Skip to main content

The Azure certification roadmap in 2026, the order that actually works

Most posted Azure roadmaps treat the cert catalog like a checklist to complete from top to bottom. That produces candidates with five fundamentals badges and no associate-level depth, which is the opposite of what hiring managers look for. The right Azure roadmap is role-specific, and the order matters more than the count.

Below are six paths, one per role family, with the honest sequencing, the certs to skip, and the pacing that makes the prep stick.

The map​

Microsoft publishes over 60 active certifications in 2026. The ones that move careers sit in four tiers:

One important Azure-specific rule: the Expert-tier exams are formally prerequisite-gated. You cannot register for AZ-305 without first holding AZ-104 or AZ-204. This is not a soft recommendation. Microsoft enforces it at booking.

Path 1, the cloud administrator​

You manage Azure environments. VM provisioning, networking, storage, identity, access control. Your job runs on Azure Portal and the az CLI.

  1. AZ-900 (optional). Skip it if you have six or more months of hands-on Azure work. Take it if you're new to cloud.
  2. AZ-104. The core Azure admin cert. Tests virtual networks, subscriptions, governance, resource groups, Entra ID, storage accounts, and compute. It is the most-hired Azure cert in 2026. The 110 thousand US dollar median salary for AZ-104 holders sits at the lower bound of the associate tier because it is a generalist credential. What it opens is broad.
  3. Stop here for 12 months. Real production work between certs is not optional.
  4. AZ-305 when your role becomes architecture-facing. It tests landing zone design, hybrid connectivity, identity strategy, business continuity, and disaster recovery at enterprise scale. 145 thousand US dollar median in 2026. Requires AZ-104 or AZ-204 to register.

Path 2, the developer​

You build applications that run in Azure. App Service, Azure Functions, Azure Container Apps, Cosmos DB, Service Bus, Key Vault, Cognitive Services.

  1. AZ-900 (optional, same rule as above).
  2. AZ-204. The developer associate. Tests App Service, Functions, Blob Storage, Cosmos DB, Azure Cache for Redis, API Management, and event-driven patterns. The right cert for backend engineers and cloud-native app developers. Roadmap.
  3. AZ-400 if you also own pipelines, release management, IaC, and monitoring. The DevOps Engineer Expert cert formally requires AZ-204 or AZ-104. It tests GitHub Actions and Azure Pipelines at depth, plus Terraform, Bicep, and infrastructure observability. 155 thousand US dollar median in 2026. Roadmap.

AZ-400 without real deployment pipeline ownership is a cert you can pass but not use. The exam is hard to fake because the questions require reasoning from real pipelines, not memorized facts.

Path 3, the security engineer​

You own Azure security posture, identity governance, threat protection, and compliance. Your role is in a SOC, GRC team, or cloud security org.

  1. SC-900 (optional). Useful if security is genuinely new to you. Covers Entra ID basics, Defender products, Purview, and Compliance Manager at a conceptual level. Roadmap.
  2. AZ-104 or equivalent Azure fluency. The AZ-500 exam assumes you understand how Azure services are structured. Sitting AZ-500 without networking and identity context produces surface-level prep.
  3. AZ-500. The security engineer associate. Tests Entra ID at depth (Conditional Access, PIM, MFA), Key Vault, Defender for Cloud, Sentinel, DDoS Protection, NSGs, and secure workload design. 130 thousand US dollar median in 2026. Roadmap.

Pair AZ-500 with a vendor-neutral security cert for a stronger combined profile. The cybersecurity cert roadmap covers the CISSP and Security+ angles.

Path 4, the data engineer​

You build and operate data pipelines on Azure. Ingestion, transformation, storage, and serving. Your stack includes Synapse Analytics, Data Factory, Azure Data Lake, and increasingly Microsoft Fabric.

  1. DP-900 (optional). The data fundamentals cert. Useful vocabulary if analytics platforms are new to you. Roadmap.
  2. Then a choice based on your actual stack:
    • DP-203 if your work centers on Synapse Analytics and traditional Azure data engineering. The longer-standing associate cert. Tests Synapse, Data Factory, Azure Data Lake Storage Gen2, Stream Analytics, and Databricks integration. Roadmap.
    • DP-700 if your stack has moved to Microsoft Fabric. The newer associate cert, first offered in 2024. Tests Fabric lakehouses, OneLake, Fabric pipelines, and real-time analytics. Roadmap.

If your employer uses both Synapse and Fabric, take DP-203 first. It has deeper Synapse coverage and a longer track record in job postings.

Path 5, the AI engineer or data scientist​

You build ML models and AI systems on Azure. SageMaker is not your world. Yours is Azure Machine Learning, Azure AI Services, and OpenAI Service on Azure.

  1. AI-900 (optional). The Azure AI Fundamentals cert covers AI concepts, Azure AI Services, and basic ML pipeline vocabulary. Worth taking if ML is new to you. Roadmap.
  2. DP-100. The data scientist associate. Tests Azure Machine Learning at depth: workspace management, feature engineering, model training, AutoML, pipelines, model deployment, and responsible AI. 135 thousand US dollar median in 2026. Roadmap.

If you came from a data engineering background and ML is new, take AI-900 before DP-100. If you came from ML and Azure is new, take AZ-900 first for the cloud vocabulary layer.

