AZ-400 certification page has the current skills-measured document and a link to register.