The short version
AZ-400 has five domains. Pipelines carry 50-55% of the exam, three domains carry 10-15% each, and instrumentation carries 5-10%. Microsoft publishes weightings per domain, not per topic, so the order below is a guide to emphasis, not a promise about question counts. Everything here follows the study guide titled “Skills measured as of July 27, 2026”. The traps are our own teaching notes, not Microsoft statements.
Domain 1: Design and implement processes and communications (10-15%)
What it covers. The flow of work and how you can trace it. You should know GitHub Flow, feedback cycles with notifications and GitHub Issues, and how Azure Boards, GitHub Projects, and repositories connect. Metrics and dashboards matter here too: cycle time, lead time, and time to recovery, plus queries for planning, development, testing, security, delivery, and operations. The collaboration part covers wikis with Markdown and Mermaid diagrams, release notes, documentation built from Git history, webhooks, and integration with Microsoft Teams.
Typical traps. Cycle time and lead time look similar. Lead time starts when an item is created, and cycle time starts when work begins. Another trap is mixing up what each integration does: a webhook sends events out, while a Boards connection links work items to code.
What to practice. Build a dashboard with cycle and lead time widgets. Link a commit to a work item in both directions. Write a wiki page with a Mermaid diagram.
Domain 2: Design and implement a source control strategy (10-15%)
What it covers. Branching strategies (trunk-based, feature branch, and release branch), and pull request workflows enforced with branch policies or branch protection rules. Repository management covers large files with Git LFS or git-fat, scaling big repositories with tools such as Scalar, permissions, tags, recovering lost data with Git commands, and removing sensitive data from history.
Typical traps. Questions often hide the tool in the wording. “Branch policies” are an Azure Repos term, while “branch protection rules” belong to GitHub. Undoing a mistake on a shared branch calls for a revert, not a history rewrite. Lost local commits that no branch points to are found with the reflog.
What to practice. Set a policy that needs two reviewers. Add LFS tracking to a test repository. Recover a commit after a hard reset.
Domain 3: Design and implement build and release pipelines (50-55%)
This domain has six areas, and each one could be a short course on its own.
- Package management. Azure Artifacts and GitHub Packages, feeds and views, upstream sources, and versioning schemes such as SemVer and CalVer. Be able to say which version number follows a backward-compatible feature.
- Testing strategy. Quality and release gates, unit, integration, and load tests, test tasks and agents, and code coverage. Know how test results reach the Tests tab.
- Pipelines. Choosing between GitHub Actions and Azure Pipelines, agent and runner infrastructure (cost, connectivity, maintenance), triggers, YAML, job order and parallelism, reusable templates, variable groups, and checks and approvals on environments.
- Deployments. Blue-green, canary, ring, and progressive exposure, feature flags with Azure App Configuration, deployment slots, hotfix paths, resiliency, containers, and database tasks.
- Infrastructure as code. Configuration management choices, Bicep and ARM templates, desired state configuration, and Azure Deployment Environments.
- Maintaining pipelines. Health metrics, cost and concurrency tuning, retention, and migrating classic pipelines to YAML.
Typical traps. Look-alike pairs. Two answers often both work, and one stated constraint such as cost, network isolation, or least privilege decides. Also watch the platform: a keyword that exists in Azure Pipelines YAML may not exist in GitHub Actions. For example, GitHub Actions jobs wait on other jobs with needs, and Azure Pipelines uses dependsOn.
What to practice. Write a multi-stage YAML pipeline with a matrix, a template, an environment approval, and a deployment to a slot. Do the same task in GitHub Actions. Because this domain is more than half the exam, most of your hands-on time belongs here.
Domain 4: Develop a security and compliance plan (10-15%)
What it covers. Authentication and authorization: choosing between service principals and managed identities (system-assigned and user-assigned), GitHub Apps, GITHUB_TOKEN, personal access tokens, Azure DevOps service connections, roles and permissions, and access levels for stakeholders and outside collaborators. Sensitive information: Azure Key Vault, secretless authentication through workload identity federation and OpenID Connect, secure files, and avoiding leaks in pipeline logs. Scanning: dependency, code, secret, and license scanning, Microsoft Defender for Cloud DevOps Security, GitHub Advanced Security (including for Azure DevOps), container scanning with CodeQL, and Dependabot alerts.
Typical traps. Choosing a stored secret when a secretless option exists. Mixing up a managed identity, whose lifecycle follows an Azure resource, with a service principal that you manage yourself.
What to practice. Set up OpenID Connect from a GitHub workflow to Azure. Read a secret from Key Vault in a pipeline. Turn on code scanning on a repository.
Domain 5: Implement an instrumentation strategy (5-10%)
What it covers. Monitoring for a DevOps environment: Azure Monitor and its logs, Application Insights, VM and container insights, monitoring in GitHub, and alerts for events in GitHub Actions and Azure Pipelines. Analysis: infrastructure indicators such as CPU, memory, disk, and network, usage and performance metrics, distributed tracing, and basic KQL queries.
Typical traps. Not knowing which table or feature holds a given kind of data. Expect to read or complete short KQL queries, not write long ones.
What to practice. Run a few KQL queries in a Log Analytics workspace. Create an alert that fires on a failed pipeline.
More guides for AZ-400
- AZ-400 Exam Format: Time, Score, Retakes
- Is AZ-400 Hard? An Honest Difficulty Check
- AZ-400 Prerequisites and Skills Self-Check
- AZ-400 Renewal and Retakes Explained
- Is AZ-400 Worth It? An Honest Look
- AZ-400 Cheat Sheet: Key Facts to Review
- AZ-104 vs AZ-400: Which First?
- AZ-305 vs AZ-400: Which Exam First?
Next step
Take these domains into a schedule with the study plan. To see how the topics appear as questions, try the sample questions, or work through our AZ-400 practice tests.