AZ-400 Exam Changes 2026: Build Hands-On Lab for New Skills
AZ-400 in 2026: understand what changed and build a lab that proves you can do the work
If you are searching for AZ-400 exam changes 2026, you likely want clarity on what actually shifted and how to adapt your study plan without starting from scratch. This guide explains the refreshed focus areas and turns them into a practical, job-ready lab you can run on the Azure free tier and GitHub.
You will see how the updated skills emphasise GitHub-first CI/CD, Infrastructure as Code with Bicep/Terraform, security and governance baked into pipelines, and real-world observability. We map each theme to concrete lab tasks, with a simple evening/weekend schedule you can stick to.
By the end, you will have a lean, hands-on lab plan that mirrors current DevOps practice in Azure and helps you prepare with confidence—without guessing which tools to prioritise or overspending on cloud resources.
AZ-400 exam changes 2026: what actually shifted
Key emphases in the refreshed skills
- GitHub-first delivery: More weight on GitHub Actions, reusable workflows, environments and approvals, while Azure DevOps Services remains relevant.
- Infrastructure as Code: Stronger use of Bicep (and Terraform in many teams), with validation (what-if/plan), review gates and modular templates.
- Security built into pipelines: Dependency and secret scanning, least-privilege access, OpenID Connect (OIDC) federation to Azure, and policy compliance checks.
- Governance and cost awareness: Tags, policy-as-code, and simple guardrails to keep environments consistent and spend controlled.
- Observability and reliability: Application Insights and Azure Monitor for logs, metrics and alerts; release health, rollback and change tracking.
- Containers where it fits: Building and shipping container images and deploying to an Azure runtime when appropriate.
You don’t need to abandon Azure DevOps if that’s your workplace toolset. Focus on transferable concepts (YAML pipelines, policies, approvals, IaC, observability). For the exam and modern workflows, be comfortable demonstrating the same ideas in GitHub.
Map the new focus areas to practical lab tasks
| Focus area | Hands-on lab task |
|---|---|
| GitHub Actions CI/CD | Create reusable workflows for build, test and deploy; use environments and approvals. |
| IaC with Bicep | Provision a resource group, App Service plan, Web App and Application Insights via Bicep, with what-if checks in CI. |
| Security and identity | Set up OIDC federation from GitHub to Azure; add dependency and secret scanning; enforce least privilege. |
| Policy and governance | Assign a built-in Azure Policy to enforce tags and deny risky configurations; surface compliance in PRs. |
| Observability | Enable App Insights, add release annotations, query logs, and trigger an alert on health checks. |
| Containers (optional) | Build a container image, push to GitHub Container Registry, and deploy to Azure App Service for Linux. |
Build your Azure free‑tier lab step by step
Prerequisites checklist
- Azure account with free tier/credits and the Azure CLI installed.
- GitHub account and a demo repository (public to save Actions minutes where appropriate).
- Sample app (e.g., a minimal Node.js/.NET/Java REST API).
- Basic familiarity with Azure core concepts; if you need fundamentals, consider Azure Fundamentals (AZ‑900).
Step 1 — Foundation and repo standards
Create a new GitHub repo with a main branch, protection rules, branch naming and conventional commits. Add CODEOWNERS and pull request templates so every change is reviewed—this mirrors real governance.
What good looks like
- Branch protection: required PR reviews and status checks.
- Conventional commits and PR templates to standardise changes.
- Issue labels and milestones to plan work transparently.
Step 2 — Continuous Integration with GitHub Actions
Add a build-and-test workflow: install dependencies, run unit tests, cache packages, and publish artefacts. Enable dependency and secret scanning on the repo. Treat failing checks as blockers for merge.
Use a reusable workflow (in .github/workflows) so future services can share the same CI logic—this is often examined and valued in practice.
Step 3 — Provision Azure with Bicep (IaC)
Author Bicep modules for a resource group, Linux App Service plan (F1 where suitable), Web App and Application Insights. In CI, run az deployment group what-if to validate changes. Store Bicep in a infra folder with clear module boundaries.
Prefer Bicep for the AZ-400 focus; keep Terraform as an optional extension if you already use it at work.
Step 4 — Secure identity: OIDC to Azure
Configure OpenID Connect federation so GitHub Actions can obtain a token for your subscription without long‑lived secrets. Grant the workflow a scoped role (for example, Contributor on the target resource group only).
Why this matters
- Removes stored secrets from CI/CD.
- Implements least privilege with role assignments.
- Aligns to modern DevSecOps expectations assessed in AZ‑400‑level skills.
