Microsoft Azure DevOps Solutions Architect (AZ-400)

You can structure team backlogs across Azure Boards and GitHub, connecting user stories directly to pull requests for complete delivery traceability.

1. DevOps culture, roles and the DevOps Engineer Expert path90 min
   • DevOps shared responsibility model
   • AZ-400 certification competencies
   • Cross-functional team alignment
   • Value stream mapping methodology
   • Continuous improvement loops
2. Structuring the flow of work with GitHub Flow90 min
   • GitHub Flow vs Gitflow lifecycle
   • Short-lived feature branches
   • Automated deployment validation rules
   • Trunk-based integration practices
   • Release tagging strategies
3. Tracking work with Azure Boards, GitHub Projects and GitHub Issues2 hrs
   • Work item types and hierarchy
   • Azure Boards sprint backlogs
   • GitHub Projects automation and issue linking
   • Kanban board column mapping
   • Epic and feature breakdown structures
4. Integrating Azure Boards with GitHub repositories90 min
   • Azure DevOps GitHub app connection
   • Mention syntax for linking commits and PRs
   • Automated state changes on branch merges
   • Webhook event configuration
   • Cross-platform status reporting
5. Feedback cycles, notifications and source, bug and quality traceability2 hrs
   • Service hooks and Slack or Teams alerts
   • End-to-end traceability matrix
   • Defect tracking and work item telemetry
   • Audit log configuration
   • Incident feedback loops
6. Managing technical debt and backlog prioritization in DevOps teams90 min
   • Technical debt quantification models
   • Security backlog integration
   • SLA-driven bug remediation
   • Refactoring sprint allocation
   • Priority matrix frameworks

Hands-on project: Ticket: Configure an Azure Boards Scrum board mapped to a GitHub organization, setup automated issue state transitions triggered by PR merges, and document the Definition of Done in Markdown.

You can calculate DORA delivery metrics, build Azure DevOps analytics dashboards, and maintain living architectural documentation using Markdown and Mermaid diagrams.

1. Flow metrics: cycle time, lead time and time to recovery90 min
   • DORA core delivery metrics
   • Cumulative flow diagrams
   • Lead time vs cycle time tracking
   • Mean time to resolution (MTTR) calculation
   • Deployment frequency measurement
2. Dashboards and queries for planning, development, testing and security90 min
   • Work Item Query Language (WIQL)
   • Widget configuration in Azure DevOps
   • Sprint burndown and velocity reporting
   • Custom query charting
   • Security vulnerability widget embedding
3. Project wikis with Markdown and Mermaid process diagrams90 min
   • Azure DevOps code wiki sync
   • Mermaid architecture syntax
   • Technical specification templates
   • Runbook documentation standards
   • Version-controlled markdown wikis
4. Release notes, API documentation and docs generated from Git history90 min
   • Conventional commits parser
   • Changelog automation in CI pipelines
   • Release notes generation tools
   • Swagger and OpenAPI specification publishing
   • Automated documentation site generation
5. Stakeholder reporting and engineering telemetry dashboards90 min
   • Executive summary dashboards
   • Cost and resource utilization metrics
   • Compliance audit reporting views
   • Team productivity analytics
   • Automated status email distribution
6. Knowledge management and disaster recovery runbook maintenance60 min
   • Runbook validation testing
   • Incident response documentation
   • Architecture decision records (ADRs)
   • Team onboarding portal creation
   • Documentation drift detection

Hands-on project: Ticket: Construct an Azure DevOps dashboard showing lead time for changes and deployment frequency widgets, and commit a versioned repository wiki with Mermaid sequence diagrams illustrating release triggers.

You can enforce strict repository branch policies, sanitize sensitive commit histories, and manage enterprise codebases using Git LFS and Scalar.

