Exam tips & high-yield caveats
The traps, terminology pairs and "which tool" distinctions AZ-400 loves to test. Skim this the night before — it stitches the five domains into the decisions the exam actually asks you to make.
Always verify
Microsoft renames and re-scopes products frequently (Azure AD → Entra ID, Guest Configuration → Machine Configuration, classic release gates → environment checks). These caveats reflect the current GA picture and the skills measured effective July 27, 2026 — confirm against the official docs before relying on any single fact.
Azure DevOps ↔ GitHub — the terminology map
The single highest-yield thing on this page. A large share of AZ-400 questions are asking whether you know the two names for the same idea, or which platform a feature belongs to.
| Concept | Azure DevOps | GitHub |
|---|---|---|
| CI/CD definition | Azure Pipelines (azure-pipelines.yml) | GitHub Actions (.github/workflows/*.yml) |
| Structure | Pipeline → stage → job → step | Workflow → job → step (no stages) |
| Compute | Agent + pool | Runner + runner group |
| Reusable step unit | Task (task: X@1) | Action (uses: org/x@v1) |
| Reuse a whole pipeline/workflow | Template / extends | Reusable workflow (workflow_call) |
| Merge quality rules | Branch policies | Branch protection rules / rulesets |
| Block merge on failing CI | Build validation | Required status checks |
| Package registry | Azure Artifacts | GitHub Packages / ghcr.io |
| Work tracking | Azure Boards (work items) | GitHub Issues + Projects |
| Link commit → work item | #123 (in Repos) / AB#123 (from GitHub) | #123 (GitHub issue) |
| Secretless Azure auth | Service connection + workload identity federation | azure/login + OIDC |
| Deployment gate | Environment approvals & checks | Environment protection rules |
| Free non-technical access | Stakeholder access level | Outside collaborator (read) |
| Security scanning suite | GHAS for Azure DevOps | GitHub Advanced Security |
Facts that decide a platform question
TFVC → Azure Pipelines only. Stages / classic release gates / deployment groups → Azure Pipelines only. Dependabot / native CodeQL / community actions marketplace → GitHub. Code in GitHub but need rich release management → GitHub source + Azure Pipelines via the GitHub App.
"Which tool / which feature?" decision table
| The requirement says… | Answer |
|---|---|
| Version and distribute arbitrary non-package files | Universal Packages (Azure Artifacts) |
| Cache a public registry so builds survive its outage | Upstream source on the feed |
| Promote packages testing → stable, no re-versioning | Feed views (@prerelease → @release) |
| Publish the test report even when tests fail | condition: succeededOrFailed() / if: always() |
| Test against a real DB with no shared server | Service containers |
| Force every prod pipeline to run a mandatory scan | extends template + required template check |
| Build must reach a private VNet / on-prem resource | Self-hosted agent/runner |
| Bursty Kubernetes runners that scale to zero | Actions Runner Controller (ARC) |
| Let a user add/remove a stage at queue time | Parameters + ${{ if }} (compile-time) |
| Zero downtime with instant rollback | Blue-green via slot swap |
| Watch error rate on 5% of traffic | Canary |
| Compare conversion between two working designs | A/B testing |
| Internal → preview → everyone rollout | Ring / progressive exposure |
| Merge unfinished work to main safely | Feature flags (Azure App Configuration) |
| Rename a DB column with zero downtime | Expand–contract across releases |
| Azure-native IaC, simpler than ARM | Bicep |
| Provision AWS + Azure with one tool | Terraform |
| Preview infra changes before applying | az deployment group what-if |
| Audit OS config across many VMs via Azure Policy | Azure Machine Configuration |
| Devs self-serve governed environments from templates | Azure Deployment Environments |
| Keep one release build forever | Retention lease |
| Azure resource → Azure service, no secrets | Managed identity |
| Deploy to Azure from GitHub with no stored secret | OIDC / workload identity federation |
| Block a secret at push time | GHAS secret scanning push protection |
| Auto-patch a vulnerable dependency | Dependabot security updates |
| Unified security posture across GitHub + Azure DevOps | Defender for Cloud DevOps security |
| Surface a 3rd-party scanner's results in GitHub | Upload SARIF |
| Monitor AKS pods | Container Insights |
| Trace a request across microservices | Distributed tracing / Application Map |
| Alert an app when CPU > 80% | Azure Monitor metric alert + action group |
Precedence & conflict-resolution rules
Azure DevOps permissions
Deny beats Allow across group memberships (except Project Collection Administrators). Permissions inherit project → repo → branch.
