Microsoft DevOps Engineer Expert (AZ-400)
Design and implement Microsoft DevOps solutions with Azure DevOps, GitHub, pipelines, security and monitoring. Lessons, exam-style practice, timed mocks and an AI tutor, mapped to every objective of the official exam guide.
Free Included · 7-day free trial
The exam
- Questions
- 50
- Time
- 100 minutes
- Passing score
- 700 on a scale of 1 to 1000
- Exam fee
- USD 165 (US price; varies by country, excludes taxes; confirm on the exam page when booking)
- Valid for
- 1 year; renew for free with an online assessment on Microsoft Learn in the 6 months before expiry
- Delivery
- Online proctored (Pearson VUE) or test center
Official exam page · booked with Microsoft
Every section of the exam guide
5 sections and 86 objectives, in the official weights. Each lesson is mapped to the objectives it covers.
Section 1 · Design and implement processes and communications13%
What the exam asks
- Design and implement a structure for the flow of work, including GitHub Flow
- Design and implement a strategy for feedback cycles, including notifications and GitHub Issues
- Design and implement integration for tracking work, including GitHub projects, Azure Boards, and repositories
- Design and implement source, bug, and quality traceability
- Design and implement a dashboard, including flow of work, such as cycle times, time to recovery, and lead time
- Design and implement appropriate metrics and queries for project planning
- Design and implement appropriate metrics and queries for development
- Design and implement appropriate metrics and queries for testing
- Design and implement appropriate metrics and queries for security
- Design and implement appropriate metrics and queries for delivery
- Design and implement appropriate metrics and queries for operations
- Document a project by configuring wikis and process diagrams, including Markdown and Mermaid syntax
- Configure release documentation, including release notes and API documentation
- Automate creation of documentation from Git history
- Configure integration by using webhooks
- Configure integration between Azure Boards and GitHub repositories
- Configure integration between GitHub or Azure DevOps and Microsoft Teams
Lessons
- Flow of work, feedback and traceability
- Dashboards, flow metrics and queries
- Documentation, release notes and integrations
Section 2 · Design and implement a source control strategy13%
What the exam asks
- Design a branch strategy, including trunk-based, feature branch, and release branch
- Design and implement a pull request workflow by using branch policies and branch protection rules
- Implement branch merging restrictions by using branch policies and branch protection rules
- Design and implement a strategy for managing large files, including Git Large File Storage (LFS) and git-fat
- Design a strategy for scaling and optimizing a Git repository, including Scalar and cross-repository sharing
- Configure permissions in the source control repository
- Configure tags to organize the source control repository
- Recover specific data by using Git commands
- Remove specific data from source control
Lessons
- Branch strategies, pull request workflows and merge restrictions
- Large files, repository scaling and permissions
- Tags, recovering data and removing data from Git
Section 3 · Design and implement build and release pipelines53%
What the exam asks
- Recommend package management tools including GitHub Packages and Azure Artifacts
- Design and implement package feeds and views for local and upstream packages
- Design and implement a dependency versioning strategy for code assets and packages, including semantic versioning (SemVer) and date-based (CalVer)
- Design and implement a versioning strategy for pipeline artifacts
- Design and implement quality and release gates, including security and governance
- Design a comprehensive testing strategy, including local tests, unit tests, integration tests, and load tests
- Implement tests in a pipeline, including configuring test tasks, configuring test agents, and integration of test results
- Implement code coverage analysis
- Select a deployment automation solution, including GitHub Actions and Azure Pipelines
- Design and implement a GitHub runner or Azure DevOps agent infrastructure, including cost, tool selection, licenses, connectivity, and maintainability
- Design and implement integration between GitHub repositories and Azure Pipelines
- Develop and implement pipeline trigger rules
- Develop pipelines by using YAML
- Design and implement a strategy for job execution order, including parallelism and multi-stage pipelines
- Develop and implement complex pipeline scenarios, such as hybrid pipelines, VM templates, and self-hosted runners or agents
- Create reusable pipeline elements, including YAML templates, task groups, variables, and variable groups
- Design and implement checks and approvals by using YAML-based environments
- Design a deployment strategy, including blue-green, canary, ring, progressive exposure, feature flags, and A/B testing
- Design a pipeline to ensure that dependency deployments are reliably ordered
