ExamSprintLab

AZ-400 study plan: pass in 4 weeks

Updated October 9, 2026

Four weeks is realistic for AZ-400 if you already build CI/CD pipelines and study 8-10 hours a week. Because build and release pipelines are 50-55% of the exam, spend two of the four weeks there: first pipelines and testing, then deployments, infrastructure as code and maintenance. Source control, work tracking, security and monitoring fit into the other two. Without pipeline experience, double the timeline and build a small project as you go.

Before you start

  • Read the official skills outline once. It lists every objective and names the tools.
  • Create a free Azure DevOps organization, a GitHub account with a test repository, and an Azure subscription with a budget alert.
  • Take the free Microsoft practice assessment cold. The per-domain breakdown matters more than the score.
  • Pick one small app (a web API in any language) and use it for every lab, so each week builds on the last.

Week 1: source control, work tracking and communication (20-30% combined)

Goal: control how work and code move before any pipeline runs.

  • Flow of work: GitHub Flow, GitHub Issues and Projects, Azure Boards and linking work items to commits and pull requests for traceability.
  • Metrics: cycle time, lead time and time to recovery; dashboards and queries.
  • Collaboration: wikis with Markdown and Mermaid, release notes, webhooks, Teams integration.
  • Branching: trunk-based, feature branch and release branch; branch policies in Azure Repos and branch protection rules in GitHub.
  • Repositories: Git LFS, Scalar for large repos, tags, permissions, recovering data with reflog, revert and cherry-pick, and removing sensitive data from history.

Lab: protect main in both GitHub and Azure Repos with required reviews and a required status check; link a work item to a pull request; push a fake secret and remove it from history.

Week 2: pipelines and testing (part of 50-55%)

Goal: write a working multi-stage YAML pipeline in both GitHub Actions and Azure Pipelines.

  • YAML: triggers (push, pull_request, schedules, path filters), stages, jobs, steps, dependsOn, conditions, variables and variable groups.
  • Reuse: templates, reusable workflows, composite actions, task groups.
  • Agents and runners: Microsoft-hosted versus self-hosted, scale set agents, cost, connectivity and licenses.
  • Testing: unit, integration and load tests, test result publishing, code coverage, quality gates.
  • Packages: Azure Artifacts feeds and upstream sources, GitHub Packages, SemVer and CalVer.

Lab: one pipeline that builds, tests with coverage, publishes an artifact and a package, with a template for the build job.

Week 3: deployments and infrastructure as code (rest of 50-55%)

Goal: release safely and repeatably.

  • Strategies: blue-green, canary, ring, progressive exposure, A/B testing and feature flags with Azure App Configuration.
  • Minimising downtime: rolling deployments, load balancing, deployment slots and swap, hotfix paths.
  • Environments: checks and approvals on YAML environments, ordered dependencies between deployments.
  • IaC: Bicep and ARM, desired state, Azure Machine Configuration, Azure Deployment Environments, testing and deploying IaC from a pipeline.
  • Maintenance: pipeline health, flaky tests, concurrency, retention, classic-to-YAML migration.

Lab: deploy the app to a staging slot with an approval check, swap, then roll back; provision the slot’s infrastructure from Bicep in the same pipeline.

Week 4: security, monitoring and review

Goal: harden the pipeline and watch what it deploys.

  • Identity: service principals versus managed identities, workload identity federation (OpenID Connect) for GitHub Actions and Azure Pipelines, service connections, GITHUB_TOKEN, GitHub Apps versus personal access tokens.
  • Secrets: Azure Key Vault, secure files, preventing leakage in logs.
  • Scanning: GitHub Advanced Security (CodeQL, secret scanning, dependency review), Dependabot, Microsoft Defender for Cloud DevOps security, container scanning.
  • Instrumentation: Application Insights, Azure Monitor Logs, VM and container insights, alerts for pipeline events, distributed tracing, KQL basics.

Review: take the free 20-question practice test mid-week and repeat the official practice assessment. Spend the remaining days on the lowest domain.

If you already run pipelines

Compress weeks 2 and 3. Spend the time on objectives people rarely meet at work: Scalar, git-fat, CalVer, Azure Deployment Environments, Azure Machine Configuration, hybrid pipelines, Mermaid in wikis and Defender for Cloud DevOps security.

How to know you are ready

  • You can read a YAML pipeline and say what triggers it, what runs in parallel and what the approval gate protects.
  • You can choose between service principal, managed identity and federated credential for a given requirement.
  • You can name the deployment strategy that matches a given rollback and exposure requirement.
  • You score 80% or more on realistic practice questions twice in a row, on different sets.

Then book it. The exam format covers the mechanics and the exam day guide the day itself.