Step 5 — Continuous Delivery with environments and approvals
Create staging and production environments in GitHub. Deploy Bicep to provision, then deploy the app to staging automatically on merge. Require a manual approval for production. Post a deployment summary as a job step.
On the Azure free tier, use Web App for Linux where possible. If a feature (e.g., slots) requires a paid SKU, simulate blue/green by separate staging and production apps and switching the DNS or app setting used by clients.
Step 6 — Policy-as-code guardrails
Assign a built‑in Azure Policy (for example, require tags on resources). In CI, run a script to check compliance and fail the PR if non‑compliant. Track exceptions in version control.
Step 7 — Observability and release health
Enable Application Insights, add release annotations from the pipeline, and create a simple Kusto query to surface failures. Configure an alert that pages you (email) if availability drops after a deploy. Add a rollback job that re‑releases the previous artefact when a health check fails.
Optional Step — Containerise the app
Build a Docker image, push to GitHub Container Registry, and deploy to Azure App Service for Containers. Keep an eye on SKUs and costs, and tear down when not in use.
Common mistakes to avoid
- Global Owner role for pipelines: Over‑permissive and unnecessary. Scope to the resource group.
- Manual tweaks in Azure after IaC: Drift breaks repeatability. Change Bicep and redeploy.
- Skipping tests and scans: The pipeline should block risky changes by default.
- No rollback path: Keep the previous artefact and a documented rollback job.
Evening and weekend study plan
5 hours per week (4 weeks)
- Week 1: Repo standards, CI workflow, tests, scans.
- Week 2: Bicep modules and what‑if validation.
- Week 3: OIDC setup, staging deploy, approvals.
- Week 4: Policy checks, observability, rollback drill.
10 hours per week (2–3 weeks)
- Week 1: CI + Bicep + initial deploy.
- Week 2: OIDC, environments, policies, alerts.
- Week 3: Container optional lab and resilience drills.
Want extra practice ideas after you finish the core lab? Try these portfolio‑friendly scenarios in CI/CD project ideas for a DevOps portfolio.
Two sensible preparation routes
Route A — Self‑guided lab + docs
Route B — Live support and coaching
Final guidance
Focus your AZ‑400 preparation on doing the work you’ll be tested on: version‑controlled IaC, secure GitHub‑to‑Azure deployments, policy guardrails and observable releases. Keep your lab small, repeatable and cost‑aware; practice merges, approvals, and rollbacks until they feel routine. When the concepts click in your lab, the exam scenarios make far more sense.
Next step: Book a free consultation to get personalised advice on the right IT course or career path for your goals.
Turn what you just learned into a real IT career move
Whether you want to build job-ready skills, follow a structured career path, or get expert advice before choosing a course, Codionix IT Training UK can help you move forward with confidence.
Explore IT Courses
Browse instructor-led training across cloud, cybersecurity, networking, data, support, digital skills, and more.
View CoursesView Career Paths
See structured pathways designed to help you progress toward roles like helpdesk technician, network engineer, ethical hacker, and beyond.
Explore Career PathsBook Free Consultation
Not sure which course or path fits you best? Speak with the team and get clear, practical guidance before you commit.
Get Free AdviceRelated articles
GitHub Actions vs Azure DevOps 2026 UK: Migrations & Costs
Compare GitHub Actions and Azure DevOps Pipelines from a UK perspective. Discover migration options and real-world costs to decide the best CI/CD path for your team.
GitOps vs CI/CD: Which Workflow Fits Growing Teams?
Compare GitOps and traditional CI/CD through a practical lens focused on growing teams. Learn key trade-offs and decision criteria to guide your workflow choices.
CI/CD Project Ideas for a DevOps Portfolio to Impress UK Employers
Discover seven practical CI/CD project ideas that turn classroom learning into verifiable DevOps skills. Build a portfolio that resonates with UK employers.
Free IT Training Consultation
Use the calendar to book your free one-to-one course advice session with a Codionix IT training expert. Get personalized career guidance to help you choose the best online IT course in the UK for your goals. We’re happy to answer any questions you may have and help you determine which of our training programs best fit your needs.
How it works?
You schedule a call at your convenience
We do a free discovery and consulting meeting
We guide you towards the best career path for you
Your benefits:
- Personal Guidance
- Course Clarity
- Career Focus
- Honest Advice
- Stress-Free
- Clear Direction
Find us on:
Schedule a Free Consultation
Not sure which IT course is right for you? Book a free consultation and get expert guidance from our team — no cost, no pressure.