Path 6, the network engineer​

You own Azure network topology. Virtual networks, peering, ExpressRoute, VPN Gateway, Azure Firewall, DNS, load balancers, and hybrid connectivity.

  1. AZ-104 as the foundation. Networking in Azure makes no sense without understanding resource groups, subscriptions, and identity. AZ-104 is the prerequisite floor.
  2. AZ-700. The network engineer associate. Tests VNet design, peering, VPN Gateway configuration, ExpressRoute circuits, Azure Firewall, DNS zones, and Private Endpoint at depth. It is narrower than AZ-104 but much deeper on networking. Right for engineers whose daily reality is hybrid connectivity and network security policy. Roadmap.

A smaller subset of network engineers also holds AZ-800 (Windows Server Hybrid Administrator) when their environment mixes on-premises Windows Server with Azure Arc. The AZ-800 is not a common standalone path but a common add-on for engineers running hybrid estates.

Exam costs​

Every Microsoft certification exam costs $165 USD in 2026, regardless of tier. This uniformity is a meaningful difference from AWS, where Professional and Specialty exams cost twice as much as Associates.

PathExamsTotal (before discounts)
Admin (AZ-900 + AZ-104 + AZ-305)3$495
Developer (AZ-900 + AZ-204 + AZ-400)3$495
Security (SC-900 + AZ-500)2$330
Data engineer (DP-900 + DP-203)2$330
AI / data scientist (AI-900 + DP-100)2$330

Microsoft exam vouchers circulate through Microsoft Learn, enterprise MSDN subscriptions, and Microsoft partner programs. If your employer has a Microsoft partnership, check before paying full price.

What to skip​

Common time sinks in the Azure catalog:

  • Multiple fundamentals certs as a stack. Each fundamentals cert maps to one track. Pick the one that matches your path and move on. Holding AZ-900, AI-900, and DP-900 simultaneously signals breadth anxiety, not expertise.
  • AZ-305 before AZ-104. Microsoft blocks this at the exam-booking level. If you see a prep guide that suggests otherwise, that guide is out of date.
  • AZ-800 as a standalone first cert. The Windows Server Hybrid Administrator cert is a specialist credential for engineers who already run Azure and on-premises Windows together. It is not an entry point.
  • Specialty certs without a matching job. Azure Network Engineer (AZ-700) is high-value for network engineers. For everyone else, it is depth in a domain they will not use.

Renewal timeline​

Azure certs renew annually via a free online assessment on Microsoft Learn. This is different from AWS, which uses a three-year cycle. The renewal assessment is shorter than the original exam (roughly 25 questions) and can be taken any time within the 180-day renewal window before expiration. Missing the window means re-sitting the full exam. Set a calendar reminder six months before your cert expiry date.

Pacing the full arc​

For someone studying while working full-time:

  • Months 0 to 1: AZ-900. Not mandatory, but cheap for the vocabulary.
  • Months 2 to 6: AZ-104. The heaviest associate in terms of breadth. Expect 80 to 160 hours depending on starting point.
  • Months 7 to 18: Real work. Build things, break things, respond to incidents. No cert replaces this.
  • Months 18 to 30: AZ-305 (for architects) or a role-specific associate (AZ-204, AZ-400, AZ-500).
  • Renewal check: Set a reminder at month 9 from any cert date. The annual renewal is low-effort, but missing it restarts the clock.

The candidates who stall in the Azure cert path are almost always the ones who try to compress the real-work phase. Six months in a lab is not the same as six months on a production environment someone relies on. The cert exams can tell the difference.

Common questions​

Is AZ-104 worth it without work experience?​

It is worth sitting, but it is worth less. Hiring managers value AZ-104 plus demonstrated work experience significantly more than the cert alone. If you have no Azure work yet, the cert opens doors. Once you're through, close the experience gap as fast as possible.

How does the Azure path compare to the AWS path?​

The two catalogs are more similar than different at the associate level. AZ-104 is the Azure equivalent of SAA-C03: broad, high-leverage, the cert most people should take first. The expert tier in Azure (AZ-305, AZ-400) is formally prerequisite-gated, while AWS's Professional exams are not formally gated though they assume associate fluency. See the AWS certification path if you're deciding between the two clouds.

Can I hold both Azure and AWS certs?​

Yes, and many senior cloud engineers do. The most common combination is SAA-C03 plus AZ-104, giving a generalist profile that covers both clouds. For architects, SAP-C02 plus AZ-305 is the senior dual-cloud credential. The prep overlap between AWS and Azure at the associate level is around 30 to 40 percent. Building genuine fluency in both takes longer than chasing two badge counts.

What about Azure certifications for Microsoft 365 or Power Platform?​

MS-900 and PL-900 are the entry points for those tracks. They are separate role families from cloud infrastructure and developer work. MS-900 leads toward Microsoft 365 administration roles. PL-900 leads toward Power Platform developer and administrator roles. They are not substitutes for AZ-900 or AZ-104 in a cloud infrastructure path.

Pick your path, then run a diagnostic​

Identify the role family first. Then run the free CAT evaluation for the first cert in your sequence. Twenty-five questions, per-domain skill estimates, a phased roadmap tuned to your real starting level. The diagnostic tells you whether you should start at AZ-900 or skip straight to AZ-104, and how much prep time to budget before your target exam date. Booking an exam before running the diagnostic is the most common way candidates misallocate two months of study.