The az 400 syllabus has five domains: design and implement processes and communications (14%), design and implement a source control strategy (12%), design and implement build and release pipelines (54%), develop a security and compliance plan (12%), and implement an instrumentation strategy (8%). Build and release pipelines carries more than half the exam, so most of your study time belongs there.
Microsoft publishes the az 400 syllabus as a skills-measured outline attached to the AZ-400 exam page, and it is the only source you should trust for what the exam actually covers. This page breaks that outline into the five domains, their weights, and the skill clusters inside each one, so you can plan study time by what actually counts toward your score.
AZ-400 exam topics and their weights
| Domain | Weight | What it covers |
|---|---|---|
| Design and implement processes and communications | 14% | Flow of work, feedback cycles, work tracking, dashboards and metrics, documentation |
| Design and implement a source control strategy | 12% | Branching strategy, pull request workflow, repository management |
| Design and implement build and release pipelines | 54% | Package management, pipeline testing strategy, pipeline design and YAML |
| Develop a security and compliance plan | 12% | Authentication and authorization, secrets management, security scanning |
| Implement an instrumentation strategy | 8% | Monitoring configuration, metrics analysis |
Build and release pipelines is worth more than the other four domains combined, so a study plan that spends equal time on each domain will under-prepare you for the exam. Treat the weight column as your budget, not a suggestion.
Design and implement processes and communications (14%)
This domain groups three skill clusters from the official study guide: Design and implement traceability and flow of work, Design and implement appropriate metrics and queries for DevOps, and Configure collaboration and communication. In practice this means you should be comfortable designing a flow-of-work structure such as GitHub Flow, wiring up feedback through notifications and issues, connecting GitHub projects or Azure Boards to repositories, and building dashboards that surface cycle time, lead time, and time to recovery. It also covers documenting a project with wikis and diagrams and generating release notes from Git history.
Design and implement a source control strategy (12%)
The two clusters here are Design and implement branching strategies for the source code and Configure and manage repositories. Expect scenario questions comparing trunk-based, feature-branch, and release-branch strategies, plus branch policies and protection rules that control pull requests and merges. Repository management covers large-file handling, scaling a Git repository, permissions, tags, and recovering or removing specific data from source control.
Design and implement build and release pipelines (54%)
This is the largest domain by far, built from three clusters: Design and implement a package management strategy, Design and implement a testing strategy for pipelines, and Design and implement pipelines. Package management covers choosing between tools such as GitHub Packages and Azure Artifacts, designing feeds, and versioning strategy for code and pipeline artifacts. The testing cluster covers quality and release gates, a full testing strategy across unit, integration, and load tests, and code coverage. The pipelines cluster covers choosing a deployment automation solution, agent and runner infrastructure, integration between GitHub and Azure Pipelines, trigger rules, YAML pipeline authoring, and job execution order including parallelism and multi-stage design.
Because this single domain outweighs the rest of the az 400 syllabus combined, most of your hands-on practice — writing YAML, wiring triggers, configuring gates — should happen here first.
Develop a security and compliance plan (12%)
Clusters: Design and implement authentication and authorization methods, Design and implement a strategy for managing sensitive information in automation, and Automate security and compliance scanning. This spans choosing between service principals and managed identities, GitHub and Azure DevOps authentication and permissions, managing secrets through Azure Key Vault, secretless authentication patterns, and configuring security scanning including Microsoft Defender for Cloud DevOps Security and GitHub Advanced Security.
Implement an instrumentation strategy (8%)
The smallest domain still splits into two clusters: Configure monitoring for a DevOps environment and Analyze metrics from instrumentation. Expect questions on Azure Monitor integration, Application Insights telemetry, GitHub Actions and Azure Pipelines alerting, infrastructure performance indicators, distributed tracing, and basic Kusto Query Language use for log queries.
How to use this AZ-400 syllabus
Study the domains in weight order, not the order Microsoft lists them. Spend the bulk of your preparation on build and release pipelines, then split remaining time across processes, source control, and security roughly evenly, and treat instrumentation as a final review pass. Pair this page with the study plan, which schedules preparation across these same weighted domains, and check the exam format page for how these topics translate into the exam experience. When you are ready to test yourself, the sample questions page and the practice test both follow this exact domain weighting.
This exam is part of the requirements toward Microsoft Certified: DevOps Engineer Expert, and confirming eligibility on the prerequisites page before you commit study time is worth doing early.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.