Microsoft Azure Certification Roadmap: Choose the Right Path

Don’t build your Azure certification plan by climbing the badge ladder from Fundamentals upward. That instinct—AZ-900, then AZ-104, then whatever looks next—burns months on exams your target job never asks for, and it leaves you exposed when a credential retires halfway through your study plan.

Skip the ladder. A better Azure certification roadmap starts with the job you want, accounts for the experience you already have, and pairs one relevant credential with hands-on proof.

In this guide, you will build that roadmap. By the end, you will have a target certification, a realistic timeline, and a lab project that demonstrates more than exam recall.

2026 accuracy note: Credential availability and exam objectives change. The paths and retirement dates in this article were checked on July 12, 2026. Review Microsoft’s live credential retirement page and the current study guide before scheduling an exam.

How to Choose Your Azure Certification Path

Before opening an exam study guide, answer four questions:

1. What job are you targeting? An Azure administrator, network engineer, architect, developer, DevOps engineer, security engineer, and data engineer use overlapping services but perform different work.

2. What can you already do? Existing systems, networking, development, security, or data experience can let you skip introductory material. Experience in one specialty does not automatically cover Azure identity, governance, and cost controls.

3. How much time can you sustain each week? A six-week sprint suits an experienced practitioner closing a few gaps. A career changer needs more runway.

4. What will you build? Your lab should map to the exam domains and produce evidence you can discuss in an interview.

Use the following decision table as your first pass.

Current experience	Target role	Recommended first step	Next credential or action
No cloud experience	Any Azure role	Azure Fundamentals (AZ-900) and small labs	Choose one role-based path
Systems or cloud administration	Azure administrator	Azure Administrator Associate (AZ-104)	Specialize with AZ-700, AZ-305, or AZ-400
Network administration	Azure network engineer	Fill Azure basics gaps, then AZ-700	Add AZ-104 for broader operations work
Experienced Azure administrator	Solutions architect	Earn or maintain AZ-104	Take AZ-305 and build an architecture case study
CI/CD or platform engineering	DevOps engineer	Use AZ-104 as the durable prerequisite	Take AZ-400
Data beginner	Data role	DP-900 if data concepts are weak	DP-700 for Fabric data engineering
Developer beginning a new path	Azure/AI cloud developer	Follow current AI-200 objectives and build a project	Confirm the live credential and exam before scheduling
Security practitioner new to Azure	Cloud security	Build AZ-104-level administration and security labs	Check the live catalog for the AZ-500 successor

Notice what this table does not recommend: taking every Fundamentals exam, beginning with an expert exam, or following an old sequence because it looks tidy. Your shortest useful path is the one that closes the gap between your current skills and your target role.

Start with Azure Fundamentals—or Skip It?

Microsoft Certified: Azure Fundamentals (AZ-900) is a beginner credential covering cloud concepts, Azure architecture and services, and Azure management and governance. Microsoft calls it a common starting point, not a required first step for every technical certification.

Choose AZ-900 if subscriptions, resource groups, regions, shared responsibility, pricing, identity, and governance are new to you. It also fits project managers, recruiters, sales professionals, and other roles that need Azure literacy without day-to-day administration.

Skip the exam when you already administer Azure resources and can explain the core concepts without substantial review. You can still use the free learning material to fill a specific gap before moving to an associate credential.

Either way, do not stop at terminology. Create a resource group, apply tags, configure a budget, inspect role assignments and Azure Advisor, and then remove the resources. That small exercise turns abstract concepts into a useful mental model.

The same rule applies to specialist Fundamentals credentials. Azure Data Fundamentals (DP-900) helps beginners understand relational, non-relational, transactional, and analytical workloads, but Microsoft explicitly states that it is not a prerequisite for role-based certifications. Azure AI Fundamentals now uses AI-901; check its current certification page rather than relying on an old exam list.

Choose a Role-Based Azure Certification Roadmap

Microsoft role-based certifications work best when the credential matches the tasks you expect to perform. The following paths pair each certification with practical lab evidence.

Azure Administrator: Build a Broad Operations Foundation

For cloud administrators and operations engineers, Azure Administrator Associate (AZ-104) is the broadest practical foundation in this roadmap. It covers virtual networks, storage, compute, identity, security, governance, implementation, monitoring, and management.

