AZ-400 study plan

Your step-by-step plan

1. Map the blueprint and book a date

   Day 1

   Read Microsoft's skills-measured outline and the five domains with their weights, and note immediately that build and release pipelines is over half the exam while processes, source control, security, and instrumentation share the rest. Book a provisional date now: a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting. Weight your calendar to match the weighting.

2. Build the requirement-to-capability maps

   Week 1

   Before drilling any domain, build the decision maps the whole exam rests on: the "Azure DevOps" versus "GitHub" vocabulary (branch policies versus branch protection rules, "Azure Artifacts" versus "GitHub Packages", "GitHub Advanced Security" versus "Microsoft Defender for Cloud"), and the requirement keywords (least downtime, gradual exposure, no long-lived secret, least operational overhead). Use the recall prompts in this guide: cover the answer, choose from the constraint, then reveal. If you cannot pick from the requirement alone, you do not own it yet.

3. Go deep on Build and Release Pipelines, part one

   Weeks 1 to 3

   This is over half the exam, so it gets the most time. Start with YAML mechanics until they are automatic: multi-stage pipelines, triggers, job order and parallelism, output variables through the dependencies context, pipeline resources and pipeline-completion triggers, templates, and variable groups. Author real pipelines, do not just read them. Then add package management: "Azure Artifacts" feeds, views, and upstream sources, "GitHub Packages", and SemVer versus CalVer versioning.

4. Finish Build and Release Pipelines, part two

   Weeks 3 to 4

   Cover the rest of the dominant domain: deployment strategies (blue-green, canary, ring and progressive exposure, feature flags, A/B), downtime-minimising mechanics (deployment slots and swap, rolling, hotfix paths, containers, database tasks), checks and approvals on YAML environments, agent and runner infrastructure (Microsoft-hosted versus self-hosted and scale set, cost and connectivity), and infrastructure as code with ARM, "Bicep", the what-if preview, desired state configuration, and Azure Deployment Environments. Drill every choice against its named requirement.

5. Lock Source Control and Processes and Communications

   Week 4

   These are reliable marks. For source control, separate branching models by integration frequency, fix build validation as a branch policy, keep branch policies versus branch protection rules straight, and learn lightweight versus annotated tags and LFS. For processes, fix the hash-syntax work-item linking, the DORA metrics by unit, the Analytics-backed dashboard widgets, and provisioned versus published code wikis.

6. Cover Security and Compliance and Instrumentation

   Week 5

   Security rewards a clean identity tree: least-privilege service connections and managed identities, workload identity federation with its issuer and subject, secure files and "Azure Key Vault", and the "GitHub Advanced Security" scanning map (CodeQL, secret scanning, Dependabot, dependency graph and review). Instrumentation reduces to "Application Insights" versus infrastructure insights, sampling for cost, Live Metrics Stream for live rollouts, and Smart Detection for baseline anomalies.

7. Drill weak domains, then sit timed mocks

   Weeks 5 to 6

   Use your per-domain accuracy to attack the areas dragging you down, not to re-read what you already know, and keep build and release pipelines green because it carries the most marks. Take at least one full timed mock under exam conditions to rehearse pacing and the flag-and-return habit, and practise reading any case study once to extract every requirement before answering its cluster. Review every missed question and name the constraint you misread before you book or sit.

Frequently asked questions