Azure DevOps zero to hero: the ladder, in the order that works

Every "Azure DevOps zero to hero" list names the same tools — Terraform, Bicep, pipelines, runners — and almost none of them tell you the order. Order is the whole game. Here is the ladder rung by rung, why each rung sits where it does, and the free class that teaches it.

New to cloud? CAMPUX is a free, build-first course. Start here →

"Zero to hero" is a promise that usually delivers a logo wall: Git, Bicep, Terraform, GitHub Actions, Azure Pipelines, OIDC, self-hosted runners, GitOps. All the right words, no sequence. The problem is that these skills are a ladder, not a menu — try Terraform before you are comfortable with Git and you spend your energy fighting the version control instead of learning the infrastructure. So this is the same tool list, but arranged as rungs, each one leaning on the one below it. Climb it in order and by the top you can do the thing the job actually asks for: change cloud infrastructure with a git push and explain every step of how it happened.

Rung 1 — Git, until it is boring

Everything above this rung is text files in a repository, so Git is not one skill among many — it is the floor the whole ladder stands on. You do not need to be a Git wizard, but branches, commits, pull requests and reading a diff have to be automatic, because in a week they will be the thing you do fifty times a day without thinking. Most people who stall on "DevOps" are actually stalling on Git and blaming the tools built on top of it. Get this to the point of boredom before you climb.

This is the pre-Azure bridge that almost no roadmap sequences properly. If you are still shaky on the command line, start there — the non-CS cloud roadmap builds the Git and Linux floor before it touches any cloud tool.

Rung 2 — Infrastructure as code: Bicep first, then Terraform

Clicking resources into existence in the portal is fine for looking around and useless for a job, because nobody can review a click and you cannot rebuild it. Infrastructure as code fixes both: your environment becomes a text file you commit, review and recreate on demand. Learn Bicep first — it is Azure-native, there is little to set up, and it maps directly onto Azure Resource Manager, so the ideas land without the extra machinery. Then move to Terraform, which adds state files and providers but works across clouds and shows up in more job descriptions. Do them in that order and Terraform feels like a small addition rather than a second mountain.

Bicep is Class 20 — Infrastructure as Code with Bicep; Terraform is Class 21 — Infrastructure as Code with Terraform. The reason to know both, and to be able to say why you would pick each, is covered in the FAQ below.

You are not learning eight tools. You are learning one idea — describe it, commit it, ship it — in eight places.

Rung 3 — A CI/CD pipeline that runs your code for you

Now automate it. A CI/CD pipeline is just a machine that runs your steps for you on every push: validate the code, plan the change, deploy it. Start with GitHub Actions because that is where public portfolio projects live and it is the fastest to show someone. Then learn Azure Pipelines, the Azure DevOps product a lot of enterprises run internally, with its own environments, approvals and agent pools. They share the same shape — triggers, jobs, steps, an agent or runner, secrets — so once you have built one, the second is mostly new keywords over old ideas.

GitHub Actions is Class 22 — CI/CD with GitHub Actions. The Azure DevOps side is Class 39 — Azure DevOps Pipelines, which breaks all the way down to fundamentals, YAML, agent pools, templates, environments, approvals and quality gates if you want the depth.

Rung 4 — OIDC, so no secret ever lives in the repo

A pipeline that deploys to Azure has to prove who it is. The old way was to paste a cloud credential into the pipeline's secrets — and a leaked one of those is a very bad day. The current way is OIDC federated credentials: the pipeline requests a short-lived token at run time and Azure trusts it because of a relationship you set up once, so there is no long-lived secret to steal. This is the rung that separates a demo from something an employer trusts, and it is worth learning precisely because a lot of tutorials still skip it.

That is Class 23 — GitHub Actions to Azure with OIDC. If you build only one thing from this whole ladder, make it the pipeline in the CI/CD project that gets a junior resume read — OIDC is the detail that makes reviewers lean in.

Rung 5 — Runners and agents, including your own

Your pipeline steps run somewhere, and that somewhere is a runner (GitHub's word) or an agent (Azure's). By default the platform hands you a fresh throwaway virtual machine for free, which is all you need for a long time. A self-hosted runner is a machine you own and register instead — you reach for one when jobs need to touch a private network, need specific hardware or an operating system the hosted pool lacks, or when you burn so many minutes that hosted compute gets expensive. You will rarely need one while learning, but knowing exactly when a team would run its own is the kind of judgement an interviewer digs for, so it belongs on the ladder even though you may never set one up at home.

Runners, agent pools and the heavier pipeline patterns are Class 24 — Runners & Advanced Pipelines.

Rung 6 — Tie it together with one GitOps build

The rungs become a skill when they meet in one project. Build a repository where a git push is the only way infrastructure changes — IaC in the repo, a pipeline that plans and applies it, OIDC doing the auth, environments gating the deploy. That is GitOps: the git history is the record of what your cloud looks like, and to change the cloud you change the repo. One project like this, that you can walk through end to end, outweighs a dozen tutorials you followed once.

The guided version is Build 03 — the GitOps loop, one of the milestone builds on the path.

The ladder at a glance

Questions people also ask

How long does it take to go from zero to hero in Azure DevOps?

Plan on three to four focused months at around ten hours a week if you are starting from Git. The ladder is Git, then infrastructure as code with Bicep and Terraform, then a CI/CD pipeline, then OIDC authentication, runners, and a GitOps build to tie it together. "Hero" here does not mean knowing every tool — it means you can build a pipeline that deploys infrastructure from a git push and explain every step. That is a junior-ready skill set, and it is a foundation to keep building on, not a finish line.

Should I learn Bicep or Terraform first for Azure?

Learn Bicep first, then Terraform. Bicep is Azure-native, has less to set up, and maps cleanly onto Azure Resource Manager so the concepts of infrastructure as code land without the extra baggage of state files and providers. Once those concepts are solid, Terraform is a short step and it is the one more job postings ask for because it works across clouds. Knowing both, and being able to say why you would reach for each, reads far stronger in an interview than defending one as the only answer.

Is GitHub Actions or Azure Pipelines better to learn?

Learn the concepts once and both become easy, because they share the same shape: triggers, jobs, steps, agents or runners, and secrets. GitHub Actions is where most open portfolio projects live and is the fastest to show publicly, so start there. Azure Pipelines is what a lot of enterprises run internally, with its own environments, approvals and agent pools, so learn it second. The pipeline thinking transfers directly; only the YAML keywords differ.

What is a self-hosted runner and do I need one?

A self-hosted runner is a machine you own that executes your pipeline jobs, instead of the throwaway virtual machine the platform gives you for free. You reach for one when jobs need access to a private network, a specific operating system or hardware, or when you run so many minutes that hosted runners get expensive. For learning, the free hosted runners are plenty — but understanding when and why a team runs its own is exactly the kind of judgement an interviewer probes, so it belongs on the ladder.

Do I need to learn Azure DevOps to get a cloud job?

You need the skills the label covers, yes. Almost every cloud-engineering role now expects that you can put infrastructure in code and ship it through a pipeline rather than clicking in the portal. Whether the team uses GitHub Actions or the Azure DevOps product specifically, the underlying skills — Git, IaC, CI/CD, identity-based authentication — are the ones on the job description. Learn the ladder and you are covered regardless of which tool a given employer happens to run.