1. Branching strategies: trunk-based, feature branch and release branch2 hrs
   • Trunk-based development flow
   • Release isolation strategies
   • Managing hotfixes across active releases
   • Long-lived branch management anti-patterns
   • Feature flag integration with branching
2. Pull request workflows with branch policies and branch protection rules2 hrs
   • Azure Repos branch policies
   • GitHub branch protection rules
   • Auto-complete and build expiration
   • Comment resolution requirements
   • Work item linking enforcement
3. Merge restrictions, required reviewers and status checks90 min
   • Code owner file definitions
   • Enforcing build validation gates
   • Squash vs rebase vs three-way merge
   • Required status check configuration
   • Bypassing rules for emergency hotfixes
4. Large files with Git LFS and repo scaling with Scalar90 min
   • Git LFS pointer file mechanics
   • Scalar repo maintenance for monorepos
   • Git clone depth and sparse checkout
   • Managing binary assets in source control
   • Background file system monitoring
5. Recovering and sanitizing Git history60 min
   • BFG Repo-Cleaner and git-filter-repo
   • Purging credential leaks from Git history
   • Git reflog and history restoration
   • Rewriting author metadata safely
   • Force push protection policies
6. Advanced Git hooks and client-side automation60 min
   • Pre-commit hook implementation
   • Commit message linting with Husky
   • Secret detection hooks locally
   • Shared repository templates
   • Git configuration management

Hands-on project: Ticket: Enforce branch protection policies on main requiring two approvals, squash merging, and passing CI status checks, while sanitizing accidentally committed secrets using git-filter-repo.

You can set up secure package feeds in Azure Artifacts and GitHub Packages with upstream source rules and strict SemVer versioning.

1. Choosing between GitHub Packages and Azure Artifacts90 min
   • GitHub Packages registry capabilities
   • Azure Artifacts protocol support
   • Access tokens and permission models
   • Cross-tenant package sharing
   • Storage quota and pricing models
2. Package feeds, views and upstream sources90 min
   • Feed views: Local, Release, Prerelease
   • Upstream source isolation and poisoning defense
   • Publishing NuGet and npm artifacts
   • Maven and Python PyPI registry configuration
   • Package promotion workflows
3. Dependency versioning with SemVer and CalVer90 min
   • Semantic versioning (MAJOR.MINOR.PATCH)
   • CalVer standards and use cases
   • Automated version tagging via GitVersion
   • Pre-release identifier handling
   • Breaking change management
4. Retention strategy for artifacts and dependencies90 min
   • Retention policies per feed view
   • Automated package deletion rules
   • Handling obsolete and vulnerable packages
   • Storage cost optimization
   • Immutability rules for released packages
5. Consuming private packages securely in build pipelines60 min
   • Credential provider setup for NuGet and npm
   • Personal access token (PAT) scoping
   • Service connection authentication for feeds
   • Caching packages in build agents
   • Troubleshooting 401 unauthorized errors
6. Software Bill of Materials (SBOM) generation for packages60 min
   • SBOM generation standards (SPDX, CycloneDX)
   • MicrosoftSBOMTool integration in pipelines
   • Tracking transitive dependencies
   • Compliance reporting for open source licenses
   • Vulnerability auditing of artifact inputs

Hands-on project: Ticket: Create an Azure Artifacts private feed with public npm upstream sources, publish an internal shared library using semantic release automation, and configure retention rules to prune untagged prerelease builds.

You can build multi-stage YAML CI/CD pipelines across Azure Pipelines and GitHub Actions utilizing self-hosted runners, approvals, and shared templates.

