The Azure cloud engineer roadmap: what to learn, in order
Most roadmaps you find are a wall of links — every service, every cert, every tool, no order. That is not a plan, it is a reading list you will abandon by week three. Here is the sequence a working engineer would hand you, and the reason each stage comes where it does.
New to cloud? CAMPUX is a free, build-first course. Start here →
The order matters more than the list. Learn identity before you touch networking and both make sense; learn them backward and you memorize disconnected facts. So treat this as a path with gates, not a menu. Each stage assumes the one before it, and each ends with something you built — not a video you finished. If you have never touched a cloud console before, start one step earlier with becoming a cloud engineer with no experience, then come back here for the ordering.
Stage 1 — Foundations, with AZ-900 as the checkpoint
Before any service, you need the mental model: what a region is, what a resource group holds, how the shared-responsibility line splits work between you and Microsoft, why cloud is rented and metered rather than owned. This is the vocabulary everything else is spoken in. The clean way to force yourself through it is AZ-900, Azure Fundamentals — but treat the exam as a checkpoint, not the destination. It proves you can describe cloud concepts and core Azure services; it does not prove you can build anything. Study it, sit it if you want the confidence, and move on within a few weeks. Do not let a foundations cert become a comfort zone you linger in for months.
A foundations cert proves you can describe the cloud. It never proves you can build it.
Stage 2 — The pillars you must be able to reason about
This is the real substance of the job, and where most people rush. Five pillars, and you need to reason about each one out loud, not just recognize the icon:
- Identity — Microsoft Entra ID, users, groups, roles, conditional access. Identity is the new perimeter; almost every real breach starts here, so it comes first.
- Networking — virtual networks, subnets, network security groups, private endpoints. This is where beginners freeze in interviews, so give it extra time.
- Compute — VMs, App Service, containers, the trade between running a server and renting a platform.
- Storage — blob, files, tiers, redundancy, and how access is controlled.
- Governance — subscriptions, management groups, policy, tags, and how a company keeps a thousand resources from turning into chaos.
Do not read these five and nod. For each, build the smallest possible thing: a VM you can reach only through a locked-down network, a storage account only one identity can open, a policy that blocks a resource in the wrong region. The goal at this stage is that someone can ask you "how would you isolate this workload" and you answer from having done it, not from a slide.
Stage 3 — The force multipliers
Now you separate yourself from people who only click in the portal. Clicking does not scale and it leaves no record. The multipliers turn you from an operator into an engineer:
- Infrastructure as code — Bicep (Azure-native) or Terraform (multi-cloud). Learn one properly. Define a resource group, a network, and a VM in code, then destroy and rebuild it from that file.
- Git — version control is not optional. Your infrastructure code lives in a repo with a history, the same as any other code.
- CI/CD — a pipeline in GitHub Actions or Azure DevOps that deploys your Bicep or Terraform when you push. This is the single loudest signal on a junior portfolio.
- Scripting — PowerShell or the Azure CLI, enough to automate the repetitive and glue the pieces together.
Why here and not earlier: you cannot write infrastructure as code for services you do not understand. The pillars have to come first so the code you write means something. Get here and you can describe your work as "I define it in Bicep, it lives in Git, a pipeline deploys it" — which is exactly how the job is done.
Stage 4 — A role-based cert as proof
With the pillars and the multipliers under you, AZ-104, Azure Administrator Associate is the right proof point. It is not a foundations badge; it tests configuring, managing, securing, and administering real Azure — identity and governance, storage, compute, and virtual networking, the exact daily work. Sitting it after Stage 2 and 3 feels natural because you have already built most of what it asks about. Sitting it cold, as your first move, means cramming. And a caution that runs through this whole roadmap: one role-based cert backed by projects beats three certs backing nothing. Certs get you past a filter. They do not close an offer.
This roadmap is reverse-engineered from real Azure job postings, not from a vendor's learning catalog. Pull twenty listings for the title you want and the same requirements repeat: Entra, networking, Bicep or Terraform, a pipeline, PowerShell or CLI. That repeated list is your syllabus — the market wrote it, not us. And the same postings tell you the second thing: proof of work beats a stack of certs. A candidate who can walk through a network they designed and a pipeline they built wins over one holding four badges and no story every time.
Stage 5 — Two or three real projects and a portfolio
This is the stage that gets skipped and the one that gets people hired. You need two or three projects substantial enough to talk through for ten minutes each: the decision you made, the thing that broke, how you fixed it. Not a tutorial you copied — something with your fingerprints on it. A three-tier web app with a locked-down network. A hub-and-spoke topology deployed entirely from Bicep. A cost-governance setup with policy and budgets. Put the code in a public Git repo with a README that explains the why, not just the how. If you want concrete, well-scoped options, the capstone project ideas post is built for exactly this stage. A portfolio of three working projects is the difference between "I studied Azure" and "here, look at what I run."
Stage 6 — The job hunt
Now the sequence pays off. Write your resume around outcomes, not tasks: "built a repeatable VNet deployment in Bicep that cut environment setup from a day to minutes" beats "familiar with Azure networking." Point every bullet at something you did. Apply steadily rather than perfectly, and expect the interview to probe the projects from Stage 5 — which is the whole reason you built them. When they ask how you would secure a workload, you answer from the network you locked down, not from theory. On how long all of this takes end to end, be realistic; the realistic timeline post lays out honest numbers rather than the six-week fantasy the ads sell.
The takeaway
The roadmap is six ordered stages: foundations with AZ-900 as a checkpoint, the five pillars you can reason about, the force multipliers of infrastructure as code and CI/CD and scripting, AZ-104 as proof once you have the substance behind it, two or three real projects in a public repo, and then a job hunt built around outcomes. Every stage ends with something you built, because that is what the market pays for. Follow the order, resist the urge to collect certs in place of shipping work, and you arrive at the interview as someone who has done the job in miniature — which is the only candidate that reliably gets the offer.
Questions people also ask
How long does it take to become an Azure cloud engineer?
Most people who study a couple of hours a day get to a hireable level in roughly six to nine months, faster if they already work in IT. The variable is not talent, it is consistency and whether you build real things. Watching videos for a year teaches you less than shipping three small projects over four focused months.
Do you need a degree to become an Azure cloud engineer?
No. Cloud is one of the few technical fields where a portfolio of working infrastructure outweighs a diploma. Plenty of engineers come from support desks, sysadmin roles, or unrelated careers entirely. What hiring managers screen for is evidence you can build, secure, and troubleshoot in Azure, which a degree does not prove and a project does.
Which Azure certification is best for a cloud engineer?
AZ-104, the Azure Administrator Associate, is the role-based certification that maps most directly to a cloud engineer job. It covers identity, governance, storage, compute, and networking, which is the daily work. AZ-900 is a useful foundations checkpoint before it, but on its own it does not signal that you can do the job.
Is AZ-104 enough to get a job?
AZ-104 gets you past keyword filters and proves baseline knowledge, but on its own it rarely closes an offer. Postings that name AZ-104 almost always also want infrastructure as code, scripting, and CI/CD, and the interview tests whether you have built something. Pair the cert with two or three real projects and it becomes proof rather than a participation badge.
What skills does an Azure cloud engineer need?
The core set is identity with Microsoft Entra, networking, compute, storage, and governance, then the force multipliers on top: infrastructure as code with Bicep or Terraform, Git, a CI/CD pipeline, and scripting with PowerShell or the Azure CLI. Read a handful of real job postings for your target title and the required list writes itself.