Updated 1 Nov 2026 · 6 min read
On this page
What the Microsoft AZ-400 is and who it is for
The AZ-400, Designing and Implementing Microsoft DevOps Solutions, is the exam for the Microsoft Certified: DevOps Engineer Expert certification. Microsoft describes the DevOps engineer as a developer or infrastructure administrator who also works with people, processes and products to deliver value continuously, and who designs and implements flow of work, collaboration, communication, source control and automation.
Microsoft expects experience both administering and developing in Azure, with strong skills in at least one of the two, plus experience implementing both GitHub and Azure DevOps solutions. That second point shapes the exam: many objectives name a GitHub feature and an Azure DevOps feature side by side.
Passing the AZ-400 on its own does not give you the certification. To become a DevOps Engineer Expert you must also hold either the Microsoft Certified: Azure Administrator Associate or the Microsoft Certified: Azure Developer Associate.
Microsoft AZ-400 at a glance
| Item | Detail |
|---|---|
| Exam code | AZ-400 |
| Questions | Not published for this exam. Microsoft says most of its exams have 40 to 60 and the number varies |
| Time allowed | 100 minutes, or 120 minutes if the exam contains labs. You see the exact time when you register |
| Passing score | 700 out of 1,000, scaled |
| Exam fee | US$165 in the US, priced by the country or region where you sit it |
| Languages | English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese (Brazil), Chinese (Traditional) and Italian |
| Where you sit it | Pearson VUE, online proctored or at a test centre |
| Certification valid for | 12 months, renewed with a free online assessment |
Microsoft does not say whether the AZ-400 includes labs, because labs can be removed at any time. Its exam duration page gives 100 minutes for associate and expert exams without labs and 120 minutes for those that may contain them.
What is on the exam
Design and implement processes and communications (10 to 15%). Structuring the flow of work with GitHub Flow, tracking work across GitHub projects and Azure Boards, and building dashboards and queries for metrics such as cycle time, lead time and time to recovery. It also covers wikis, release notes, webhooks and Microsoft Teams integration.
Design and implement a source control strategy (10 to 15%). Trunk-based, feature and release branch strategies, pull request workflows with branch policies and branch protection rules, and repository management: Git LFS for large files, scaling with Scalar, permissions, tags, and recovering or removing data with Git commands.
Design and implement build and release pipelines (50 to 55%). Half the exam. It covers package management with GitHub Packages and Azure Artifacts, SemVer and CalVer versioning, testing strategy and code coverage in pipelines, and the choice between GitHub Actions and Azure Pipelines. You write YAML pipelines with triggers, multi-stage jobs, templates, variable groups and environment checks and approvals, and design runner and agent infrastructure. Deployment strategies come next: blue-green, canary, ring, feature flags with Azure App Configuration, deployment slots and database tasks. It finishes with infrastructure as code (Bicep, ARM, Azure Machine Configuration, Azure Deployment Environments) and maintaining pipelines, including migrating classic pipelines to YAML.
Develop a security and compliance plan (10 to 15%). Service principals versus managed identities, GitHub Apps, GITHUB_TOKEN and personal access tokens, Azure DevOps service connections, and permissions in both tools. Secrets go through Azure Key Vault and workload identity federation. Scanning covers Defender for Cloud DevOps Security, GitHub Advanced Security on both platforms, CodeQL, container scanning and Dependabot alerts.
Implement an instrumentation strategy (5 to 10%). Azure Monitor and Application Insights, VM and container insights, alerts for GitHub Actions and Azure Pipelines, distributed tracing, and basic KQL queries.
Microsoft updated the English exam on 27 July 2026. Its change log marks only minor changes, in four objective groups. Localised versions follow about eight weeks after an English update.
Why people fail it
The exam tests two toolchains at once. Many objectives pair a GitHub feature with an Azure DevOps one: branch protection rules and branch policies, GitHub Packages and Azure Artifacts, GitHub Actions and Azure Pipelines, GitHub Advanced Security on both. Candidates who use only one of them every day lose marks on the other, and on questions that ask which of the two fits a requirement.
