Career Roadmap
Azure DevOps Engineer: Zero to Hero
This roadmap guides you from Azure operations to professional DevOps engineering on Azure. You will design and implement CI/CD pipelines, infrastructure as code, container orchestration, monitoring, and security controls. AZ-104 builds the operational foundation. AZ-400 validates professional DevOps expertise. The roadmap reflects the April 2026 AZ-400 exam update and the AZ-204 retirement on July 31, 2026. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for Azure Administrators and Cloud Engineers transitioning into DevOps who already have operational Azure experience, as well as Software Engineers moving into DevOps who want to build CI/CD and infrastructure automation skills. Additionally, it is tailored for Platform Engineers building internal developer platforms, as well as Site Reliability Engineers who want to deepen their Azure automation expertise.
Skills You'll Develop
Deploy and manage Azure resources with AZ-104-level depth across networking, compute, storage, and identity.
Design and implement YAML pipelines with Azure Pipelines and GitHub Actions, including stages, gates, and approvals.
Automate infrastructure provisioning with Azure Bicep, ARM templates, and Terraform on Azure.
Build and deploy containerized applications with ACR, AKS, Helm, and GitOps.
Implement Azure Monitor, Log Analytics, Application Insights, and SRE principles (SLIs, SLOs, error budgets).
Implement pipeline security, managed identities, Key Vault, and Defender for DevOps.
Target Roles in this Roadmap
- Azure DevOps Engineer: Designs and implements CI/CD pipelines, infrastructure as code, and operational automation
- Platform Engineer: Builds internal developer platforms and infrastructure tooling on Azure
- Cloud Infrastructure Engineer: Automates Azure infrastructure provisioning and configuration management
- DevSecOps Engineer: Embeds security into CI/CD pipelines and infrastructure automation
- Site Reliability Engineer (Azure Focus): Implements monitoring, incident response, and reliability engineering on Azure
Typical Employer Categories
- Technology & Software Firms: SaaS platforms, cloud-native companies, developer tooling vendors on Azure
- Financial Services: Banking, fintech, payment processors, and trading platforms running on Azure
- Healthcare Organizations: Patient data platforms, HIPAA-compliant workloads on Azure
- Consulting & Professional Services: Azure DevOps assessments, transformation engagements, managed DevOps providers
- Government & Public Sector: Federal agencies, state government, public sector Azure migrations
- Microsoft Partners: Azure Managed Service Providers (MSPs), Azure Expert MSPs, and system integrators
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| Microsoft AZ-104 (Azure Administrator) | Month 2-4 | Azure operational foundation. Required for the DevOps Engineer Expert badge. |
| Microsoft AZ-400 (DevOps Engineer Expert) | Month 6-12 | The core Azure DevOps credential. Validates CI/CD pipelines, IaC, and platform engineering. |
Optional Foundation
| Cert | When | Why |
|---|---|---|
| Microsoft AZ-900 (Azure Fundamentals) | Month 1 | Optional warm-up. Only needed if you are completely new to Azure. |
Specialization Path
| Cert | When | Why |
|---|---|---|
| CNCF CKA (Certified Kubernetes Administrator) | Month 12-16 | Hands-on Kubernetes depth. Required for platform engineering and AKS-focused roles. |
| HashiCorp Terraform Associate | Month 12-16 | Vendor-neutral IaC fluency. Optional but highly practical for multi-cloud environments. |
| Microsoft SC-500 (Cloud and AI Security Engineer) | Month 12-16 | Security depth for DevOps engineers. Only if your role demands security focus. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level | AZ-104 + basic pipeline knowledge | Month 4-5 |
| Practitioner Level | AZ-400 + pipeline automation skills | Month 10-12 |
| Specialist Level | AZ-400 + CKA + platform engineering skills | Month 14+ |
Step 0 - Azure operations and DevOps foundations
Build operational Azure knowledge and DevOps foundations. AZ-104 is the recommended prerequisite for AZ-400 and is required for the DevOps Engineer Expert badge.
~3-4 months~3-4 months
Step 0 - Azure operations and DevOps foundations
Build operational Azure knowledge and DevOps foundations. AZ-104 is the recommended prerequisite for AZ-400 and is required for the DevOps Engineer Expert badge.