- Plan for minimizing downtime during deployments by using load balancing, rolling deployments, and deployment slot usage and swap
- Design a hotfix path plan for responding to high-priority code fixes
- Design and implement a resiliency strategy for deployment
- Implement feature flags by using Azure App Configuration Feature Manager
- Implement application deployment by using containers, binaries, and scripts
- Implement a deployment that includes database tasks
- Recommend a configuration management technology for application infrastructure
- Implement a configuration management strategy for application infrastructure
- Define an IaC strategy, including source control and automation of testing and deployment
- Design and implement desired state configuration for environments, including Azure Automation State Configuration, Azure Resource Manager, Bicep, and Azure Machine Configuration
- Design and implement Azure Deployment Environments for on-demand self-deployment
- Monitor pipeline health, including failure rate, duration, and flaky tests
- Optimize a pipeline for cost, time, performance, and reliability
- Optimize pipeline concurrency for performance and cost
- Design and implement a retention strategy for pipeline artifacts and dependencies
- Migrate a pipeline from classic to YAML in Azure Pipelines
Lessons
- Packages, feeds and versioning
- Quality gates, testing strategy and code coverage
- Choosing the automation platform, agents, runners and triggers
- YAML pipelines: structure, ordering, reuse and environments
- Deployment strategies, resiliency, feature flags and application deployment
- Configuration management, infrastructure as code and pipeline operations
Section 4 · Develop a security and compliance plan13%
What the exam asks
- Choose between Microsoft Entra service principals and managed identities for Azure resources (system-assigned and user-assigned)
- Implement and manage GitHub authentication, including GitHub Apps, GITHUB_TOKEN, and personal access tokens
- Implement and manage Azure DevOps service connections and personal access tokens
- Design and implement permissions and roles in GitHub
- Design and implement permissions and security groups in Azure DevOps
- Recommend appropriate access levels, including stakeholder access in Azure DevOps and outside collaborator access in GitHub
- Configure projects and teams in Azure DevOps
- Implement and manage secrets, keys, and certificates by using Azure Key Vault
- Implement and manage secrets and secretless authentication (for example, workload identity federation/OpenID Connect) in GitHub Actions and Azure Pipelines
- Design and implement a strategy for managing sensitive files during deployment, including Azure Pipelines secure files
- Design pipelines to prevent leakage of sensitive information
- Design a strategy for security and compliance scanning, including dependency, code, secret, and licensing scanning
- Configure Microsoft Defender for Cloud DevOps Security
- Configure GitHub Advanced Security for GitHub and GitHub Advanced Security for Azure DevOps
- Integrate GitHub Advanced Security with Microsoft Defender for Cloud
- Automate container scanning, including scanning container images and configuring an action to run CodeQL analysis in a container
- Automate analysis of vulnerabilities of open-source components by using Dependabot alerts
Lessons
- Workload identities and credentials: Entra, GitHub and Azure DevOps
- Permissions, roles, access levels and projects
- Secrets, Key Vault, OIDC and keeping sensitive data out of pipelines
- Security and compliance scanning: GitHub Advanced Security, Defender for Cloud and Dependabot
Section 5 · Implement an instrumentation strategy8%
What the exam asks
- Configure Azure Monitor and Azure Monitor Logs to integrate with DevOps tools
- Configure collection of telemetry by using Azure Monitor Application Insights, Azure VM Insights, Azure Container Insights, Azure Monitor for Storage, and Azure Monitor for Networks
- Configure monitoring in GitHub, including enabling insights and creating and configuring charts
- Configure alerts for events in GitHub Actions and Azure Pipelines
- Inspect infrastructure performance indicators, including CPU, memory, disk, and network
- Analyze metrics by using collected telemetry, including usage and application performance
- Inspect distributed tracing by using Azure Monitor Application Insights
- Interrogate logs using basic Kusto Query Language (KQL) queries
Lessons
- Azure Monitor, Application Insights and infrastructure telemetry
- Monitoring and alerts in GitHub, Azure Pipelines and Azure Monitor
- Analyzing telemetry, distributed tracing and KQL
21-Day Complete Plan
The default path. It covers all 19 lessons and all 10 labs in order, with a section drill after each section, daily flashcards, and the four mock exams on days 17, 18, 20 and 21. Build and release pipelines is about half of the exam, so it gets 8 of the 21 days. Plan the labs for days when you can sign in to an Azure subscription and a GitHub account, and delete resources after each one. About 1.5–2.5 hours a day.
