Career Roadmap
Azure DevOps Engineer: Zero to Hero
Build practical DevOps skills first, then validate readiness with certifications. This roadmap reflects the 2026 Azure certification landscape including AZ-204's retirement, AZ-104 as the standard AZ-400 prerequisite, and the April 2026 AZ-400 exam update. Use ExamOS practice quizzes at every step to make progress measurable before each exam attempt.
Embark on your career roadmap by setting a target and staying accountable
Set targetStep 0 - Core technical foundations
Build the technical baseline that every Azure DevOps concept builds on. Skipping this step is the most common reason early-career candidates struggle later.
2-4 weeks2-4 weeks
Step 0 - Core technical foundations
Build the technical baseline that every Azure DevOps concept builds on. Skipping this step is the most common reason early-career candidates struggle later.
- Git fundamentals — branching strategies, merging, rebasing, pull requests, branch protection rules
- Linux basics — file system, permissions, processes, shell scripting essentials
- Networking fundamentals — HTTP, DNS, TCP/IP, ports, TLS, load balancing concepts
- YAML syntax and structure — this is the language of modern pipelines
- Command line confidence — navigating, scripting, and automating basic tasks
Certifications
💡 GitHub Foundations (GH-900) validates source control and collaborative development fundamentals. It is the right first credential for this path because Git and GitHub are foundational to every subsequent step.
💡 Use ExamOS quizzes to validate Git workflow and source control understanding before attempting GH-900.
💡 Do not underinvest here. Weak Git fundamentals surface as problems throughout the entire path.
Step 1 - Azure Administrator fundamentals (AZ-104)
Build operational Azure knowledge across compute, networking, storage, and identity. This is now the standard prerequisite for AZ-400 and is non-negotiable for the DevOps Engineer Expert certification.
6-8 weeks6-8 weeks
Step 1 - Azure Administrator fundamentals (AZ-104)
Build operational Azure knowledge across compute, networking, storage, and identity. This is now the standard prerequisite for AZ-400 and is non-negotiable for the DevOps Engineer Expert certification.
- Azure resource hierarchy — Management Groups, Subscriptions, Resource Groups, Resources
- Virtual Machines, scale sets, and compute fundamentals
- Azure Networking — VNets, NSGs, load balancers, VNet peering, Private Endpoints
- Storage Accounts — types, tiers, access control, lifecycle management
- Microsoft Entra ID (formerly Azure AD) — users, groups, roles, RBAC
- Azure Monitor, Log Analytics, and diagnostic settings
- Azure Policy and governance fundamentals
Certifications
💡 AZ-104 is required to earn the Microsoft Certified DevOps Engineer Expert badge after passing AZ-400. You can sit AZ-400 without it, but the Expert certification only activates when you hold either AZ-104 or AZ-204.
💡 If you are starting this path after July 2026, complete AZ-104 as your prerequisite. Do not plan around AZ-204.
💡 Use ExamOS daily scenario practice to identify weak areas in networking and identity before your exam, the two domains that consistently catch candidates.
💡 Passing AZ-900 first is optional. Candidates with no Azure background may benefit from it. Candidates with IT experience should go directly to AZ-104.
Step 2 - DevOps principles and practices
Understand the culture, principles, and workflows that underpin DevOps before touching the specific tooling.
2-3 weeks2-3 weeks
Step 2 - DevOps principles and practices
Understand the culture, principles, and workflows that underpin DevOps before touching the specific tooling.
- What DevOps actually is — culture, collaboration, and shared ownership
- The software delivery lifecycle — Code, Build, Test, Deploy, Monitor, Feedback
- CI versus CD versus continuous deployment — knowing the differences matters
- Shift-left testing and why it reduces cost
- Site Reliability Engineering (SRE) principles — SLIs, SLOs, SLAs, error budgets
- Feedback loops and how monitoring connects back to development
- The difference between DevOps and Platform Engineering in 2026
💡 This step has no certification associated with it but directly influences how well you understand AZ-400 scenarios.
💡 SRE strategy is a 5-10% domain on the updated AZ-400 (April 2026). Candidates who skip this conceptual foundation regularly miss these questions.
💡 The Gene Kim books (The Phoenix Project, The Unicorn Project) are widely recommended for building the mental model behind DevOps culture. The concepts appear in AZ-400 scenario questions more often than candidates expect.
Step 3 - Azure DevOps and GitHub Actions pipelines
Build real pipeline skills using Azure DevOps and GitHub Actions. This is the core of what AZ-400 tests and where the most exam weight sits.
4-5 weeks4-5 weeks
Step 3 - Azure DevOps and GitHub Actions pipelines
Build real pipeline skills using Azure DevOps and GitHub Actions. This is the core of what AZ-400 tests and where the most exam weight sits.