1. YAML pipelines, trigger rules and multi-stage configurations2 hrs
   • Multi-stage schema (stages, jobs, steps)
   • Push, PR, and scheduled triggers
   • Conditional execution using pipeline expressions
   • Path filtering for monorepo pipelines
   • Batching concurrent pipeline runs
2. Job execution order, parallelism and dependencies2 hrs
   • Job dependencies and dependsOn syntax
   • Parallel job matrices for multi-platform builds
   • Containerised jobs using Docker CLI
   • Strategy maxParallelism configuration
   • Artifact passing between jobs
3. Reusable elements: YAML templates, task groups and variable groups2 hrs
   • Step, job, and stage YAML templates
   • Variable groups linked to Azure Key Vault
   • Template parameters and validation rules
   • Extends keyword for pipeline templates
   • Scope inheritance in variable groups
4. Microsoft-hosted vs self-hosted agents and runner networking2 hrs
   • Configuring self-hosted Linux agents on Azure VMs
   • VNet integration and private endpoints for runners
   • GitHub Actions self-hosted runner groups
   • Ephemeral runner scaling on Kubernetes
   • Agent tag management and pool routing
5. Pipeline secrets handling and secure variable scoping90 min
   • Secret variable masking in pipeline logs
   • Run-time secret injection mechanisms
   • Restricting environment variable access
   • Auditing pipeline secret usage
   • Tokenization of configuration files
6. Managing pipeline artifacts and workspace persistence90 min
   • PublishPipelineArtifact and DownloadPipelineArtifact tasks
   • Workspace cleaning strategies
   • Managing build cache persistence
   • Handling large artifact uploads
   • External storage integration for artifacts

Hands-on project: Ticket: Write a production-ready multi-stage azure-pipelines.yml file featuring separate build, test, and deploy stages, conditional execution, variable group secret bindings, and environment approval gates.

You can configure environment deployment protection rules, manual sign-offs, and migrate legacy build definitions into modern YAML templates.

1. Environments with manual checks, gates and approvals2 hrs
   • Azure DevOps Environment resource locks
   • Manual approval policies and business hours gates
   • REST API invocation gates for canary validation
   • Required checks timeout configurations
   • Excluding specific users from bypass rights
2. Migrating classic UI pipelines to clean YAML definitions2 hrs
   • Exporting Classic release definitions to YAML
   • Refactoring task groups to modular templates
   • Validating feature parity and secret references
   • Handling legacy task deprecations
   • Parallel running of classic and YAML pipelines
3. Troubleshooting pipeline syntax and runtime errors90 min
   • YAML schema validation in IDE
   • Diagnosing agent pool connectivity failures
   • Pipeline debug logging flags (system.debug)
   • Analyzing expression evaluation errors
   • Inspecting agent diagnostics logs
4. Matrix expansions and complex pipeline flow control90 min
   • Dynamic matrix generation in YAML
   • Skipping stages based on commit messages
   • Failure handling with condition expressions (failed(), always())
   • Timeouts and cancellation handling
   • Nested template expansion debugging
5. Managing cross-repository pipeline triggers and dependencies90 min
   • Resource triggers in YAML pipelines
   • Consuming artifacts from external repositories
   • Securing cross-project service connections
   • Managing upstream and downstream build chains
   • Handling pipeline version locking
6. Implementing pipeline dry-runs and validation stages60 min
   • Pipeline template linting commands
   • Executing syntax validation without queueing agents
   • Simulating production gate evaluations
   • Automated testing of YAML templates
   • Pipeline governance and policy enforcement

Hands-on project: Ticket: Setup an Azure DevOps Environment protected by manual sign-offs, business hours checks, and REST API invocation gates for automated canary validation.

You can embed automated unit, integration, and code coverage quality gates in build pipelines that fail builds on test regressions.