AZ-104 is a strong fit if you come from help desk, systems administration, Windows or Linux administration, virtualization, networking, or another cloud platform. Expect to work with the Azure portal, Azure CLI, PowerShell, ARM or Bicep, and Microsoft Entra ID.

Build one environment that connects the domains instead of completing unrelated click-through labs. For example:

• Create two virtual networks with subnets, peering, DNS, network security groups, and route inspection.

• Deploy Windows and Linux virtual machines with managed disks, backup, availability, and monitoring.

• Configure storage access, lifecycle rules, role-based access control (RBAC), and a private endpoint.

• Apply policies, locks, tags, budgets, users, groups, and least-privilege roles.

• Reproduce the deployment with Bicep or Terraform.

• Add Azure Monitor alerts and a Log Analytics query, then troubleshoot an intentionally broken connection.

Once you can operate this environment without following a tutorial, choose your next credential based on the work you enjoy: AZ-700 for networking, AZ-305 for architecture, or AZ-400 for DevOps.

Azure Network Engineer: Specialize with AZ-700

Azure Network Engineer Associate (AZ-700) suits network professionals who already understand IP addressing, protocols, name resolution, routing, security, and resiliency.

Your lab should include address-space design, hub-and-spoke routing, VNet peering, Azure DNS, private endpoints, NSGs, route tables, and an application-delivery or load-balancing service. Add Network Watcher, break a route or security rule, and document how you isolated the fault.

Do not treat cloud networking as subnet math with a new interface. Identity, private access, hybrid connectivity, application delivery, monitoring, cost, and platform limits are part of the design.

Blueprint alert: Microsoft announced an English AZ-700 content update for July 27, 2026. If your study period crosses that date, compare the old and new study guides and update your objective checklist.

Azure Solutions Architect: Combine AZ-104 and AZ-305

Azure Solutions Architect Expert is not awarded for passing AZ-305 alone. Microsoft requires the Azure Administrator Associate credential and AZ-305.

Follow this sequence:

1. Build and validate AZ-104-level administration skills.

2. Operate a multi-service Azure environment and troubleshoot real failures.

3. Study AZ-305 design objectives.

4. Produce a production-style architecture case study.

Your case study should include requirements, assumptions, an architecture diagram, identity and network boundaries, recovery time and recovery point objectives, availability, governance, cost, observability, deployment, and security tradeoffs. Tie decisions to the Azure Well-Architected Framework instead of merely listing services.

An expert badge supports your design credibility. A diagram, deployment templates, decision record, and failure analysis prove that you can defend and operate the design.

DevOps or Platform Engineer: Use AZ-104 and AZ-400

DevOps Engineer Expert requires AZ-400 plus either Azure Administrator Associate or Azure Developer Associate. Because Azure Developer Associate retires on July 31, 2026, AZ-104 is the durable prerequisite for most candidates beginning this path in 2026.

Build a repository that demonstrates the delivery lifecycle:

• Protect the main branch and require pull-request checks.

• Create a multistage pipeline that tests, scans, packages, deploys, and promotes an application.

• Provision infrastructure as code.

• Store secrets in Key Vault and use a managed or workload identity.

• Add approvals, environment checks, rollback, and a blue/green or canary deployment strategy.

• Instrument the application, configure alerts, and recover from a failed deployment.

Microsoft expects familiarity with both GitHub and Azure DevOps solutions. You do not need duplicate projects, but you should understand how the source-control, pipeline, package, security, and work-tracking concepts map between them.

Developer and AI Cloud Developer: Avoid a Retiring Path

Older roadmaps commonly recommend AZ-204 followed by AI-102. That sequence is stale in mid-2026.

Azure Developer Associate (AZ-204) retires July 31, 2026, and Azure AI Engineer Associate (AI-102) retired June 30, 2026. If you are already prepared for AZ-204, decide whether you can realistically pass before retirement. Microsoft states that the credential cannot be earned or renewed after retirement. If you are beginning from scratch, do not rush through months of development skills to meet the deadline.

Instead, use current Microsoft objectives to guide your learning while confirming the replacement credential in the live catalog. Microsoft’s AI-200 study guide covers containerized Azure solutions, AI solutions using Azure data services, service integration, security, monitoring, and troubleshooting.