- Azure DevOps services — Repos, Pipelines, Artifacts, Boards, Test Plans
- GitHub Actions — workflows, triggers, jobs, steps, runners, reusable workflows
- YAML pipeline authoring — stages, jobs, steps, templates, variables, conditions
- Build pipelines — compiling, testing, packaging, publishing artifacts
- Release pipelines — deployment environments, approvals, gates
- Pipeline security — service connections, secrets, pipeline permissions
- Multi-stage pipelines and environment-specific deployments
Certifications
💡 CI/CD pipelines account for approximately 50-55% of the AZ-400 exam. This is the highest-weighted domain by a significant margin.
💡 The AZ-400 was updated April 24, 2026. Review the current skills outline on Microsoft Learn before booking. The update increased emphasis on GitHub Actions alongside Azure Pipelines.
💡 Use ExamOS quizzes regularly throughout this step. This is where concepts begin getting tested at scenario depth.
💡 Build real pipelines in a personal Azure DevOps organization and GitHub repository. Reading about pipelines is insufficient. Scenario questions assume hands-on familiarity.
Step 4 - Infrastructure as code and configuration management
Move from manual provisioning to repeatable, version-controlled infrastructure. This is how modern DevOps teams manage cloud environments at scale.
4-6 weeks4-6 weeks
Step 4 - Infrastructure as code and configuration management
Move from manual provisioning to repeatable, version-controlled infrastructure. This is how modern DevOps teams manage cloud environments at scale.
- Azure Bicep — syntax, modules, parameters, deployment modes
- Terraform on Azure — providers, state management, modules, workspaces
- Choosing between Bicep and Terraform and when to use each
- ARM templates — understanding the underlying format even if Bicep is preferred
- Configuration management concepts — desired state, drift detection
- Deploying full environments using IaC through Azure Pipelines and GitHub Actions
- Azure Deployment Environments and Azure Developer CLI
💡 Infrastructure as code is a 10-15% domain on AZ-400 and one where candidates frequently underestimate the depth required.
💡 HashiCorp Terraform Associate is an optional but highly practical credential that signals IaC fluency to employers. It is vendor-neutral and widely recognized alongside AZ-400 in job postings.
💡 Use ExamOS quizzes to test scenario-based IaC decision-making — knowing when to use Bicep versus Terraform, and what happens when deployments fail or drift.
💡 Hands-on labs matter here more than theory. Build and destroy real environments using both Bicep and Terraform before your exam.
Step 5 - Containers, Kubernetes, and AKS
Understand how modern applications are packaged, deployed, and managed at scale using containers and Kubernetes on Azure.
4-6 weeks4-6 weeks
Step 5 - Containers, Kubernetes, and AKS
Understand how modern applications are packaged, deployed, and managed at scale using containers and Kubernetes on Azure.
- Docker fundamentals — images, containers, registries, Dockerfile best practices
- Azure Container Registry (ACR) — building, storing, and managing container images
- Kubernetes architecture — nodes, pods, deployments, services, namespaces, RBAC
- Azure Kubernetes Service (AKS) — cluster creation, node pools, scaling, upgrades
- Helm — packaging and deploying applications to Kubernetes clusters
- GitOps with ArgoCD or Flux — declarative deployment to Kubernetes from Git
- Container security — image scanning, runtime security, admission controllers
💡 Kubernetes and Networking Concepts Associate (KCNA) provides a solid Kubernetes conceptual foundation and is a practical first Kubernetes credential.
💡 Certified Kubernetes Administrator (CKA) is the stronger follow-on credential and one of the most respected hands-on certifications in DevOps and platform engineering. It requires genuine operational Kubernetes experience and is fully hands-on with no multiple-choice component.
💡 If your target role involves AKS operations or platform engineering, invest the time in CKA. It differentiates your profile significantly from AZ-400-only candidates.
💡 Use ExamOS quizzes to test Kubernetes concepts and AKS architecture scenarios before sitting KCNA.
Step 6 - Monitoring, observability, and SRE practice
Understand what happens after deployment — how to measure system health, detect problems early, and create the feedback loops that improve delivery.
2-3 weeks2-3 weeks
Step 6 - Monitoring, observability, and SRE practice
Understand what happens after deployment — how to measure system health, detect problems early, and create the feedback loops that improve delivery.
- Azure Monitor — metrics, alerts, action groups, autoscale
- Log Analytics workspaces and KQL query fundamentals
- Application Insights — distributed tracing, dependency tracking, performance monitoring
- Dashboards and workbooks for operational visibility
- SRE in practice — defining SLIs and SLOs for real services, managing error budgets
- Alert fatigue management and meaningful signal versus noise
- Connecting monitoring data back to pipeline decisions
Certifications
💡 SRE strategy (5-10%) and instrumentation (5-10%) together account for up to 20% of AZ-400. Most candidates underweight monitoring preparation relative to its exam presence.