- Day 1Start here: the exam, the flow of work and feedback
- Day 2Documentation, webhooks and integrations; first lab
- Day 3Process lab, process drill, then branching strategies
- Day 4Large files, scaling, permissions, tags and recovery
- Day 5Source control labs and drill
- Day 6Packages, feeds, versioning and quality gates
- Day 7Choosing the platform, agents, runners and triggers; YAML structure
- … and 14 more days, with mock exams at the end
Sample questions
Written for practice in the style of the real exam: never questions from the real exam.
Sample question 1
A monorepo on Azure Repos is 80 GB. Engineers work in only two services but wait hours for git clone and git status is slow. The team wants the largest improvement with the least manual Git tuning. What should they use?
- AA shallow clone with --depth 1 on every developer machine, deepened later with git fetch --deepen when history is needed
- BScalar: scalar clone (partial clone and sparse checkout), then git sparse-checkout set for the two services
- CGit submodules for each service so that developers clone and update only the two repositories they work in
- DNightly git gc --aggressive and git prune on every developer machine to compress the local object database
Show the answer
B. Scalar configures Git for large repositories: partial clone (commits and trees first), sparse checkout, commit-graph and background maintenance. After scalar clone, git sparse-checkout set <folders> expands only the needed directories.
Sample question 2
An administrator must install a Marketplace extension and change an organization-level pipeline policy in Azure DevOps Services. Which membership is required?
- AProject Administrators in one project
- BContributors in every project
- CProject Collection Administrators
- DRelease Administrators
Show the answer
C. Project Collection Administrators administer the whole organization (collection). Project Administrators are scoped to a project and Contributors work with project content.
About this exam
Do I need AZ-104 or AZ-204 before AZ-400?
No. You can sit AZ-400 without a prerequisite, but the DevOps Engineer Expert certification is awarded only when you also hold Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204).
How many questions and how long?
Microsoft does not publish the question count for AZ-400. Role-based associate and expert exams without labs get 100 minutes (120 if they may contain labs), and most Microsoft exams have 40 to 60 questions. The mock exams here use 50 questions in 100 minutes.
What score do I need?
700 on a scale of 1 to 1000. It is scaled, so it is not exactly 70% correct, and there is no penalty for wrong answers.
Can I use Microsoft Learn during the exam?
Yes, on associate and expert exams, from the left navigation pane. The whole learn.microsoft.com domain is available except Q&A, practice assessments and your profile. The time is not extended. GitHub documentation is blocked.
Is the exam open book for GitHub topics?
Only Microsoft Learn is available, so GitHub-specific settings (branch protection options, Actions permissions, Dependabot) must come from memory. Learn does cover some GitHub integration topics for Azure DevOps and Azure.
What changed in the July 2026 version?
Minor changes to the traceability and flow of work group, the security and compliance scanning group, and both instrumentation groups. The five sections and the weights are unchanged. This course follows the 27 July 2026 skills.
Which is more important, Azure DevOps or GitHub?
Both. The skills outline names both everywhere. Section 3 is about half the exam and covers Azure Pipelines and GitHub Actions side by side, so learn the equivalent for each feature (the Same requirement, different tools table on the Strategy page).
Several services in the lessons are retiring. Will the exam test them?
The skills outline still lists Azure Automation State Configuration and Azure Deployment Environments, so you must know what they do. Also know the replacement and the date. Questions about new designs expect the current service.
Do the labs cost money?
The labs run on the Azure DevOps free tier, GitHub Free and an Azure free account, but extra parallel jobs, hosted agents, larger Artifacts storage, GitHub Advanced Security on private repositories and Azure resources cost money. Delete resource groups, feeds, service connections and test repositories when you finish.
What if I fail?
You can retake after 24 hours. Later retakes wait 14 days, up to five attempts in 12 months. Your score report shows performance per skill area; use it to choose which section drills to repeat.
See where you stand in 8 minutes
Ten questions from this course, weighted like the real exam, with your score by section and a rough chance of passing.