Azure AZ-400 study plan
Azure AZ-400 · Give each week a clear focus.
8 weeks · About 7 hours per week
Design and implement build and release pipelines
Author a multi-stage YAML pipeline that restores, builds, runs unit tests, and publishes a build artifact
Extract repeated pipeline steps into a reusable template file and consume it from the main pipeline
Configure a Microsoft-hosted agent pool and demonstrate a pipeline run against a self-hosted or containerized agent
Wire up pipeline variables, runtime parameters, and a variable group so the same pipeline builds Debug and Release configurations
Add trigger rules (branch include/exclude, path filters, PR triggers) so runs fire only on the intended changes
Your checkpoint
A repository whose YAML pipeline completes two successful runs (Debug and Release) from the same definition, publishes a downloadable artifact, and uses at least one shared template file.
Design and implement build and release pipelines & Design and implement a source control strategy
Build a multi-stage pipeline (build to deploy-to-dev to deploy-to-test) using deployment jobs tied to Azure Pipelines environments
Implement a runOnce deployment strategy and a rolling deployment strategy, and document when each is appropriate
Configure an environment-level approval check and a branch control check, then exercise both during a deployment
Create Azure Repos branch policies on main: build validation, minimum reviewer count, linked work items, and comment resolution
Adopt a branching model (trunk-based with short-lived feature branches) and open a pull request that satisfies every configured policy
Your checkpoint
A multi-stage pipeline that deploys to two environments, pauses for an approval that is visibly recorded, and a merged pull request that could not have completed without all branch policies passing.
Design and implement build and release pipelines & Design and implement a source control strategy
Define infrastructure as code (Bicep or ARM template) and deploy it from a pipeline stage using a service connection scoped to a resource group
Publish a versioned NuGet or npm package to an Azure Artifacts feed and consume it from a second pipeline with an upstream-restored dependency
Implement semantic versioning in the package pipeline using a version counter or GitVersion-style strategy, and prove two distinct versions appear in the feed
Apply merge strategy decisions (squash, rebase-and-fast-forward, semi-linear) and configure repository settings to enforce one of them
Add a CODEOWNERS file and verify required-reviewer enforcement on a pull request touching an owned path
Your checkpoint
A pipeline stage that provisions infrastructure from a checked-in template plus an Azure Artifacts feed containing at least two semver-versioned packages, with one package restored by a downstream pipeline run.
Design and implement build and release pipelines & Design and implement a source control strategy
Add deployment gates to a release flow using a post-deployment check such as an Azure Monitor or REST API invocation query
Convert a classic release pipeline into an equivalent YAML pipeline and note the capability gaps encountered
Configure a canary or blue-green release using deployment slots and traffic routing, and record the rollback steps
Review pipeline caching and parallel job settings, then reduce end-to-end build time by at least 20 percent
Solve 40 timed practice items covering pipelines and source control and log each miss with its root cause
Your checkpoint
A timing comparison table showing build duration before and after caching or parallelism changes, plus a written rollback runbook and a remediation log of at least 10 analyzed practice misses.
Design and implement processes and communications
Structure an Azure Boards backlog into epics, features, and user stories with acceptance criteria and story points for a sample delivery
Build a delivery plan or sprint dashboard that shows flow of work across two or more sprints
Configure service hooks or notifications so build failures and pull request updates post to a team channel
Publish a project wiki page that documents the team's definition of done, branching conventions, and release cadence
Define traceability from work item to commit to build to deployment and demonstrate it end to end on one story
Your checkpoint
A shared project dashboard containing at least three work-tracking widgets, a wiki page set of at least two pages, and one work item whose links show commit, build, and deployment traceability.
Develop a security and compliance plan
Remove plaintext secrets from pipeline definitions by linking an Azure Key Vault to a variable group and referencing the mapped variables
Authenticate pipeline-to-Azure access with a workload identity federation or managed identity service connection instead of a stored secret
Enable secret scanning, dependency scanning, and static code analysis in the build and configure the pipeline to fail on high-severity findings
Apply an Azure Policy assignment and review Microsoft Defender for Cloud recommendations for the deployed resource group
Define least-privilege permissions for service connections, agent pools, and pipeline-level access and apply them
Your checkpoint
A pipeline that completes with zero plaintext secrets in its YAML or variable definitions, blocks a deliberately introduced vulnerable dependency, and a one-page permissions matrix covering every identity the pipeline uses.
Implement an instrumentation strategy & Develop a security and compliance plan
Instrument an application with Application Insights and verify distributed tracing across at least two components in the transaction search
Create an availability test and an Azure Monitor alert rule that fires on a simulated failure, then capture the notification
Build a dashboard or workbook that surfaces request rate, failure rate, and response time for the deployed app
Configure release annotations or deployment markers so telemetry correlates with deployments
Close out remaining security gaps by adding a compliance check or approval gate that blocks deployment when a scan finding is open
Your checkpoint
A monitoring dashboard with live telemetry for a deployed app, plus evidence of one alert that fired on an induced failure and one deployment annotation visible on the metrics chart.
Design and implement build and release pipelines & Design and implement a source control strategy & Design and implement processes and communications & Develop a security and compliance plan & Implement an instrumentation strategy
Take two full-length timed practice exams and score each domain separately against the published weights
Re-drill every missed objective by rebuilding the specific pipeline, policy, or monitoring artifact that was tested
Rehearse exam logistics: question pacing, case-study reading order, and flagging strategy for uncertain items
Write a one-page recall sheet of the facts you repeatedly missed and review it daily for the final three days
Your checkpoint
Two scored practice exams with a per-domain score table, a closed remediation list showing every miss rebuilt or re-verified, and a final recall sheet of no more than one page.
Milestones
Week 2: You can author a multi-stage YAML pipeline with template reuse, deployment jobs, an approval check, and branch-policy enforcement from a blank repository in under 60 minutes without reference material.
Week 4: You score 75 percent or higher on a 40-item timed set covering build and release pipelines plus source control, and every miss has a written root cause.
Week 6: You can describe and demonstrate, end to end, how a secret reaches a pipeline without ever appearing in source control, and you score 80 percent or higher on a security and compliance practice set.
Week 8: Both full-length practice exams score at or above the passing threshold with no individual domain below 70 percent, and the remediation list contains no open items.