1. Automated test execution in CI: unit and integration tests90 min
   • Running JUnit and pytest in pipeline tasks
   • Docker-compose integration test harnesses
   • Test failure threshold configurations
   • Parallel test execution strategies
   • Isolating flaky database tests
2. Publishing test results and code coverage analysis in pipelines90 min
   • PublishTestResults task configuration
   • PublishCodeCoverageResults with Cobertura and JaCoCo
   • SonarQube pull request decoration
   • Enforcing coverage threshold failure gates
   • Visualizing test trends over time
3. Release gates with Azure Policy and automated pre-deployment approvals90 min
   • Azure Policy compliance checks in pipelines
   • Azure Monitor alert-based deployment gates
   • Work item status query gates
   • Evaluating external REST endpoints as gates
   • Re-evaluation intervals and timeout settings
4. Monitoring pipeline flakiness and failure trends60 min
   • Azure DevOps Pipeline Analytics tab
   • Identifying flaky tests with automatic reruns
   • Mean time to build failure resolution
   • Test duration anomaly detection
   • Reporting test failures to engineering leads
5. End-to-end UI and smoke testing automation in release pipelines60 min
   • Executing Playwright or Selenium tests in CI
   • Headless browser execution on self-hosted agents
   • Recording test execution videos as artifacts
   • Handling test environment teardown
   • Synthetic monitoring post-deployment checks
6. Integrating security and compliance testing into early CI stages60 min
   • Shift-left testing principles
   • Static Application Security Testing (SAST) in PR builds
   • Secret scanning before code commit acceptance
   • Open source license compliance checks
   • Blocking builds on high-severity code smells

Hands-on project: Ticket: Add automated test execution into a pipeline that publishes Cobertura code coverage reports, enforces an 80% minimum coverage gate, and blocks PR merges when unit tests fail.

You can execute zero-downtime blue-green deployments, canary rollouts, and feature flag management across Azure App Services and container workloads.

1. Blue-green, canary, ring, and progressive exposure rollouts2 hrs
   • Blue-green deployment topology
   • Canary traffic routing principles
   • Ring deployment patterns for enterprise services
   • Traffic manager and Front Door routing rules
   • Automated rollback trigger criteria
2. Feature flags with Azure App Configuration Feature Manager2 hrs
   • Azure App Configuration store setup
   • Targeting filters and percentage rollouts
   • Integrating Feature Management SDK in code
   • Dynamic configuration refresh without restarts
   • Auditing feature flag changes
3. Minimising downtime with App Service deployment slot swaps2 hrs
   • Deployment slot architecture and configuration sticky settings
   • Slot swap with preview for warmup verification
   • Automated rollback on application health check failure
   • Startup script optimization for slot warm-up
   • Managing connection strings across slots
4. Automating database migrations and rollback strategies2 hrs
   • Flyway and Liquibase CI/CD execution
   • Backward-compatible database schema changes
   • Rollback scripts and data compensation patterns
   • Zero-downtime database refactoring steps
   • Handling schema version locks in pipelines
5. Kubernetes rolling updates and advanced traffic splitting90 min
   • Kubernetes Deployment strategy maxSurge and maxUnavailable
   • Readiness and liveness probe configuration
   • Ingress controller traffic weighting
   • Service mesh integration with Istio or Linkerd
   • Graceful pod termination handling
6. Disaster recovery and multi-region failover execution90 min
   • Active-passive vs active-active deployment models
   • DNS failover automation with Traffic Manager
   • Replicating database state across regions
   • Failover drill execution in pipelines
   • Recovery point objective (RPO) and time (RTO) metrics

Hands-on project: Ticket: Configure an Azure App Service with staging and production deployment slots, wire an automated swap triggered by healthy smoke tests, and implement a toggleable feature flag using Azure App Configuration.

You can provision and validate Azure infrastructure declaratively using Bicep and Terraform pipelines configured with remote state locking.

