AZ-401 Study Guide: Agentic DevOps Engineer Expert

Objectives and Microsoft Learn pages checked 2026-10-26

TL;DR

AZ-401, Designing and Implementing Microsoft Agentic DevOps Solutions, is a beta Expert exam with a passing score of 700. Build and release pipelines carry 35-40% of the weight, and the rest splits across processes, security, instrumentation and source control. Study 40 focused hours, weighted by the blueprint, with labs on both Azure DevOps and GitHub.

Beta notice. The exam and the Microsoft Certified: Agentic DevOps Engineer Expert credential are both in beta. Beta exams are not scored immediately, and Microsoft's official Practice Assessment is not currently available. See the credential page and Microsoft's beta exam guidance.

MSCertQuiz sells practice-exam access for AZ-401 and other Microsoft/GitHub certifications; this guide is written by the same team that builds and maintains that question bank.

This page leaves out the exam price, duration and number of questions. The Microsoft pages we checked on 2026-10-26 do not state them, and a guess would be worse than a gap. The official AZ-401 study guide is the source for everything below about skills and weights.

One change, five domains: following a commit from idea to incident

The exam is easiest to hold in your head as the life of a single change. It starts as a work item, becomes a branch, moves through a pipeline, reaches production under security controls, and is finally watched by instrumentation. Each stop is a domain.

Processes and communications (15-20%) covers the front of that journey. You design the flow of work across plan, build, deploy and operate, set up feedback and notifications, track work in Azure Boards, and trace commits back to bugs and quality. Newer in this exam is the collaboration layer for agents: documenting projects with AI assistance, setting requirements and restrictions for agentic development (agents, skills and loops), and configuring MCP servers for Azure DevOps and GitHub.

Source control strategy (10-15%) is the smallest block and the most mechanical. Expect trunk-based, feature, release, Git flow, GitHub flow and Git worktree strategies, pull request workflows enforced by branch policies and branch protection rules (including rules for GitHub Copilot), Git hooks, tags, recovery and removal of data with Git commands, and migrating a repository from Azure DevOps to GitHub.

Build and release pipelines (35-40%) is where the change spends most of its life. It spans package management with Azure Artifacts and GitHub Packages, versioning with SemVer and CalVer, testing strategy and quality gates, runner and agent infrastructure, YAML triggers, templates and environment checks, GitHub Agentic Workflows, deployment patterns such as blue-green, canary, ring and feature flags, infrastructure as code, and pipeline health and retention.

Security and compliance (15-20%) decides whether the change is allowed to ship. You choose between service principals and managed identities, manage GitHub Apps, GITHUB_TOKEN and personal access tokens, implement secretless authentication, integrate Azure Key Vault, prevent leakage, and configure scanning with GitHub Advanced Security and Defender for Cloud DevOps Security.

Instrumentation (15-20%) closes the loop. You build dashboards for cycle time, lead time and time to recovery, connect Azure Monitor and Log Analytics, deploy and configure the Azure Copilot Observability Agent and Azure SRE Agent, analyze telemetry and distributed traces, collect GitHub Copilot agent logs, and query logs with KQL or natural language.

Domain	AZ-401 weight	AZ-400 weight (July 27, 2026 update)
Design and implement build and release pipelines	35-40%	50-55%
Design and implement processes and communications	15-20%	10-15%
Design and implement a security and compliance plan	15-20%	10-15%
Implement an instrumentation strategy	15-20%	5-10%
Design and implement a source control strategy	10-15%	10-15%

Weights from the AZ-401 and AZ-400 study guides on Microsoft Learn. Our own AZ-400 study guide covers the older exam in full.

Six things candidates assume about AZ-401, and what the sources say

Can I pass AZ-401 by knowing Azure Pipelines alone?

No. Pipelines is the largest block at 35-40%, which leaves most of the exam elsewhere. The objectives name GitHub Actions, GitHub Advanced Security, GITHUB_TOKEN and GitHub Apps beside their Azure DevOps equivalents, so you need both platforms.

