AZ-400: Designing and Implementing Microsoft DevOps Solutions
Design and implement strategies for collaboration, code, infrastructure, source control, security, compliance, continuous integration, testing, delivery, monitoring, and feedback using Azure DevOps and GitHub.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Recommended Study Guides & Exam Preparation Blueprints
Reinforce your knowledge with domain breakdowns, trap question analyses, and architectural cheat sheets:
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The AZ-400 exam features 45-60 scenario, pipeline configuration, and tooling questions over 120 minutes. Cost is $165 USD with a passing threshold of 700/1000 (70%).
Domains include: (1) Configure processes and communications (~10-15%), (2) Design and implement source control (~15-20%), (3) Design and implement build and release pipelines (~20-25%), (4) Develop a security and compliance plan (~10-15%), and (5) Implement an instrumentation strategy (~10-15%).
To earn the DevOps Engineer Expert certification, candidates must hold either AZ-104 (Azure Administrator) or AZ-204 (Azure Developer) before or after passing AZ-400.
Both provide CI/CD automation. Azure Pipelines offers deep enterprise customization, classic release gates, and tight Azure Boards integration. GitHub Actions is developer-first, tightly coupled with GitHub repositories, and offers a vast community actions marketplace.
Workload Identity Federation uses OpenID Connect (OIDC) to exchange short-lived tokens between GitHub Actions / Azure Pipelines and Microsoft Entra ID, completely eliminating stored credentials and secret rotation.
DevOps engineers utilize Canary deployments (gradual percentage traffic shift), Blue-Green deployments (instant switch between identical environments), and Rolling deployments (updating instances sequentially).
GitOps uses Git repositories as the single source of truth for cluster state. Agents in the Kubernetes cluster pull changes from Git and automatically synchronize the live cluster state with declared manifests.
DevSecOps embeds security across the SDLC. Static Application Security Testing (SAST, e.g. SonarQube, GitHub CodeQL) analyzes source code for vulnerabilities during build; Dynamic Application Security Testing (DAST) inspects running applications.
Dependabot scans open-source dependencies for known vulnerabilities (CVEs) and submits automated pull requests to patch them. SBOM generates an inventory of all software packages and components.
Feature flags allow deploying code to production with features disabled, enabling dark launching, canary testing, and instant rollback without redeploying binaries.
AZ-400 is valid for one year and renewable annually for free via Microsoft Learn.
AZ-400 certifies Senior DevOps Engineers, SRE Leads, and Platform Engineering Directors earning average US salaries between $140,000 and $185,000+.