AZ-400 Complete Guide: Microsoft Azure DevOps Engineer Expert Scope, Resources & Pass Strategy

Microsoft Certified: DevOps Engineer Expert (AZ-400) is the Expert-tier certification for DevOps engineers who design and implement CI/CD pipelines, IaC, GitOps, and SRE practices on Azure DevOps and GitHub. It stands alongside AZ-305 (Solutions Architect) as one of the two pillars of Azure's Expert tier, and it's the destination for everyone aiming for DevOps engineer, SRE, or platform engineer roles. Since Microsoft acquired GitHub in 2018, the exam has evolved to cover both Azure DevOps Services and GitHub Actions, and in the 2026 version GitHub now accounts for nearly half of the total weight.

This article organizes everything: the AZ-400 exam specs, how it relates to the AZ-104 / AZ-204 prerequisites, the 5-domain structure, when to use Azure DevOps vs. GitHub, a head-to-head comparison of the IaC tools (Bicep / ARM / Terraform), a 3-4 month roadmap to passing, and Expert-double strategies pairing AZ-400 with AZ-305 / SC-100. The first step toward passing is to recognize that AZ-400 tests 'the integrated skills required to make team development work,' not 'knowledge of a single service.'

AZ-400 Exam Basics

The AZ-400 exam spec is the standard Expert-tier setup.150 minutes, 40-60 questions, a passing score of 700 / 1000, 165 USD / 21,103 JPY, and 12 months validity (renewable via a renewal assessment). Delivered through Pearson VUE either online via OnVUE or at a test center, with multi-language support including Japanese. In addition to multiple-choice questions, the format includes YAML pipeline reading (Azure Pipelines / GitHub Actions), case studies (multiple questions tied to a single corporate scenario), sequence-ordering questions, and drag-and-drop questions — testing both implementation steps and design judgment.

AZ-104 or AZ-204 Is Required for the Expert Badge

To actually earn the AZ-400 Expert certification, you must also hold either AZ-104 (Administrator Associate) or AZ-204 (Developer Associate). You can sit AZ-400 by itself, but the Expert badge will not be issued. The 'DevOps Engineer Expert' badge only appears on Credly the moment you have AZ-400 plus AZ-104 or AZ-204 on file.

Which prerequisite to pick comes down to direction. For infrastructure operations, IaC, and cloud governance (the Platform Engineer / SRE lean), the canonical route is AZ-104 → AZ-400. For app development, containers, and microservices (a developer stepping up into DevOps), it's AZ-204 → AZ-400. However, AZ-204 is scheduled to retire on July 31, 2026 with no announced successor, so for new candidates the safe pick is AZ-104 → AZ-400.

Domain 1: Design and Implement Processes and Communications (10-15%)

This is the people-and-process layer that makes DevOps actually work. Core topics: Azure Boards work item management (Epic / Feature / User Story / Task), kanban boards, sprint planning; GitHub Issues / Projects for agile management; Pull Request / code review process design; Slack / Microsoft Teams integration; change-management notifications (Service Hooks, GitHub Apps); and choosing frameworks among SCRUM / Kanban / XP / SAFe. The point weight is small, but this is the foundational knowledge you need to parse case-study scenarios.

Domain 2: Design and Implement Source Control (15-20%)

This domain handles Git and branching strategy. Core topics: Git branching strategy (GitFlow vs. GitHub Flow vs. Trunk-based Development, Release Flow); branch protection (Required Reviewers, Status Checks, Linear History, Signed Commits, Code Owners); code review process (PR templates, Auto-merge, Draft PR); submodules / Submodule / Subtree; monorepo vs. polyrepo strategy; Git LFS for binary management; Secret Scanning for credential leak detection; and the GitHub Advanced Security feature suite. Recent trends like Trunk-based Development + Feature Flags and GitOps (FluxCD / Argo CD) are also in scope.

Domain 3: Design and Implement Build and Release Pipelines (40-45%, Most Important)

The highest-weighted core domain, and the single biggest factor in whether you pass. Core topics: Azure Pipelines / GitHub Actions YAML pipeline design (Triggers, Jobs, Steps, Tasks, Variables, Parameters, Conditions, Templates, Dependencies); multi-stage pipelines (Build / Test / Stage / Prod); staged release with Environment / Approval / Gate; choosing Self-hosted Agents vs. Microsoft-hosted Agents; Container Registry integration (Azure Container Registry / GitHub Container Registry); IaC integration (embedding Bicep / ARM / Terraform into CI/CD); deployment strategies (Blue-Green, Canary, Feature Flag, Rolling Update, A/B Testing); and artifact management (Azure Artifacts / GitHub Packages — NuGet / npm / Maven / Python packages).