- Azure resource hierarchy: Management Groups, Subscriptions, Resource Groups
- Azure networking: VNets, subnets, NSGs, load balancers, VNet peering, Private Endpoints
- Azure compute: VMs, scale sets, App Services, Azure Container Instances, AKS basics
- Azure storage: Storage Accounts, access control, lifecycle management, redundancy options
- Microsoft Entra ID: users, groups, roles, RBAC, service principals, managed identities
- Azure Monitor and Log Analytics: diagnostic settings, log queries (KQL basics), metric alerts
- Azure Policy and governance fundamentals
- Git fundamentals: branching strategies (GitFlow, trunk-based), pull requests, branch protection
- Linux basics: file system, permissions, bash scripting, process management
- YAML syntax: the language of modern Azure Pipelines and GitHub Actions
Certifications
💡 AZ-104 is required to earn the Microsoft Certified DevOps Engineer Expert badge after passing AZ-400. You can sit AZ-400 without it, but the Expert certification only activates when you hold either AZ-104 or AZ-204.
💡 AZ-900 (Azure Fundamentals) is optional. If you are completely new to Azure, take it as a warm-up (2-3 weeks). If you already have any Azure or IT experience, skip it and go straight to AZ-104.
💡 GitHub Foundations (GH-900) is optional. Only sit it if you are completely new to Git and GitHub. Most candidates should skip this.
🏁 Entry Level Checkpoint: You have passed AZ-104. You can reason through Azure networking, RBAC, and compute scenarios confidently.
🛠 Project Ideas
- ▸Deploy a VNet with subnets, NSGs, and a load balancer. Deploy a VM and App Service, and configure connectivity.
- ▸Write an Azure Policy that enforces tagging and denies creation of unencrypted storage accounts.
- ▸Set up a Git repository with branch protection rules and a pull request workflow.
Step 1 - Azure DevOps engineering (AZ-400)
Build professional-level DevOps skills on Azure. AZ-400 covers CI/CD pipelines (50-55% of exam), infrastructure as code (10-15%), containers and Kubernetes, monitoring and observability, and security and compliance.
~4-6 months~4-6 months
Step 1 - Azure DevOps engineering (AZ-400)
Build professional-level DevOps skills on Azure. AZ-400 covers CI/CD pipelines (50-55% of exam), infrastructure as code (10-15%), containers and Kubernetes, monitoring and observability, and security and compliance.
- CI/CD Pipelines (50-55% — heaviest domain): Azure Pipelines and GitHub Actions YAML authoring, stages, jobs, steps, templates, variables, conditions, approvals, gates, service connections, agent pools
- Infrastructure as Code (10-15%): Azure Bicep (syntax, modules, parameters, deployment), Terraform on Azure (providers, state management, remote backends), ARM templates, choosing between Bicep and Terraform
- Containers and Kubernetes: Docker, Azure Container Registry (ACR), Azure Kubernetes Service (AKS), Helm charts, GitOps with ArgoCD or Flux
- Monitoring and Observability: Azure Monitor, Log Analytics, KQL, Application Insights, SRE principles (SLIs, SLOs, SLAs, error budgets), distributed tracing
- Security and Compliance: Managed identities, service principals, RBAC, Key Vault (secrets, keys, certificates), Microsoft Defender for DevOps, supply chain security (SBOM, dependency scanning)
- Pipeline Security: service connections, secret management, least-privilege permissions, OIDC authentication
Certifications
💡 CI/CD pipelines account for approximately 50-55% of the AZ-400 exam. This is the highest-weighted domain by a significant margin. Invest proportionally more time here.
💡 The AZ-400 was updated April 24, 2026. Review the current skills outline on Microsoft Learn before booking. The update increased emphasis on GitHub Actions alongside Azure Pipelines.
💡 Infrastructure as code is a 10-15% domain on AZ-400 and one where candidates frequently underestimate the depth required. Bicep and Terraform are both testable.
🏁 Practitioner Level Checkpoint: You have passed AZ-400. You can design and implement end-to-end DevOps workflows on Azure.
🛠 Project Ideas
- ▸Build a complete CI/CD pipeline with Azure Pipelines or GitHub Actions. Implement a blue-green deployment strategy with approval gates and automated rollback.
- ▸Write a Bicep module for a multi-tier application. Deploy it to development, staging, and production environments using pipeline stages.