A strong project is a containerized Python API using vector storage, event-driven background processing, managed identity, Key Vault, OpenTelemetry, tests, infrastructure as code, and a deployment pipeline. Include cost controls and responsible-AI decisions.

The AI-200 study guide confirms the exam blueprint. Verify the associated certification title and exam availability on Microsoft Learn before paying or scheduling.

Data Engineer: Move from DP-900 to DP-700 When Needed

Take DP-900 only if you need a foundation in cloud data concepts. For role-focused data engineering, the current path in the researched Microsoft catalog is Fabric Data Engineer Associate (DP-700).

DP-700 is a Microsoft Fabric credential—not “Azure Data Engineer Associate.” It covers ingestion, transformation, orchestration, security, monitoring, and optimization with SQL, PySpark, and KQL.

Build a lakehouse project that ingests both batch and streaming data, implements medallion layers, transforms data with SQL and PySpark, orchestrates pipelines, secures workspaces, and monitors jobs. Introduce a slow workload, tune it, and document lineage, data quality, recovery, and cost.

Blueprint alert: Microsoft announced English content updates for DP-900 and DP-700 on July 21, 2026. Download the live guides when you begin studying.

Security Engineer: Check the AZ-500 Deadline

Azure Security Engineer Associate (AZ-500) retires August 31, 2026. Candidates who already have strong Azure administration and security experience can use Microsoft’s practice assessment and labs to judge whether finishing before retirement is sensible.

If you are starting from zero, build AZ-104-level skills rather than cramming for a credential that cannot be earned or renewed after the cutoff. Check Microsoft’s catalog for the successor path.

In the meantime, build a security lab covering least-privilege RBAC, privileged-access design, network segmentation, private access, Key Vault, managed identities, Defender for Cloud recommendations, policy initiatives, vulnerability remediation, and a Microsoft Sentinel incident workflow. Keep before-and-after evidence showing both the insecure state and your remediation.

Avoid the 2026 Certification Retirement Trap

Retirements are not a footnote in this roadmap. They determine whether a months-long plan still leads to a credential.

Credential	Status on July 12, 2026	What to do
Azure Data Scientist Associate (DP-100)	Retired June 1, 2026	Do not begin it; check the live catalog and build role-relevant projects
Azure AI Engineer Associate (AI-102)	Retired June 30, 2026	Do not follow stale AI-102 roadmaps
Azure Developer Associate (AZ-204)	Retires July 31, 2026	Finish only if already prepared; otherwise follow the replacement path
Azure Security Engineer Associate (AZ-500)	Retires August 31, 2026	Attempt only if readiness is already high; otherwise wait for the successor

Before committing to any certification exam, open its official page and verify three items: availability, prerequisites, and the date of the latest study-guide update. Repeat that check before scheduling. Microsoft notes that retirement information is subject to change.

Certification or Applied Skills Credential?

A certification evaluates a broader role and typically requires a proctored exam. Microsoft Applied Skills credentials assess a narrower, scenario-based skill.

Choose a certification when a job description asks for it, you need broad role validation, or the credential is a prerequisite for an expert path. Choose an Applied Skills credential when you need to demonstrate one focused capability, such as deploying or securing a particular solution, without committing to an entire role-based exam.

The two can complement each other. For example, use AZ-104 as broad administrator validation, then add a relevant Applied Skills credential and project for a task you perform at work. Do not accumulate either type without a role or project that gives it context.

Build a Study Plan Around Your Available Time

Elapsed time does not guarantee readiness. Use these schedules as planning bands, then gate your exam date on objective coverage, practice results, and independent lab performance.

Four to Six Weeks: Experienced Practitioner

This plan requires roughly 8–12 focused hours each week and suits someone already performing most of the target role.

• Week 1: Download the live study guide, mark each objective as know, lab, or gap, and take the free Microsoft Practice Assessment.

• Weeks 2–3: Study weak domains and complete one focused lab for each.

• Week 4: Build an integrated scenario and troubleshoot faults without step-by-step instructions.

• Week 5: Retake the assessment, review every incorrect answer, and explore the Exam Sandbox.

• Week 6: Close remaining gaps, verify the blueprint again, and schedule only when performance is consistently strong.

