Exam guide for cloud switchers · Expert

AZ-400 for AWS engineers: Designing and Implementing Microsoft DevOps Solutions

AZ-400 is the DevOps Engineer Expert exam.

More than half of it is build and release pipelines, split between GitHub (Actions, Advanced Security, Packages) and Azure DevOps (Boards, Repos, Pipelines, Artifacts). If you know AWS CodePipeline and CodeBuild, the concepts transfer, but very few questions are about AWS-style managed CI/CD services.

Last verified: Oct 27, 2026 against the official AZ-400 study guide · Edit on GitHub · Report an error

Exam at a glance

Exam	AZ-400: Designing and Implementing Microsoft DevOps Solutions
Certification	Microsoft Certified – DevOps Engineer Expert (Expert)
Status	current A new Agentic DevOps Engineer Expert certification (exam AZ-401) is in beta.
Skills measured as of	Jul 27, 2026
Passing score	700 or greater (per the study guide)
Prerequisite	Microsoft lists the Azure Administrator Associate or Azure Developer Associate certification as the prerequisite for DevOps Engineer Expert. The Azure Developer Associate (AZ-204) is retired, so for most new candidates that means AZ-104.
Closest AWS cert	DOP-C02

Exam prices vary by country and are set on the exam page, so none are quoted here. Microsoft doesn't publish pass rates.

Who it's for

AWS DevOps engineers (the DOP-C02 audience) moving pipelines to GitHub or Azure DevOps.
Platform engineers who own CI/CD, IaC and release governance for Azure workloads.
Anyone who already holds an Azure Administrator Associate certification. A related associate certification is required for the Expert credential.

Domains and how they map to AWS

Domain (official)	Weight	Compare pages
Design and implement processes and communications	10–15%	—
Design and implement a source control strategy	10–15%	—
Design and implement build and release pipelines	50–55%	6
Develop a security and compliance plan	10–15%	5
Implement an instrumentation strategy	5–10%	1

1. Design and implement processes and communications 10–15%

Official skill areas: Design and implement traceability and flow of work · Design and implement appropriate metrics and queries for DevOps · Configure collaboration and communication

From AWS: No AWS equivalent is tested. This domain covers Azure Boards and GitHub Projects for work tracking, dashboards and DevOps metrics (cycle time, lead time), wikis, release notes and Teams integration.

No AWS↔Azure service comparison on this site maps to this domain.

2. Design and implement a source control strategy 10–15%

Official skill areas: Design and implement branching strategies for the source code · Configure and manage repositories

From AWS: Git branching (trunk-based, feature branches), pull-request policies and branch protection are tool-agnostic. CodeCommit experience carries over only conceptually. Expect Git LFS, repository scaling and removing secrets from history.

No AWS↔Azure service comparison on this site maps to this domain.

3. Design and implement build and release pipelines 50–55%

Official skill areas: Design and implement a package management strategy · Design and implement a testing strategy for pipelines · Design and implement pipelines · Design and implement deployments · Design and implement infrastructure as code (IaC) · Maintain pipelines

From AWS: This domain is about half the exam. CodeBuild/CodePipeline/CodeDeploy map to GitHub Actions or Azure Pipelines YAML, with environments, checks and approvals. CodeArtifact maps to Azure Artifacts and GitHub Packages. CloudFormation/CDK map to Bicep/ARM (and Terraform). AppConfig feature flags map to Azure App Configuration feature management. Blue-green and canary deployments target App Service slots, AKS and Container Apps.

Compare pages to study (6):

4. Develop a security and compliance plan 10–15%

Official skill areas: Design and implement authentication and authorization methods · Design and implement a strategy for managing sensitive information in automation · Automate security and compliance scanning

From AWS: Secrets Manager maps to Key Vault. GitHub-to-AWS OIDC role trust maps to Entra workload identity federation (secretless service connections). Inspector and ECR scanning map to GitHub Advanced Security, Dependabot and Defender for Cloud DevOps security.

Compare pages to study (5):

5. Implement an instrumentation strategy 5–10%

Official skill areas: Configure monitoring for a DevOps environment · Analyze metrics from instrumentation

From AWS: CloudWatch and X-Ray map to Azure Monitor, Application Insights and Log Analytics. Queries are KQL.

Compare pages to study (1):

Concepts that trip AWS engineers up

Azure DevOps is its own SaaS

An Azure DevOps organization (Boards, Repos, Pipelines, Artifacts, Test Plans) is separate from Azure subscriptions. It reaches Azure through service connections. Projects, teams, security groups and stakeholder access are their own permission system.

Two pipeline products

Questions mix GitHub Actions workflows and Azure Pipelines YAML: stages, jobs, templates, variable groups, self-hosted agents vs runners. Migrating classic release pipelines to YAML is an explicit objective.

Secretless authentication

Prefer Entra workload identity federation (OIDC) for GitHub Actions and Azure DevOps service connections over stored service principal secrets. It's the same idea as an AWS IAM OIDC identity provider for GitHub.

GitHub Advanced Security

Code scanning (CodeQL), secret scanning and dependency review appear by name, including Advanced Security for Azure DevOps and its integration with Defender for Cloud. AWS has no single equivalent.

KQL for instrumentation

The instrumentation domain expects basic KQL over Azure Monitor Logs and Application Insights, not CloudWatch Logs Insights.

A new expert exam in beta

Microsoft has an Agentic DevOps Engineer Expert certification (exam AZ-401) in beta. AZ-400 itself shows no retirement date.

Closest AWS certification

AWS Certified DevOps Engineer – Professional DOP-C02: Same role. AZ-400 is tool-specific to GitHub and Azure DevOps rather than to cloud-native CI/CD services. Korean version retires after Dec 31, 2026.

FAQ

What does AZ-400 cover, and how is it weighted?

AZ-400 (Designing and Implementing Microsoft DevOps Solutions) has 5 domains: Design and implement processes and communications (10–15%); Design and implement a source control strategy (10–15%); Design and implement build and release pipelines (50–55%); Develop a security and compliance plan (10–15%); Implement an instrumentation strategy (5–10%). Weights are from the official Microsoft Learn study guide (skills measured as of Jul 27, 2026).

What is the closest AWS certification to AZ-400?

AWS Certified DevOps Engineer – Professional (DOP-C02): Same role. AZ-400 is tool-specific to GitHub and Azure DevOps rather than to cloud-native CI/CD services.

Is AZ-400 a current exam?

As of Oct 27, 2026, Microsoft Learn lists AZ-400 as current. A new Agentic DevOps Engineer Expert certification (exam AZ-401) is in beta.