- ▸Configure Azure Container Registry with AKS. Deploy a containerized application using Helm and implement GitOps with ArgoCD.
- ▸Set up Application Insights with availability tests. Create a dashboard for the four golden signals (latency, traffic, errors, saturation).
Step 2 - Exam consolidation and follow-on paths
Consolidate AZ-400 preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exam. Identify follow-on credentials that extend your Azure DevOps capability.
~1 month~1 month
Step 2 - Exam consolidation and follow-on paths
Consolidate AZ-400 preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exam. Identify follow-on credentials that extend your Azure DevOps capability.
- Full-domain scenario practice across all AZ-400 domains (CI/CD 50-55%, IaC 10-15%, Containers, Monitoring, Security)
- Timed simulations for AZ-400 (40-60 questions, 150 minutes)
- Official Microsoft practice exams and domain-weighted review
- Follow-on paths: CKA (Certified Kubernetes Administrator) for Kubernetes depth, SC-500 for security focus, Terraform Associate for IaC breadth
Certifications
💡 Consistent performance above 80% on Legend mode across five consecutive ExamOS sessions is the clearest readiness signal for AZ-400.
💡 The most common Azure DevOps failure pattern is knowing what services exist without being able to reason through which is correct for a described scenario with multiple plausible alternatives.
💡 CKA is the strongest follow-on for Kubernetes depth and platform engineering roles.
💡 SC-500 is the natural follow-on for security-focused DevOps engineers.
💡 Terraform Associate adds vendor-neutral IaC breadth for multi-cloud environments.
🏁 Specialist Level Checkpoint: You have passed your target certifications. You can design and implement DevOps workflows on Azure at an enterprise level.
Final Step - What this path actually builds
This roadmap moves you from Azure operations to professional DevOps engineering. AZ-104 validates that you understand Azure infrastructure. AZ-400 validates that you can design and implement end-to-end DevOps workflows including CI/CD pipelines, infrastructure as code, container orchestration, monitoring, and security. CI/CD pipelines account for 50-55% of the exam—the credential recognizes that pipeline design is the most critical DevOps skill. The April 2026 exam update increased emphasis on GitHub Actions alongside Azure Pipelines. After AZ-400, CKA is the strongest follow-on for Kubernetes depth and platform engineering, SC-500 is the natural follow-on for security-focused DevOps engineers, and Terraform Associate adds vendor-neutral IaC breadth. Build real pipelines. Measure your readiness with ExamOS. Book when your reasoning is sharp and your automation is reliable.
Final Step - What this path actually builds
This roadmap moves you from Azure operations to professional DevOps engineering. AZ-104 validates that you understand Azure infrastructure. AZ-400 validates that you can design and implement end-to-end DevOps workflows including CI/CD pipelines, infrastructure as code, container orchestration, monitoring, and security. CI/CD pipelines account for 50-55% of the exam—the credential recognizes that pipeline design is the most critical DevOps skill. The April 2026 exam update increased emphasis on GitHub Actions alongside Azure Pipelines. After AZ-400, CKA is the strongest follow-on for Kubernetes depth and platform engineering, SC-500 is the natural follow-on for security-focused DevOps engineers, and Terraform Associate adds vendor-neutral IaC breadth. Build real pipelines. Measure your readiness with ExamOS. Book when your reasoning is sharp and your automation is reliable.
Final Thoughts
💡 Total: 10-16 months at 2 hours/day (8-12 months at 3-4 hours/day)
💡 AZ-900: Adds 2-3 weeks for complete beginners (optional).
💡 AZ-104: Typically takes 6-10 weeks for candidates with general IT experience.
💡 AZ-400: Typically takes 10-16 weeks for candidates with AZ-104 knowledge.
💡 **CI/CD pipelines account for 50-55% of AZ-400—allocate proportionally more study time.
💡 AZ-204 retires July 31, 2026—AZ-104 becomes the primary prerequisite path after that date.
💡 Readiness: Consistent 80%+ on Legend mode across five sessions is your signal to book.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| AZ-900 only (optional) | ~2 weeks | ~1 month |
| AZ-104 only | ~2 months | ~3 months |
| AZ-104 + AZ-400 | ~6 months | ~10 months |
| AZ-104 + AZ-400 + CKA | ~8 months | ~14 months |