The AZ-400 exam is how Microsoft certifies the 'DevOps Engineer Expert' role. You cannot sit it on its own — you need to already hold either Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) first. That prerequisite signals exactly who the exam is for: engineers who already have a solid foundation in infrastructure or development and want to validate a DevOps layer on top. The passing score is 700/1000, with roughly 40–60 questions in a 120-minute window.
Two Platforms, One Exam
Imagine a car assembly line where two different robot arms each handle different components. If you mix up which arm does what, the car falls apart. AZ-400 works the same way: knowing which feature belongs to which platform — Azure DevOps or GitHub — is your first task.
Azure DevOps is Microsoft's enterprise DevOps platform, made up of five services: Azure Boards (agile work tracking), Azure Repos (Git or TFVC source control), Azure Pipelines (build and release automation), Azure Artifacts (package feeds), and Azure Test Plans (manual and exploratory testing). GitHub, also under Microsoft, is the developer collaboration platform built around GitHub Actions, GitHub Packages, and GitHub Advanced Security (GHAS).
The two platforms are designed to complement each other. A common pattern that appears in exam questions: source code lives in GitHub, while Azure Pipelines handles build and deploy; or Azure Boards is linked to GitHub Issues so commits and pull requests automatically close work items. Getting platform-specific terminology right matters here — 'self-hosted runner' is the GitHub Actions term, while 'self-hosted agent' is the Azure Pipelines term. Mixing them up is a fast way to lose points.
Six Domains at a Glance
Think of a restaurant kitchen: menu planning, ingredient storage, cooking, serving, food safety, and customer feedback each have their own team. AZ-400's six domains divide the DevOps lifecycle the same way, with each domain owning a distinct slice of responsibility.
| Domain | Core Topics | |--------|-------------| | 1. Process & Communications | Azure Boards, GitHub Issues, DevOps metrics, Wiki automation | | 2. Source Control | Branch strategies, pull request policies, Git LFS | | 3. Build & Release Pipelines | Azure Pipelines, GitHub Actions, IaC, deployment strategies, package management | | 4. Release Engineering | Environment gates, feature flags, deployment slots, zero-downtime deploys | | 5. Security & Compliance | Managed Identity, Key Vault, GHAS, Defender for DevOps | | 6. Instrumentation | Azure Monitor, Application Insights, Log Analytics, KQL |
Domain 3 (Build & Release Pipelines) carries roughly half of the total exam weight. The remaining five domains share the other half in roughly equal proportions. A practical study allocation: spend about half your total study time on Domain 3, then divide the rest evenly across the other five.
!AZ-400's 6 exam domains
Pipelines Are the Heart of the Exam
Picture ten developers all editing the same project at once. On Monday they try to merge their work — and suddenly every file is a conflict. Continuous Integration (CI) solves this by automatically running builds and tests every time code is merged, catching integration problems the moment they appear. Continuous Delivery (CD) takes tested code and pushes it all the way to staging or production automatically.
In AZ-400, CI/CD appears as YAML pipelines. Both Azure Pipelines and GitHub Actions define pipelines in YAML, and the exam tests trigger conditions, multi-stage pipeline structure, and environment approval gates in depth. Infrastructure as Code (IaC) inside pipelines is equally important: Bicep is the Azure-native IaC language that replaced ARM templates with a cleaner syntax; Terraform is the multi-cloud IaC tool. When a question says 'Azure-native IaC' or 'simplify ARM templates,' think Bicep. When it says 'multi-cloud' or 'provider-agnostic,' think Terraform.
Deployment strategies come up regularly too. A blue-green deployment keeps two identical production environments and swaps traffic between them. Canary releases route a small percentage of traffic to the new version first. In Azure App Service, a deployment slot swap is the native blue-green implementation — and it is a favorite exam topic.
Security Baked Into the Pipeline
Leaving a safe's key in a random drawer is asking for trouble. Better to keep it in a locked vault and have it retrieved automatically only when needed. In AZ-400, Azure Key Vault plays exactly that role — secrets, keys, and certificates are stored centrally and referenced by pipelines at runtime, never hardcoded.
For pipeline authentication, the exam tests three models. Service Principal is the traditional Azure AD identity with a client secret or certificate. Managed Identity removes the credential entirely for Azure-hosted compute. Workload Identity Federation (OIDC) is the current recommended approach for GitHub Actions connecting to Azure — no client secret is stored anywhere, because Azure trusts the short-lived token that GitHub issues automatically.
GitHub Advanced Security (GHAS) brings three automated security checks to the code itself: CodeQL performs static analysis (SAST) to find vulnerabilities in source code; Dependabot scans dependencies and opens pull requests to update vulnerable packages; secret scanning detects credentials accidentally committed to repositories. Microsoft Defender for DevOps sits above both platforms, pulling security findings from Azure DevOps and GitHub into a single view in Microsoft Defender for Cloud.
Study Strategy and How to Use This Series
The most common mistake when preparing for AZ-400 is spending all your time reading documentation. The exam is built around scenario questions — 'given this situation, which tool is the right choice?' — so hands-on practice beats memorization every time. Create a free Azure DevOps organization, connect it to a GitHub repository, and write a real YAML pipeline that deploys something. That single exercise covers half of Domain 3 in a way no textbook can replicate.
This series breaks AZ-400 into eleven posts. This post (post 1) is the meta guide covering the full structure, and the other ten continue as follows.
Domains 1–2 (Process and Communications, Source Control): Azure Boards and DORA Metrics, Wiki, Teams Collaboration and Boards–GitHub Integration, Source Control Branching Strategy and PR Policies
Domain 3 (pipelines, IaC, deployment strategies): Azure Artifacts, Packages and Testing Strategy, Azure Pipelines and GitHub Actions, Blue-Green and Canary Deployment Strategies, ARM, Bicep and Terraform IaC
Domain 5 (Security and Compliance): Managed Identity and Key Vault Secrets, GHAS and CodeQL Security Scanning Automation
Domain 6 (Instrumentation): Azure Monitor and Application Insights
If you are starting from scratch, read in order from Azure Boards and DORA Metrics. If you already have some preparation, jump to Azure Pipelines and GitHub Actions and Managed Identity and Key Vault Secrets first — those two are where the highest density of exam weight lives.
Exam Key Takeaways
"Azure-native IaC, simpler than ARM" -- Bicep "Multi-cloud IaC" -- Terraform "Secretless GitHub Actions → Azure authentication" -- Workload Identity Federation (OIDC) "Static code analysis + vulnerable dependency updates" -- GitHub Advanced Security, CodeQL, Dependabot "Unified security dashboard for Azure DevOps and GitHub" -- Microsoft Defender for DevOps "Pipeline execution host (Azure Pipelines term)" -- self-hosted agent "Pipeline execution host (GitHub Actions term)" -- self-hosted runner "Azure Repos branch rules" -- branch policy "GitHub branch rules" -- branch protection rule "Azure-native zero-downtime deployment swap" -- deployment slot swap (Azure App Service) "Pipeline secret reference service" -- Azure Key Vault "AZ-400 prerequisite certification" -- AZ-104 or AZ-204
Ready to test where you stand? Try the AZ-400 practice exam now.