AZ-104 to AZ-400: the administrator-to-DevOps-engineer path
AZ-104 proves you can operate Azure by hand. AZ-400 asks you to automate the whole delivery of it — source control, pipelines, infrastructure as code, and the feedback loop that keeps it honest. That is not one more tier of facts to memorize — it is a change of discipline, from running the infrastructure to engineering the machine that ships it. Here is what actually changes on the leap from Administrator to DevOps Engineer, why AZ-400 sits on top of AZ-104 or AZ-204, and how to bridge it without faking the part that matters.
New to cloud? CAMPUX is a free, build-first course. Start here →
The Azure certification ladder looks like a staircase — Fundamentals, Associate, Expert — so it is tempting to treat AZ-400 as "AZ-104 but harder." It is not. The jump from the AZ-104 Azure Administrator to the AZ-400 DevOps Engineer Expert is a change of what you are responsible for, not just a step up in difficulty. AZ-104 asks whether you can run the services; AZ-400 asks whether you can build the pipeline that ships and re-ships them — with source control, continuous integration and delivery, infrastructure as code, secure releases and monitoring — so delivery stops depending on someone clicking through the portal at 2am. Miss that distinction and you study the wrong way: more service trivia, when what the DevOps exam rewards is delivery practices you can only internalize by building a real pipeline. This is what the leap actually involves, and how to make it without skipping the rung that holds the whole thing up.
AZ-104 tests operating Azure by hand — configure and run compute, network, storage, identity, governance. AZ-400 tests automating its delivery — Git, CI/CD pipelines, infrastructure as code, secure releases and monitoring. AZ-400 is not standalone: Microsoft only awards the DevOps Engineer Expert once you already hold AZ-104 or AZ-204, so passing the exam is half of it and the associate cert is the other half. Bridge the gap by building one real pipeline end to end — not by memorizing tool names — and do not wear AZ-400 with nothing running behind it, because DevOps hiring screens for a pipeline you can show.
First, the rung most guides skip: AZ-400 needs AZ-104 or AZ-204
Before any study plan, one fact reshapes the whole path: AZ-400 is not a standalone certification. The AZ-400 exam is titled Designing and Implementing Microsoft DevOps Solutions, and passing it earns you the DevOps Engineer Expert title only if you already hold the AZ-104 Azure Administrator Associate or the AZ-204 Azure Developer Associate certification. Miss that and you can pass the exam and still not hold the certification. Which associate you bring decides the flavour of your route: AZ-104 is the natural on-ramp if you came up through operations and infrastructure; AZ-204 is the one if you came up through code. This article takes the AZ-104 route — the administrator becoming a DevOps engineer — because that is the more common path into cloud, and it is the one where the mindset shift is largest.
Prerequisites and exam contents are refreshed periodically — confirm the current requirement and skills-measured list on Microsoft Learn before you book (checked August 2026).
What actually changes: operate vs automate
The cleanest way to see the leap is side by side. The same Azure services sit underneath both exams — compute, networking, storage, identity — but what you are asked to do with them changes completely.
| AZ-104 · Administrator | AZ-400 · DevOps Engineer | |
|---|---|---|
| The verb | Configure, deploy, manage, monitor | Automate, integrate, release, feed back |
| Typical question | "How do you configure a VNet or a VM?" | "How do you deploy this on every commit, safely, with no stored secrets and a way to roll back?" |
| Infrastructure example | Create resources in the portal or CLI and keep them running | Declare the same resources as code (Bicep/Terraform) and ship them through a reviewed pipeline |
| Judged on | Does it work and stay running | Does it ship continuously, reliably, securely and repeatably — without you in the loop |
| Where it sits | Associate — a standalone certification | Expert — requires AZ-104 or AZ-204 underneath it |
AZ-104 asks "can you run this." AZ-400 asks "can you build the pipeline that ships this without you."
The bridge: four moves from Administrator to DevOps Engineer
Closing the gap is not about memorizing a bigger list of services. It is about internalizing a set of delivery practices — and you internalize them by building, not reading. Four moves get you there.
- Consolidate the associate foundation first. You already need AZ-104 (or AZ-204) to hold AZ-400, so this rung is not optional — it is the prerequisite. Make sure you can genuinely operate the services you are about to automate; networking and identity especially, because a pipeline that deploys infrastructure you do not understand just breaks faster. Passing the AZ-104 and turning it into a job covers this rung in detail.
- Put everything in Git and infrastructure as code. The first real DevOps habit is refusing to click. Stop creating resources by hand and start declaring them — in Bicep or Terraform — versioned in source control, reviewed in a pull request. If you are unsure which to learn, Bicep vs Terraform walks the trade-off. This single shift is the spine of the whole exam.