💡 Azure Monitor, Log Analytics, and Application Insights appear in scenario questions regularly. Understand not just what they are but how they work together in a production monitoring setup.
💡 Use ExamOS for scenario-based monitoring questions that describe a broken or incomplete observability setup and ask what to configure.
Step 7 - Security, compliance, and DevSecOps
Embed security into every part of your pipeline and infrastructure. Security and compliance planning is a 10-15% domain on AZ-400 and increasingly central to what DevOps engineers own.
3-4 weeks3-4 weeks
Step 7 - Security, compliance, and DevSecOps
Embed security into every part of your pipeline and infrastructure. Security and compliance planning is a 10-15% domain on AZ-400 and increasingly central to what DevOps engineers own.
- Microsoft Entra ID and workload identity — managed identities, service principals, federated credentials
- RBAC design for Azure resources, pipelines, and Kubernetes clusters
- Azure Key Vault — secrets, certificates, keys, pipeline integration
- Secure pipeline patterns — secret scanning, credential rotation, least-privilege service connections
- Microsoft Defender for DevOps — pipeline security scanning, IaC scanning
- Supply chain security — dependency scanning, SBOM, signed artifacts
- Compliance automation — Azure Policy in DevOps workflows, policy-as-code with OPA
Certifications
💡 Security and compliance planning is 10-15% of AZ-400 and has increased in emphasis with the April 2026 update.
💡 DevSecOps is increasingly a core expectation for DevOps engineer roles, not a specialization. Security knowledge embedded throughout your pipeline work is more valuable than treating it as a separate topic.
💡 Use ExamOS to identify security gaps — especially around pipeline permission models and Key Vault integration scenarios — before your exam.
Step 8 - Platform engineering and advanced practices
Extend your DevOps capabilities toward platform engineering — building the internal platforms and golden paths that development teams consume. This is the direction most senior DevOps roles are moving in 2026.
OngoingOngoing
Step 8 - Platform engineering and advanced practices
Extend your DevOps capabilities toward platform engineering — building the internal platforms and golden paths that development teams consume. This is the direction most senior DevOps roles are moving in 2026.
- Internal Developer Platforms (IDPs) and the platform engineering model
- Azure Developer CLI and Azure Deployment Environments as platform primitives
- Backstage and service catalog concepts for developer self-service
- GitOps at scale — managing multiple clusters and environments declaratively
- Cost optimization in DevOps — FinOps principles applied to pipeline and infrastructure spend
- AI-assisted DevOps — GitHub Copilot in pipelines, AI-generated IaC, intelligent monitoring
- Team topology and how platform teams relate to stream-aligned teams
💡 No single certification covers platform engineering as a discipline yet. CKA plus AZ-400 plus Terraform Associate is the closest credential combination to a recognized platform engineering stack.
💡 AI is increasingly embedded in DevOps tooling. GitHub Copilot for pipeline authoring, Microsoft Defender for DevOps AI scanning, and AI-assisted incident response are all appearing in real roles. Understanding where AI fits in the delivery lifecycle is becoming a baseline expectation.
💡 The shift from DevOps generalist to platform engineer is the highest-leverage career move available to AZ-400 holders in 2026.
Final step - Certification, readiness validation, and continuous improvement
Before booking AZ-400, confirm you hold either AZ-104 or a valid AZ-204 (if earned before July 31, 2026). Run at least three full timed ExamOS practice sessions under exam conditions. Scores should be stable above 80% on Legend mode across multiple sessions before you book — one strong session is not enough. After passing AZ-400, the most valuable next investments are CKA for Kubernetes depth and Terraform Associate for IaC breadth. Both significantly strengthen the platform engineering profile that employers increasingly want from AZ-400 holders.
Final step - Certification, readiness validation, and continuous improvement
Before booking AZ-400, confirm you hold either AZ-104 or a valid AZ-204 (if earned before July 31, 2026). Run at least three full timed ExamOS practice sessions under exam conditions. Scores should be stable above 80% on Legend mode across multiple sessions before you book — one strong session is not enough. After passing AZ-400, the most valuable next investments are CKA for Kubernetes depth and Terraform Associate for IaC breadth. Both significantly strengthen the platform engineering profile that employers increasingly want from AZ-400 holders.
Certifications
Realistic timeline
- 2 hours per day: approximately 6-8 months for the complete path
- 3-4 hours per day: approximately 4-5 months
- AZ-104 alone typically takes 6-10 weeks for candidates without existing Azure administration experience
- AZ-400 typically takes 8-16 weeks after completing the prerequisite
- Consistency across daily sessions matters more than occasional long study blocks
- Hands-on lab time counts as study time — build real pipelines and infrastructure, not just notes
Embark on your career roadmap by setting a target and staying accountable
Set target