The pitfall in this domain is YAML syntax detail. If you can't precisely name the YAML keys and hierarchy under trigger / pr / pool / steps / template, the answer choices will trick you. Common: different key names for the same concept across Azure Pipelines and GitHub Actions (e.g., Azure Pipelines' pool vs. GitHub Actions' runs-on). The standard study technique is to build a side-by-side syntax cheat sheet for both.

Domain 4: Develop a Security and Compliance Plan (10-15%)

The DevSecOps domain, whose weight has been climbing rapidly in recent updates. Core topics: Microsoft Defender for DevOps (integrated into Azure DevOps / GitHub); Credential Scanning (GitHub Secret Scanning, Azure Pipelines pre-build inspection); SAST (Static Application Security Testing) (CodeQL, SonarQube); DAST (Dynamic Application Security Testing) (OWASP ZAP, Burp Suite Pro); SCA (Software Composition Analysis) (Dependabot, WhiteSource Bolt); Container Image Scanning (Trivy, Microsoft Defender for Containers); IaC scanning (Checkov, tfsec); and compliance frameworks (SOC 2, ISO 27001, PCI DSS, HIPAA). Most questions in this domain center on the GitHub Advanced Security feature suite — a clear symbol of how AZ-400 keeps tilting toward GitHub.

Domain 5: Implement an Instrumentation Strategy (10-15%)

The observability domain covering the production operations phase. Core topics: APM via Application Insights (Distributed Tracing, Live Metrics, Smart Detection); cross-cutting log aggregation via Log Analytics + Azure Monitor; visualization with Azure Workbooks / Dashboards; developer productivity visibility via GitHub Insights; SLI / SLO / SLA design (Service Level Indicator / Objective / Agreement); Error Budget operations; Chaos Engineering (Azure Chaos Studio); and applying OpenTelemetry. This domain tests your ability to implement SRE practices on Azure and GitHub — specifically, mapping concepts from Google's SRE Book (SLI / SLO / Error Budget) onto Azure products.

IaC: Choosing Among Bicep / ARM / Terraform

AZ-400 covers three IaC tools, weighted Bicep > ARM > Terraform.Bicep is Microsoft's recommended Azure-only DSL, more readable than ARM JSON, and the official Microsoft best practice as of 2026. The industry consensus is that new Azure projects should start with Bicep, full stop.ARM templates are the legacy JSON format, surviving in legacy maintenance and a handful of cases that need complex conditionals. Because Bicep transpiles to ARM, the correspondence between the two is a frequent exam topic.Terraform is HashiCorp's multi-cloud IaC tool, managing Azure resources via the AzureRM Provider. Use it when you have multi-cloud requirements, an existing Terraform footprint, or accumulated Terraform skills on the team.

The exam asks you to choose 'which tool fits which scenario' and to read each tool's YAML / HCL syntax. You should memorize Bicep's simple resource definitions at a minimum, understand the structure of ARM's main sections (parameters / variables / resources / outputs), and reach a comfortable reading level on Terraform's HCL block syntax.

A 3-4 Month Roadmap to Passing

A 3-month plan assuming you already hold AZ-104 and have 1-3 years of DevOps experience.Month 1: Burn through the Microsoft Learn AZ-400 learning path (Processes / Source Control / Security sections), create free accounts on both GitHub and Azure DevOps, and implement both Pipelines and Actions on a sample project.Month 2: Study the build/release pipelines domain, construct five multi-stage YAML pipelines, and provision the same infrastructure three ways using Bicep / ARM / Terraform.Month 3: Instrumentation domain plus final review. Build a sample dashboard using Application Insights + Log Analytics, drill the official Practice Assessment until you consistently hit 80%, and work through case-study mock questions. If you don't yet hold the prerequisite (AZ-104 / AZ-204), tack on another 3-4 months up front for a realistic 6-7 month total plan.

What to Target After AZ-400

The strongest follow-up is the Expert double with AZ-305 (Solutions Architect Expert). AZ-400 + AZ-305 = the tech lead / principal engineer profile that speaks both design and deployment automation. For security integration, climb the DevSecOps stack with SC-100 (Cybersecurity Architect Expert), or pair security with identity through SC-300 (Identity Admin). For multi-cloud DevOps, pairing AZ-400 with AWS Certified DevOps Engineer - Professional, Google Cloud Professional Cloud DevOps Engineer, or Kubernetes certifications (CKA / CKAD / CKS) is highly valued on the job market. AZ-400 by itself is increasingly listed as a required qualification for senior DevOps / SRE / platform engineer roles in the 9-14 million JPY salary band.

Frequently Asked Questions

Exam information in this article is based on the official Microsoft Learn AZ-400 page and the Azure DevOps Documentation. This article is not an official product of Microsoft Corporation, and there is no affiliation or endorsement of any kind. Microsoft, Azure, Azure DevOps, and GitHub are trademarks of the Microsoft group of companies. Information is based on official materials published as of May 24, 2026. Always confirm the latest information on the official pages.