GitHub permissions
Highest permission wins when a user gets access from multiple teams/sources — the opposite of Azure DevOps.
ARM deployment mode
Incremental (default) never deletes. Complete deletes anything in the RG not in the template.
SemVer bump from commits
fix: → patch · feat: → minor · ! / BREAKING CHANGE: → major.
Stage vs job ordering
Azure Pipelines: stages sequential, jobs parallel by default. GitHub: all jobs parallel unless needs.
cancel-in-progress
true for PR/CI (save minutes). false for production deploys (never abort mid-deploy).
Release-branch fixes
Always merge/cherry-pick the fix forward to main or it regresses in the next release.
Classic release gates
All gates must pass in the same sampling window; they re-evaluate until then or timeout.
YAML & expression gotchas
| Trap | What to remember |
|---|---|
${{ }} vs $[ ] vs $( ) | Compile-time / runtime-expression / macro. Parameters and conditional structure are compile-time. |
| Parameters vs variables | Parameters are typed and change pipeline shape; variables are strings and change values. |
deployment: vs job: | Only a deployment job binds to an environment, gets approvals/history, and auto-downloads artifacts. |
| Approvals location | Configured on the environment (UI/REST), never inside the YAML file. |
| Secret variables | Not auto-exposed to scripts — map them under env: explicitly. |
cron is UTC | Always UTC in both platforms; watch daylight-saving. Azure schedules need always: true to run without changes. |
fetchDepth: 0 | GitVersion/SonarQube/blame need full history — a shallow clone breaks them. |
fail-fast: false | See all matrix results instead of cancelling siblings on first failure. |
OIDC needs id-token: write | Plus a federated-credential subject matching the repo/ref/environment. |
| Tag images with the SHA | Never deploy or roll back from a mutable latest tag. |
Old name → new name (don't get tricked)
| You may still see… | Current name |
|---|---|
| Azure Active Directory (Azure AD) | Microsoft Entra ID |
| Guest Configuration | Azure Machine Configuration |
| Log Analytics agent (MMA/OMS) | Azure Monitor Agent (AMA) — old one retired |
| Application Insights instrumentation key | Connection string |
| Microsoft Defender for DevOps | Defender for Cloud — DevOps security |
| Classic release gates & approvals | Environment approvals & checks (YAML) |
| MSOnline / AzureAD PowerShell | Microsoft Graph PowerShell (old modules retired) |
| Project (classic GitHub board) | Projects (tables, boards, roadmaps) |
| WhiteSource / Mend Bolt | Dependabot / GHAS dependency scanning |
Question-format strategy
- Case studies
- Read the requirements and existing environment first, then the questions. Answers must satisfy all constraints ("minimise cost", "least privilege", "minimise administrative effort"). You usually can't return to a case study after leaving it.
- Build list / drag-and-drop ordering
- Order matters — e.g. rotate secret → rewrite history → force push → re-clone; or expand → migrate → read → contract. Eliminate impossible first steps.
- YAML hotspots
- Read the whole snippet before answering each dropdown. Watch for
needs/dependsOn,if/condition, and permission blocks that change the correct value. - "Yes/No" repeated-scenario sets
- Same setup, three variations — each independent. A previous "No" doesn't imply the next. Watch the subtle wording change.
- "Minimise administrative effort" / "least privilege"
- Steer you toward managed/federated identity, built-in roles, templates, group-based and automatic answers over manual/custom ones.
Day-before checklist
✅ Azure DevOps↔GitHub terminology map ✅ TFVC → Azure Pipelines ✅ stages exist only in Azure Pipelines ✅ deployment job for environments/approvals ✅ Universal Packages & feed views ✅ succeededOrFailed() / if: always() ✅ blue-green vs canary vs ring vs A/B ✅ expand–contract for DB ✅ Bicep vs Terraform vs Machine Configuration ✅ Incremental vs Complete ✅ managed identity vs SP vs OIDC ✅ GHAS push protection ✅ which Insight per resource ✅ KQL bin()/render/percentile().
Take the free practice assessment
Microsoft offers an official AZ-400 practice assessment — use it to find weak areas, then revisit the matching domain page here.