Week one of the plan below puts both platforms side by side on purpose. For every Azure DevOps control you learn, find its GitHub counterpart the same day.

Do I need to build AI agents from scratch?

The objectives point the other way. Microsoft frames the role as integrating AI assistance tools into DevOps work, and the skills read as configure, deploy, investigate and govern: MCP servers, Azure SRE Agent, the Azure Copilot Observability Agent, and Copilot-assisted YAML. Nothing in the list asks you to train a model.

Practice means operating the agents and limiting them, which is why identity, run modes and read-only settings matter more than prompt craft.

Is AZ-401 mostly a GitHub Copilot exam?

No. Copilot appears in specific bullets, such as writing pipeline YAML, branch rules for Copilot, quality gates and code coverage. The bulk is classic delivery engineering: branching, packages, deployment strategies, secrets, scanning and monitoring. Treat Copilot as a tool inside those tasks.

A useful test is to read each Copilot bullet and ask which underlying DevOps skill it sits on. That skill is what you will be tested on first.

Can a prompt instruction secure an agent?

Not on this exam. Limits that count are enforced elsewhere: read-only toolsets on an MCP server, run modes, scoped managed identities and safe outputs in agentic workflows. An instruction guides a model but removes no capability, so options relying on one are usually distractors.

This is the most common trap in our free question set, where it shows up in three of the 14 questions.

Does a beta exam give me a score right away?

No. Microsoft states that beta exams are not scored immediately because it is gathering data on question and exam quality. The passing score is listed as 700. Plan your calendar around a delayed result and check the beta exam help page for current timing.

If you need the credential for a deadline, factor that delay in before you book.

Can I use the official practice assessment?

Not at the moment. Microsoft notes that the Practice Assessment for AZ-401 is not currently available and that practice assessments are usually available within eight weeks of an exam leaving beta and becoming generally available. Until then, rely on the study guide, hands-on labs and independent question sets.

Microsoft also offers an exam sandbox that demos the exam interface, which is worth ten minutes so the format holds no surprises.

Which mistakes do AZ-401 questions punish most?

The 14-question free AZ-401 set gives a rationale for every wrong option, and its distractors fall into nine recurring reasoning errors. The most common is a control placed in the wrong layer, which drives three of the 14 questions. The five most common are below; all nine are listed in the practice set.

Pattern	How it looks in a scenario
Control in the wrong layer	A YAML condition offered where a resource-level check is needed
Right tool, wrong actor	A managed identity on a runner that is not an Azure resource
Forward-only versus retrospective	Push protection offered to find a secret committed months ago
Mode confused with permission	Approval mode treated as if it limited what an agent can reach
History edited versus extended	A revert offered for a credential that must leave history

How many hours does AZ-401 need?

Plan for about 40 hours. That figure is our recommendation, not a Microsoft number: it splits 40 hours by the midpoint of each published weight, then is adjusted by hand so the total is 40 hours. Pipelines gets the largest share at 14.5 hours. Add time where the last column describes you.

Domain	Weight	Hours	Labs worth the time	Add hours if
Build and release pipelines	35-40%	14.5	Environment with branch control, approval and exclusive lock; YAML templates; Artifacts feed with views; an agentic workflow with safe outputs	You have not run both Azure Pipelines and GitHub Actions
Processes and communications	15-20%	7	Remote Azure DevOps MCP server with read-only toolsets; Azure Boards linked to GitHub; flow metrics queries	MCP and agent skills are new to you
Security and compliance	15-20%	7	GitHub to Azure sign-in with a federated credential; Key Vault in a pipeline; Advanced Security with a status check	You rely on stored secrets today
Instrumentation	15-20%	7	Application Insights tracing plus KQL; an SRE Agent response plan in Review mode; Observability Agent scope and roles	You have not used Azure Monitor beyond dashboards
Source control strategy	10-15%	4.5	Branch policies; worktrees; history rewrite with filter-repo; a repository migration	Git recovery commands feel rusty

How do the four weeks line up with the myths?

