How to Learn Azure in 2027 (The Roadmap That Actually Works)
If I had to learn Azure from scratch today, I'd ignore most of the roadmaps floating around Reddit, LinkedIn, and YouTube. Including some of my own older content. Not because the people writing them are wrong about Azure, but because they're describing a job market and a certification portfolio that no longer exist.
The roadmap that worked in 2019 doesn't work in 2027, and this time I can point at exactly where it broke. Through 2026, Microsoft ran the largest certification shakeup in its history. AZ-204 is retired. AZ-500 is retired. AI-102 is retired. If you're following a roadmap someone wrote eighteen months ago, it's pointing you at exams you can no longer sit. I made most of these mistakes myself the slow way, which I talked about in I Wasted 2 Years Learning Azure Wrong.
I've been deep in Azure for almost a decade, with seven-plus years of production work, ten Microsoft certifications, and around five hundred engineers trained through workshops and one-on-one coaching. This is the roadmap I'd hand to myself if I could go back. Five phases, roughly eighteen months, and the part nobody talks about: the order matters more than any single certification or project in it. I walked through the five-phase structure on video in The 2026 Azure Roadmap in 5 Phases, and the phases held up. What you're reading is the map updated for the post-shakeup world.
Why the Old Roadmap Broke: Three Structural Shifts
Before the phases, you need to understand why the old path stopped working. Three things changed.
AI absorbed the "know the syntax" part of the job. Bicep templates, Terraform configurations, and kubectl YAML all used to take months to get comfortable with. Now you can prompt your way to syntactically correct infrastructure code in about thirty seconds. The career didn't disappear, but the leverage point moved. Knowing that a managed identity should be system-assigned and why is now worth far more than remembering the exact az flags to create one. The machine writes the flags. You make the decisions. I made the fuller argument about what AI actually takes over, and what it can't, in AI Isn't Replacing Cloud Engineers. It's Replacing THIS.
The "Cloud Engineer" title fragmented. Companies don't hire generalists at the entry level the way they did. They hire platform engineers, AI infrastructure engineers, agent developers, FinOps analysts, and cloud security engineers. On a resume in 2027, specificity beats breadth. The platform engineering lane in particular is where the money went, and I broke down that shift in DevOps Is Dead. Platform Engineering Pays $215K.
The bottom rung got harder to reach. Production experience matters more than ever, but entry-level roles got more competitive, because juniors are now competing with AI-augmented mid-level engineers for the same simple work. The way you get past that filter is by showing you've actually shipped something, not by stacking certifications nobody asked for. If you're starting from zero and want the wider career context first, I wrote a longer guide to breaking into a cloud computing career that covers the non-Azure-specific parts.
So the roadmap has to adapt. Here's what I'd do.
First, The 2027 Certification Reset
This is the part that makes every pre-2026 roadmap actively wrong, so it's worth ninety seconds before the phases.
Microsoft didn't tweak the certification portfolio. It rebuilt the AI-adjacent half of it and retired the originals:
| What old roadmaps tell you to take | What you actually take in 2027 |
|---|---|
| AZ-204 (Azure Developer) | AI-200, Azure AI Cloud Developer |
| AZ-500 (Security Engineer) | SC-500, Cloud and AI Security Engineer |
| AI-102 (AI Engineer) | AI-103, Azure AI Apps and Agents Developer |
| AI-900 (AI Fundamentals) | AI-901, same certification, new exam number |
Here's the part that should calm you down: the infrastructure core didn't move at all. AZ-900, AZ-104, AZ-305, and AZ-700 are untouched. Every specialization pivoted toward AI, but somebody still has to run the infrastructure those AI workloads sit on, and Microsoft left that track alone.
There's also an entirely new lane that didn't exist a year ago: the agent builder track, starting with AB-620. I'll come back to it in phase three, because it's the least crowded specialty on the map right now.
Pro tip: A certification you earned before its retirement stays valid and renewable. If you hold AZ-500 or AZ-204, nothing was taken from you. The retirement only closes the door for new candidates.
I keep the full track-by-track breakdown, including prep times and every new exam number, in my Azure Certification Roadmap 2027 field note. Use that as the reference; use this post as the sequence.
Phase 1: Orient by Passing AZ-900 in Under Four Weeks
The goal of phase one is narrow on purpose. You're not learning how to use Azure yet. You're learning what Azure is, so you can read the docs without getting lost and follow an architecture conversation without nodding politely.
Your deliverable is to pass the AZ-900. It's affordable, it's quick to study for, and the scope is broad enough to orient you. Microsoft Learn covers it well and there are free practice exams everywhere. Don't spend more than four weeks here.
The one thing I'd add for 2027 is AI-901, the Azure AI Fundamentals exam. It's a one-to-two week study effort, and AI vocabulary is now assumed in every cloud interview I sit in on. Two fundamentals exams inside six weeks is a reasonable start. More than two is procrastination dressed up as studying.
