What's inside
AZ-400 doesn't test whether you can find your way round a portal. It tests whether you can choose the right branch policy, pipeline feature, deployment pattern or identity option for a delivery requirement, in GitHub or in Azure DevOps.
This independent study guide for the Microsoft Certified: DevOps Engineer Expert exam distils what AZ-400 really expects you to understand into the comparisons, configuration choices and traps that DevOps decisions turn on, with GitHub and Azure DevOps side by side and short YAML, Git and Azure CLI examples throughout.
Organised by technology
Thirteen chapters, each readable on its own and together covering all five AZ-400 skill areas:
- Processes and communications: GitHub Flow, GitHub Issues and Projects, Azure Boards processes and backlogs, AB# linking and traceability; dashboards, flow and DORA metrics, queries and Analytics; wikis, Markdown and Mermaid, release notes, webhooks and Teams integration.
- Source control: trunk-based, feature and release branching; Azure Repos branch policies, GitHub branch protection and rulesets, CODEOWNERS and merge queues; Git LFS, Scalar, partial and sparse clones, tags, recovering and removing data.
- Build and release pipelines: Azure Artifacts and GitHub Packages, upstream sources, views and versioning; test strategy, quality and release gates, code coverage and Azure Load Testing; GitHub Actions and Azure Pipelines, triggers, Microsoft-hosted agents, Managed DevOps Pools and self-hosted runners; templates, variables, environments, checks and approvals; blue-green, canary and ring deployments, deployment slots, feature flags and database deployments; Bicep, ARM, deployment stacks, Azure Machine Configuration and Azure Deployment Environments.
- Security and compliance: service principals and managed identities, service connections, PATs, GITHUB_TOKEN and GitHub Apps, permissions and access levels; Azure Key Vault, workload identity federation and secure files; GitHub Advanced Security, Dependabot, Microsoft Defender for Cloud DevOps security and container scanning.
- Instrumentation: Azure Monitor, Application Insights and OpenTelemetry, VM and container insights, GitHub insights, alerts, distributed tracing and basic KQL.
Inside
- Comparison tables for every close call, such as GitHub Actions or Azure Pipelines, which agent type, which deployment pattern or which identity fits a requirement.
- 130 Common trap callouts that name the answers that look right but aren't, and explain what's right instead.
- 13 diagrams, from the traceability chain and branching strategies to feed views, deployment patterns and workload identity federation.
- Key takeaways at the end of every chapter for fast revision.
- A glossary of more than 450 terms, each linked to Microsoft Learn or GitHub Docs, with a free online version for print readers.
Up to date
DevOps tooling changes quickly. This edition reflects Microsoft's documentation as of October 2026: Managed DevOps Pools as the successor to scale set agents, workload identity federation with the Microsoft Entra issuer, organisation-scoped PATs as global PATs end, GitHub Secret Protection and GitHub Code Security, and the retirement dates for Azure Deployment Environments and Azure Automation State Configuration.
Understanding, not memorising
This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and apply the same judgement in real delivery pipelines.
Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.
Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.