Each week below is paired with the assumption it is most likely to correct. Finish the lab first, then read the matching answer above, so you meet each myth with evidence from your own tenant.

Week	Focus	Myth to test
Week 1	Pipelines part 1: checks, identities, templates	Myths 1 and 4. Build one deployment path on each platform and note where the control lives.
Week 2	Pipelines part 2: packages, deployment strategies, agentic workflows	Myth 2. Operate an agent with limits, not just prompts.
Week 3	Security, instrumentation and the AI agents	Myth 3. Tie each Copilot bullet to the skill beneath it.
Week 4	Processes, source control and review	Myths 5 and 6. Sit mixed scenario questions and review every miss against the objectives.

Which study resources earn their hours during a beta?

Official material is thin right now because the exam is new. The study guide and product documentation do the heavy lifting, and the table is blunt about what each can and cannot give you.

Resource	Cost	Best for	Limit
Microsoft AZ-401 study guide	Free	The authoritative skills list and linked docs	No questions or labs. It tells you what, not how deep.
Product documentation (Azure DevOps, Azure Monitor, GitHub Actions, GitHub Advanced Security, Copilot)	Free	Exact behavior, limits and supported configurations	Large. Read for the objective you are drilling, not cover to cover.
Microsoft exam sandbox	Free	Learn the exam interface	Does not contain AZ-401 content.
Official Practice Assessment	Not currently available	Would be the closest official format check	Microsoft says it usually arrives within eight weeks of the exam leaving beta.
MSCertQuiz AZ-401 practice	Paid, with free questions	Scenario questions that explain every option	We sell it, so weigh this row accordingly. Try the free set first.

When you are ready to test yourself, the AZ-401 practice quiz and the readiness quiz are the next stops. The cheat sheet is meant for the last days before the exam.

AZ-401 questions people ask

What is the AZ-401 exam?

AZ-401 is Microsoft's beta exam Designing and Implementing Microsoft Agentic DevOps Solutions. It is the required exam for Microsoft Certified: Agentic DevOps Engineer Expert, a credential also in beta. It targets people who deliver DevOps solutions on Azure DevOps and GitHub while integrating AI assistance tools.

Is AZ-401 still in beta?

Yes, as of 2026-10-26 Microsoft Learn labels both the exam and the credential as beta. Beta exams are not scored immediately because Microsoft gathers data on question quality. Re-check the credential page before you book, since the status will change when the exam goes generally available.

What is the AZ-401 passing score?

Microsoft lists a passing score of 700 on the credential page and the study guide. Because it is a beta exam, results are not issued immediately. This guide does not state price, duration or question count, because the pages checked did not give them.

What domains and weights does AZ-401 have?

Five domains: build and release pipelines (35-40%), processes and communications (15-20%), security and compliance plan (15-20%), instrumentation strategy (15-20%), and source control strategy (10-15%). Pipelines carries the most weight, but it is not a majority of the exam.

Does AZ-401 replace AZ-400?

The Learn pages checked for AZ-401 do not say it replaces AZ-400, and the AZ-400 study guide was still published when we looked. They are separate exams with different skills lists. Confirm retirement or replacement status on Microsoft Learn before choosing between them.

Is there an official AZ-401 practice test?

Not currently. Microsoft says the Practice Assessment for this exam is not available and usually appears within eight weeks of the exam leaving beta. Meanwhile you can use the free exam sandbox for the interface and independent practice questions for content.

What hands-on experience does AZ-401 assume?

Microsoft describes candidates as developers or infrastructure administrators with strong skills in Microsoft technologies, practical experience with YAML, KQL and Bicep, and experience implementing both Azure DevOps and GitHub solutions using Microsoft and GitHub AI tools.

Ready to pressure-test the plan?

Start with the AZ-401 certification page, compare it against other exams on the certifications hub, and recheck Microsoft Learn before booking, since beta details change.

Sources: credential page, AZ-401 study guide, AZ-400 study guide.