Pro tip: Treat AZ-900 as a map, not a credential. Nobody gets hired because they have it. You're taking it so the rest of this roadmap has somewhere to attach.
Phase 2: Build Something Real
This is the phase about ninety percent of beginners skip, and it's the one that makes the entire roadmap work. Pick a project that solves a real problem in your own life. Not a tutorial. Not a lab someone handed you. Something you'd actually use, like a personal Azure cost dashboard, a serverless function that emails you when a stock hits a price target, a static resume site that auto-deploys when you push to GitHub.
I want to be blunt about the lab thing, because it's the most expensive mistake in this phase. Clicking through a guided lab environment feels like progress and produces nothing you can show anyone. I've written about why cloud labs don't prepare you for real cloud work, and covered the same ground on video in Lab Environments Won't Get You a Cloud Job. If you want project ideas that hiring managers actually react to, I listed five of them in 5 Azure Projects That Actually Get You Hired.
The project doesn't have to be impressive. It has to be real. And it has to be built with infrastructure as code. Use Bicep if you're staying Azure-only, or Terraform if you want multi-cloud later. Either way, no portal clicks for resource creation. Everything in code, everything in Git, everything deployable from a pipeline.
One clarification, because I just told you to skip the labs. A guided lab is a good way to learn a specific mechanic quickly and a bad way to prove you can ship. Use one to get the syntax into your hands, then close it and go build the real thing with it. If you need that starting point, the first Bicep template lab and the intro to Terraform on Azure on CloudLearn both run in under an hour.
Here's the smallest possible starting point. A Bicep file that creates a resource group's worth of infrastructure, deployed from the CLI:
# Create the resource group your project lives in
az group create \
--name rg-cloud-portfolio \
--location canadacentral
# Deploy your Bicep template into it
az deployment group create \
--resource-group rg-cloud-portfolio \
--template-file ./infra/main.bicep \
--parameters environment=dev
That command is the whole point of phase two. You wrote the infrastructure as code, you committed it, and you can tear it down and recreate it identically tomorrow. That's the muscle real cloud work runs on.
If Bicep is new to you, start with what Azure Bicep actually is and then follow along with Azure Bicep From Scratch, where I build the first real template end to end. If you went down the Terraform path instead, the workflow is almost identical conceptually, and I walk through it in Terraform with Azure for beginners, and the same "no portal clicks, everything in Git" rule applies.
The last step is to make it deployable without you. Wire up a minimal GitHub Actions workflow that authenticates with OIDC, so there are no stored secrets, and deploys on every push:
# .github/workflows/deploy.yml
name: Deploy Infrastructure
on:
push:
branches: [main]
permissions:
id-token: write # required for OIDC login to Azure
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- run: az deployment group create
--resource-group rg-cloud-portfolio
--template-file ./infra/main.bicep
Gotcha: If you skip
id-token: write, theazure/loginstep fails with a confusing token error even though your federated credential is set up correctly. The permission block is the part people forget, and it's the silent failure that eats an afternoon.
If you'd rather see that pipeline built step by step before wiring your own, the Bicep deployments with GitHub Actions lab walks the whole flow, federated credential setup included.
Your deliverable for phase two is a public GitHub repo with working code, a README that explains what it does, and a live URL or running service somebody else can verify.
Phase 3: Pick a Specialty
This is where most roadmaps fail you. They tell you to "keep learning Azure" as if Azure is one thing. It isn't. It's a continent. And you don't move to a continent. You move to a city.
So look at the actual job market in your region. Read real postings. Notice which titles are getting hired, not which ones sound cool. Going into 2027 the specialties hiring most aggressively are platform engineering, AI infrastructure, cloud security, and FinOps. Site reliability engineering is in demand too, but that one usually wants broader experience first.
The newest option is agent engineering, and it's worth a serious look precisely because it's uncrowded. Microsoft shipped a whole certification family for it in 2026, and most companies are trying to roll out Copilot agents right now without anyone in the building who understands how they actually work. I walked through building one in Building Microsoft Copilot Agents. Being early to a lane is a real advantage, because nobody else in the resume pile is there yet either.
Pick exactly one. Read three or four job postings in that specialty, write down every skill listed under "required" and "preferred," and that list becomes your study plan for the next phase. If you're weighing whether to anchor on Azure alone or keep one foot in another cloud, I wrote an honest AWS vs Azure comparison from using both daily that's worth a read before you commit.
Your deliverable here is a one-page document that names your specialty, lists its top five required skills, and links three open job postings you want to be qualified for in twelve months.
Phase 4: Deepen With Certs That Still Exist
Now, and only now, you take certifications that carry weight.