1. IaC strategy: source control, parameter files and validation2 hrs
   • Idempotency and drift detection concepts
   • Parameter files and environment separation
   • Linting and pre-flight validation in CI
   • Modular infrastructure design patterns
   • Peer review workflows for infrastructure code
2. Azure Resource Manager and Bicep modules in pipelines2 hrs
   • Modular Bicep syntax and transpilation
   • AzureResourceManagerTemplateDeployment task
   • What-If deployment verification operations
   • Publishing modules to a Bicep registry
   • Parameter validation decorators in Bicep
3. State management and Azure Deployment Environments2 hrs
   • Azure Deployment Environments (ADE) concepts
   • Environment catalog definitions
   • Self-service developer sandbox provisioning
   • Time-to-live (TTL) expiration policies
   • DevCenter project and catalog configuration
4. Terraform on Azure: remote state locking and plan verification2 hrs
   • azurerm backend configuration with Blob Storage
   • State locking via Azure Blob Leases
   • Automating terraform plan and apply in pipelines
   • Handling terraform workspace separation
   • Resolving state lock conflicts safely
5. Infrastructure compliance scanning with Checkov and TFLint90 min
   • Running TFLint for syntax and best practices
   • Checkov security policy scanning on IaC
   • Failing pipelines on insecure cloud resource configs
   • Suppressing security findings with justification
   • Custom policy creation for organizational compliance
6. Ansible and configuration management integration90 min
   • Ansible playbooks for VM configuration
   • Azure collection for Ansible authentication
   • Idempotent software installation tasks
   • Dynamic inventory plugins for Azure
   • Executing Ansible from CI/CD pipelines

Hands-on project: Ticket: Build a CI/CD pipeline that runs terraform plan, validates security compliance using Checkov, and applies infrastructure changes to Azure using remote state stored in Blob Storage with blob lease locking.

You can implement secretless CI/CD authentication via OpenID Connect, secure credential storage with Azure Key Vault, and automate container vulnerability scans.

1. Service principals vs managed identities and OIDC federation2 hrs
   • Azure Service Connections with OpenID Connect (OIDC)
   • System-assigned vs user-assigned managed identities
   • Role-Based Access Control (RBAC) principle of least privilege
   • Configuring federated credentials in Entra ID
   • Eliminating stored client secrets in pipelines
2. Secrets, keys and certificates with Azure Key Vault integration2 hrs
   • AzureKeyVault task integration in YAML
   • Key Vault access policies vs Azure RBAC
   • Certificate renewal workflows in pipelines
   • Rotating database connection strings automatically
   • Soft-delete and purge protection configuration
3. Dependency scanning with Dependabot and GitHub Advanced Security2 hrs
   • GitHub Advanced Security (GHAS) configuration
   • CodeQL static analysis integration
   • Dependabot security alerts and secret scanning
   • Triage workflows for security vulnerabilities
   • Automated pull request patching for CVEs
4. Container vulnerability scanning with Microsoft Defender for Cloud2 hrs
   • Azure Container Registry (ACR) vulnerability scanning
   • Trivy scan integration in pipeline stages
   • Failing pipeline builds on HIGH/CRITICAL CVEs
   • Base image provenance and signing with Notation
   • Runtime threat detection for AKS workloads
5. Policy as code with Azure Policy and OPA Gatekeeper90 min
   • Writing custom Azure Policy definitions
   • Enforcing resource tagging and region restrictions
   • Open Policy Agent (OPA) Gatekeeper on AKS
   • Validating Kubernetes manifests against policies
   • Audit vs deny enforcement modes
6. Network security and private endpoints in CI/CD architectures90 min
   • Private link service connections for Azure DevOps
   • Firewall rules for self-hosted agent subnets
   • Isolating container registries behind VNets
   • Securing database access from build servers
   • Zero-trust network architecture principles

Hands-on project: Ticket: Eliminate hardcoded client secrets by configuring Workload Identity Federation (OIDC) between Azure DevOps and Microsoft Entra ID, and inject a Trivy container scanning step into the image build stage.

You can query telemetry with KQL in Log Analytics, build end-to-end Application Insights distributed traces, and optimize pipeline execution using caching.