- Build a real CI/CD pipeline. Wire a pipeline that builds, tests and deploys on every push — in GitHub Actions or Azure Pipelines — authenticating to Azure with federated identity so there are no stored secrets. Getting one green deployment from a commit teaches you more than a week of videos.
- Close the delivery loop. A deploy button is not DevOps. Add the parts that make it trustworthy: secure releases and secret handling (pipeline security), monitoring and feedback (Azure Monitor & Log Analytics), and reconciliation from Git (production GitOps). Now it is a governed delivery loop, which is exactly what AZ-400 is testing.
The honest warning: don't wear the cert you can't demonstrate
Here is the part the exam-cram sites skip. AZ-400 is an Expert credential, and DevOps is the discipline where hiring managers screen hardest for proof, not paper. A resume that leads with a DevOps Engineer Expert badge and links to nothing is a weaker signal than a plain resume that links to a public repository with a pipeline that visibly builds, tests and deploys. The whole point of DevOps is that the work is demonstrable — so an interviewer will ask you to walk through a pipeline you have run, and "I passed the exam" is not an answer to that. Earn AZ-400 on top of a pipeline you built, and it confirms a story your portfolio already tells. Earn it cold, and you have made an expert-level claim your experience cannot back — which reads as someone who collects exams, not someone who ships. If you are earlier on the path, the higher-value move is your associate cert plus one real, end-to-end pipeline you can link to — more on that in which Azure certifications actually get you hired.
Where this sits on the whole path
AZ-104 → AZ-400 is the DevOps fork of a longer route. The other expert fork, AZ-104 → AZ-305, turns the administrator into a solutions architect who designs the estate; AZ-400 turns the administrator into the engineer who ships it. If you are still choosing where to start, the complete Azure certification path lays out every tier, and if the DevOps role itself is what you are aiming at, how to become a DevOps engineer and the skills a DevOps engineer actually needs cover the ground around the cert. The through-line across all of them is the same: the certificate is the receipt, not the skill. Build the pipeline and the exam gets easier; collect the exam without the pipeline and the interviews get harder.
It worked for them.
Questions people also ask
Do I need AZ-104 before AZ-400?
You need AZ-104 or AZ-204 — AZ-400 is not a standalone exam. Microsoft only awards the DevOps Engineer Expert certification once you already hold either the AZ-104 Azure Administrator Associate or the AZ-204 Azure Developer Associate. So passing the AZ-400 exam is only half of it; the associate certification is the prerequisite underneath it. AZ-104 is the natural route if you came up through operations and infrastructure; AZ-204 is the route if you came up through code. Confirm the current prerequisite on Microsoft Learn before you book, because Microsoft adjusts these occasionally.
What is the difference between AZ-104 and AZ-400?
AZ-104 tests whether you can operate Azure by hand — configure virtual machines, networks, storage, identity and governance and keep them running. AZ-400 tests whether you can automate the delivery of all of that — source control, CI/CD pipelines, infrastructure as code, secure releases and monitoring — so software and infrastructure ship continuously and reliably. The shorthand is that AZ-104 asks "can you run this," and AZ-400 asks "can you build the pipeline that ships and re-ships this without you touching the portal."
Can I take AZ-400 without AZ-104 or AZ-204?
You can sit and pass the AZ-400 exam on its own, but you will not be awarded the DevOps Engineer Expert certification until you also hold AZ-104 or AZ-204. The exam and the certification are two different things here. In practice this means you cannot skip the associate rung: the DevOps material assumes you already know how to operate or develop on the services you are being asked to automate, which is exactly what the prerequisite guarantees.
How long does it take to go from AZ-104 to AZ-400?
Plan on a few months of hands-on pipeline building after AZ-104, not a quick turnaround — though the honest answer is that it depends heavily on how much real automation you have already done. The gap is not more facts to memorize; it is a set of practices to internalize — source control, CI/CD, infrastructure as code, secure releases and monitoring. The fastest way to close it is to build one real pipeline end to end, so the tools become muscle memory. If you rush from one exam straight to the next, you tend to pass on recall and then freeze in interviews where you are asked to walk through a pipeline you have actually run.
Is AZ-400 worth it for getting hired?
It is worth it when a working pipeline sits behind it. AZ-400 is an Expert credential and it appears in senior DevOps and platform job requirements, so it is a real signal for someone with a couple of years of delivery experience. But DevOps hiring, more than most, screens for what you can show — a public repository with a pipeline that builds, tests and deploys beats a badge with nothing behind it. Earn AZ-400 on top of a pipeline you built and it confirms the story your portfolio already tells; earn it cold and it makes a claim your experience cannot back.