The second cause is the weighting. Build and release pipelines carry 50 to 55% of the exam. Candidates with a strong process or security background often spread their time evenly and arrive without enough depth in YAML, agents, deployment patterns and infrastructure as code.
The third is that many objectives start with design. You are asked to choose a branching strategy, a deployment pattern or an authentication method that meets a stated constraint, so knowing what each feature does is not enough.
A study plan that fits the exam
Eight weeks suits most people who already work with Azure. Pipelines get four weeks because they carry half the marks.
- Week 1: processes and communications. Set up a GitHub project and an Azure Boards project, link them to repositories, and build a dashboard for cycle time and lead time. Take the free AZ-400 practice questions to see where you stand.
- Week 2: source control. Branch strategies, pull request workflows with branch policies and protection rules, Git LFS, and removing a secret from Git history.
- Week 3: packages and testing. Publish to Azure Artifacts and GitHub Packages with upstream sources, version with SemVer, and add tests and code coverage to a pipeline.
- Week 4: pipeline design. Write the same multi-stage YAML pipeline in GitHub Actions and Azure Pipelines, with templates, variable groups, a self-hosted runner and an environment approval.
- Week 5: deployments. Practise blue-green, canary and ring deployments, deployment slot swaps and feature flags with Azure App Configuration.
- Week 6: infrastructure as code and maintenance. Deploy with Bicep from a pipeline, compare configuration management options, migrate a classic pipeline to YAML and set retention.
- Week 7: security and compliance. Managed identities, service connections, workload identity federation, Key Vault, and GitHub Advanced Security with Dependabot and CodeQL.
- Week 8: instrumentation and timed runs. Set up Application Insights and write a few KQL queries, then take Microsoft's free practice assessment and work through the AZ-400 practice question pack in timed blocks.
On exam day
You schedule through Pearson VUE and can sit online or at a test centre. Microsoft strongly recommends registering with a personal Microsoft account, because exam records tied to a work or school account are lost if you leave that organisation. For an online exam you can check in from 30 minutes before your appointment, and launch and check-in take about 15 minutes.
Five minutes of break time is built into the exam, but the clock keeps running during a break and you cannot return to questions you saw before it. You can open Microsoft Learn during associate and expert exams, but Microsoft warns that using it for every question will leave you short of time, so save it for one detail. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Frequently asked questions
What happens if I fail the AZ-400?
You can retake it after 24 hours. After that, Microsoft requires 14 days between attempts, with a maximum of five attempts in the 12 months from your first. You pay for each retake.
Do I need an associate certification first?
For the certification, yes. You need the Azure Administrator Associate or the Azure Developer Associate as well as a pass in the AZ-400. Microsoft lists them as prerequisites for the DevOps Engineer Expert certification.
Is the practice question pack enough on its own?
No. It is practice, not a course. The 564 questions with explanations show how Microsoft frames pipeline and tooling decisions and where your gaps are, but the AZ-400 rewards hands-on time in both GitHub and Azure DevOps. Build the pipelines yourself, then use the questions to check what you know under time.
How do I keep the certification?
It lasts 12 months. You renew for free by passing a short, unproctored, open book assessment on Microsoft Learn during a six month window before it expires. Passing extends it by one year from the expiry date.
When you are ready to test yourself properly, get the AZ-400 practice questions with full explanations.
Sources
The official pages the facts in this guide were checked against.
- learn.microsoft.com/en-us/credentials/certifications/devops-engineer/
- learn.microsoft.com/en-us/credentials/certifications/exams/az-400/
- learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
- learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- learn.microsoft.com/en-us/credentials/exam-pricing.json
- learn.microsoft.com/en-us/credentials/certifications/register-schedule-exam
- learn.microsoft.com/en-us/credentials/certifications/online-exams
- learn.microsoft.com/en-us/credentials/certifications/renew-your-microsoft-certification
- learn.microsoft.com/en-us/credentials/support/retake-policy