1. Azure Monitor and Log Analytics integration with DevOps resources90 min
   • Log Analytics workspace deployment
   • Diagnostic settings for App Services and ACR
   • Metrics and logs aggregation strategies
   • Retention and data export configurations
   • Cost management for log storage
2. Application telemetry with Application Insights and Container Insights90 min
   • Application Insights SDK initialization
   • Monitoring live metrics and application maps
   • Container Insights for Azure Kubernetes Service
   • Prometheus metrics scraping on AKS
   • Grafana dashboard integration
3. Distributed tracing and log queries with KQL90 min
   • Kusto Query Language (KQL) syntax fundamentals
   • Correlating distributed requests across microservices
   • Creating log-based metric alerts and action groups
   • Parsing custom log formats with regex
   • Timechart and anomaly detection operators
4. Optimising build agents, caching and pipeline execution runtimes90 min
   • Caching NuGet, npm, and Maven dependencies in pipelines
   • Minimising artifact upload and download overhead
   • Agent pool auto-scaling configuration
   • Parallelizing build steps to reduce total wall-clock time
   • Diagnosing slow-running pipeline tasks
5. Automated alert action groups and webhook integrations60 min
   • Azure Monitor action group configuration
   • Integrating webhooks with PagerDuty and Slack
   • Severity levels and alert suppression rules
   • Testing alert end-to-end delivery
   • Runbook automation triggers on critical alerts
6. Cost optimization and telemetry telemetry hygiene60 min
   • Reducing log ingestion volume without losing visibility
   • Sampling rates in Application Insights
   • Daily data caps and alert notifications
   • Identifying orphan resources generating telemetry
   • Cloud spend attribution to development teams

Hands-on project: Ticket: Instrument an application with Application Insights telemetry, configure Log Analytics diagnostic settings on an AKS cluster, and write KQL alerts that trigger automated PagerDuty or webhook notifications.

You can design, build, and defend an end-to-end enterprise GitOps delivery pipeline on Azure, integrating security scanning, Terraform infrastructure, and zero-downtime AKS deployments.

1. Capstone architecture blueprint and requirements analysis90 min
   • Reviewing enterprise capstone requirements
   • Designing the reference multi-tier architecture
   • Mapping toolchain components to business outcomes
   • Defining pipeline triggers and security boundaries
   • Establishing success criteria and validation scripts
2. Provisioning foundational infrastructure with Terraform and Bicep90 min
   • Executing automated Terraform apply for core networking
   • Provisioning Azure Kubernetes Service and Azure Container Registry
   • Configuring remote state locking and backend security
   • Validating resource deployment with checkov
   • Troubleshooting state drift and infrastructure errors
3. Configuring secure OIDC authentication and Key Vault integration90 min
   • Establishing Workload Identity Federation in Entra ID
   • Setting up secretless service connections in pipelines
   • Injecting runtime secrets from Azure Key Vault
   • Validating least-privilege RBAC assignments
   • Auditing access logs and token lifetimes
4. Building multi-stage CI pipelines with testing and security gates90 min
   • Authoring the comprehensive build and test pipeline
   • Integrating SonarQube code quality checks
   • Running Trivy container image vulnerability scans
   • Publishing SBOM artifacts and test coverage reports
   • Enforcing build failure gates on security findings
5. Implementing GitOps delivery and zero-downtime AKS rollouts90 min
   • Deploying Helm charts to Azure Kubernetes Service
   • Configuring ArgoCD for continuous delivery sync
   • Executing canary traffic splitting via Ingress controllers
   • Validating zero-downtime rolling updates
   • Testing automated rollback procedures on failure
6. AZ-400 exam review, mock testing and career interview strategies90 min
   • Analyzing official Microsoft AZ-400 exam question formats
   • Reviewing case studies and high-weight domains
   • Mock technical interview questions for platform architects
   • Structuring a DevOps resume and project portfolio
   • Final submission review and mentorship feedback

Hands-on project: Ticket: Deliver the production capstone: deploy an enterprise microservices architecture to AKS using Terraform, GitHub Actions, Helm, and ArgoCD, backed by OIDC authentication, Trivy security gates, and automated KQL monitoring.