Eight to Twelve Weeks: Working Professional

With 6–8 hours per week, divide your effort as follows:

• 40% Microsoft Learn paths and product documentation

• 40% hands-on labs and one integrated project

• 20% retrieval practice, assessments, review, and exam-interface preparation

Use two short weekday sessions for concepts and one longer weekend block for labs. End every lab with saved commands or templates, validation output, a troubleshooting note, and cleanup.

Three to Six Months: New to the Role

If you have 4–6 hours per week and are learning the job as well as the exam, use a longer path:

1. Spend the first month on cloud and role prerequisites, taking a Fundamentals exam only if it adds value.

2. Use months two and three for role-specific services and individual labs.

3. Build an integrated project with security, monitoring, and troubleshooting in month four.

4. Close gaps objective by objective and use the practice assessment in month five.

5. Take the exam in month six only if your evidence says you are ready.

Turn Exam Objectives into Portfolio-Ready Labs

A successful deployment screenshot proves that a deployment succeeded once. A portfolio-ready lab shows how you planned, reproduced, secured, monitored, broke, and repaired it.

For each substantial lab, capture:

1. Goal and requirements: Define the business or technical outcome.

2. Architecture: Include the service choices, data flow, network flow, and identity boundary.

3. Reproducibility: Save Bicep, Terraform, CLI, PowerShell, or configuration files in source control.

4. Security: Document least privilege, secrets, private access, policies, and relevant threats.

5. Observability: Add logs, metrics, traces, queries, alerts, or dashboards.

6. Failure exercise: Introduce or diagnose at least one fault and record the recovery.

7. Cost and cleanup: Estimate cost, set a budget where practical, and include teardown instructions.

8. Reflection: Explain tradeoffs, limitations, and what you would change for production.

One integrated project can cover several exam domains. That project gives an interviewer richer material than a folder of tutorial screenshots and gives you a better test of whether you understand the platform.

Prepare, Pass, and Renew Your Microsoft Credential

Once your study plan is in motion, use Microsoft’s current resources instead of treating an old third-party checklist as the blueprint.

• Download the latest study guide from the certification page.

• Take the free Microsoft Practice Assessment as a gap finder, not as a memorization bank.

• Use the Exam Sandbox to learn the interface before exam day.

• Register with a personal Microsoft account. Microsoft warns that certification records tied only to a work or school account can become unrecoverable after you leave the organization.

• Check the scheduling page for your country or region rather than assuming a universal exam price.

• Recheck objectives and retirement status immediately before scheduling.

Associate, expert, and specialty certifications expire annually. Microsoft lets eligible credential holders renew through a free online Microsoft Learn assessment. Add the renewal window to your calendar and keep using the technology; renewal is easier when your knowledge has not gone stale. Fundamentals credentials do not follow the same 12-month renewal pattern shown on role-based certification pages.

Create Your Personal Azure Certification Roadmap

You now have enough information to write a roadmap in six lines:

1. Target job: Name one role, not “cloud.”

2. Current gap: List the exam domains you cannot yet explain or perform.

3. Credential: Choose one active certification that supports the role.

4. Weekly budget: Reserve sustainable concept, lab, and review blocks.

5. Portfolio deliverable: Define one integrated project and its evidence.

6. Decision dates: Record blueprint check, practice assessment, exam decision, and renewal dates.

For example, a systems administrator targeting cloud operations could choose AZ-104, study seven hours each week for 10 weeks, and build a monitored two-VNet environment deployed with Bicep. A network engineer could skip AZ-900, fill Azure governance gaps, pursue AZ-700, and document a hub-and-spoke troubleshooting lab. Neither learner needs every Microsoft Azure certification.

Choose One Path and Start This Week

A practical Microsoft Azure certification roadmap is not a ladder you must climb one badge at a time. Start with the job, use Fundamentals only when it closes a real gap, and choose the smallest active role-based path that supports your goal.

Next, turn the live exam objectives into a hands-on project. Capture architecture, automation, security, monitoring, troubleshooting, cost, and cleanup—not just a passing score. Finally, check retirement dates and renewal requirements so that your plan survives Microsoft’s credential changes.

Which role will anchor your roadmap: administrator, network engineer, architect, DevOps engineer, developer, data engineer, or security engineer? Pick one, download its current study guide, and mark your first lab on the calendar.