Start with AZ-104. It's the Azure Administrator exam, it survived the shakeup completely untouched, and it's still the single certification that opens the most doors. If you only ever get one Azure cert, make it this one. I've got a resource and preparation guide for AZ-104 on this site, and an eight-week plan on video in AZ-104 in 8 Weeks. Fair warning: it has hands-on lab questions, so you cannot memorize your way through it. That's the one place I'd actively push you toward labs, because the exam is checking whether your hands know the portal and the CLI. The Azure labs catalogue is built for that, and configuring VNets and subnets plus Entra ID users, groups, and role assignments cover two of the heaviest exam domains.
Then take the specialty cert that matches phase three. AI-200 if you went the developer route. SC-500 if you went security. AI-103 if you went AI infrastructure. AB-620 if you went agents. Notice that this is the fourth or fifth thing in the sequence, not the first, and notice that every one of those exam numbers is different from what a 2025 roadmap would have told you.
But the cert is the easy part. The harder, more valuable part is shipping two more projects that prove the specialty.
If you picked platform engineering, build something with reusable Bicep modules, a GitHub Actions deployment pipeline, and a developer-experience layer. If you picked cloud security, do a hands-on Conditional Access deployment with Entra ID, publish the architecture diagram, and write up the threat model. The Conditional Access and MFA lab is a fast way to get the policy mechanics down before you design your own, and securing a web app with managed identity and Key Vault covers the exact pattern I'm about to warn you about. While you're there, audit your own work for the obvious mistakes. I documented the managed identity mistakes I see in nearly every client environment, and avoiding those alone will put you ahead of most candidates. If you picked AI infrastructure or agents, deploy something with Microsoft Foundry or a Copilot Studio agent, wire it to a real data source, and document the cost model honestly. If agents are the lane you picked, building interactive MCP apps on Azure Functions is the closest hands-on equivalent to what AB-620 actually tests.
Every project ends with a verification step that proves it works. For an IaC project, that's as simple as confirming the resources landed and are configured the way your template claims:
# Prove the deployment did what the template said it would
az resource list \
--resource-group rg-cloud-portfolio \
--output table
Pro tip: A project without a verification step is a draft, not a deliverable. The thing that separates people who get hired is that they can show the result, not just describe the intent.
Your deliverable for phase four is AZ-104, one specialty certification, and two more public projects in that specialty, both deployed and both documented.
Phase 5: Get Visible
The 2027 job market rewards engineers who are visible. Not viral, just visible. That means a LinkedIn presence where you post about what you're working on, a GitHub profile that shows recent activity, and a short blog or log describing what you broke and how you fixed it.
You don't need a million followers. You need a few hundred specific people, meaning recruiters, hiring managers, and fellow engineers in your specialty, to know you exist. That changes the math on every application you send. If the writing part is what's stopping you, I put together a guide on how to start writing technical blogs that covers getting the first few posts out.
Your deliverable is at least one post a week on LinkedIn about your actual work, for at least three months. Most people quit after about a month. I'd recommend sticking with it for the full three.
The Biggest Mistake: Front-Loading Certs
Here's the mistake I see most often. Beginners front-load the certifications and back-load the projects. They spend nine months grinding certs, then realize they have nothing on their GitHub, the cert is already going stale, the job market has moved, and they're competing against people who shipped real things.
In 2027 that mistake has a sharper edge to it. Some of the people who spent 2025 grinding AZ-204 and AZ-500 now hold certifications for exams that no longer exist. Their certs are still valid, and I want to be clear that they weren't wasted. But the projects those people built are the part that transferred cleanly through the shakeup, and the exam numbers weren't.
The fix isn't more certs. It's interleaving. Build a project, then take a cert. Build another project, then take another cert. Keep alternating between shipping and studying. The certification prepares you for production, but the production teaches you what the certification was actually trying to say.
If you only do certs, you get hired by the shrinking pool of companies that only care about certs. If you only do projects, you sometimes get filtered out by automated resume screeners looking for cert keywords. You need both, but the project is the centerpiece, and the cert is the supporting cast.
Warning: The other quiet mistake is aiming at "Cloud Engineer" as your target role. That title is fragmenting. Aim at the specialty instead: Platform Engineer, AI Infrastructure Engineer, Cloud Security Engineer, Agent Developer. Specificity is what gets a resume past the first screen.
And one more that's specific to this year: don't chase every new AI exam Microsoft ships. There are more than fifteen associate-level options on the map now. Pass one, build something with it, then move.
The Bigger Lesson
If you remember one thing from this, make it the order. Orient with AZ-900, build a real project, pick a specialty, deepen it with AZ-104 and a specialty cert plus two more projects, then get visible. The whole loop runs about eighteen months and should land you in a specialty role with a portfolio and a network, not a generic Cloud Engineer job but something tighter, better paid, and closer to what you actually want.
Notice what the 2026 shakeup did and didn't touch. It renamed exams, retired others, and invented a whole new track. It didn't change the sequence one bit. That's the real argument for building first: exam numbers have a shelf life, and the thing you shipped doesn't.
The pieces aren't secret. AZ-900, a few projects, AZ-104, a specialty cert, a LinkedIn habit. Plenty of people have all the same pieces. What separates the ones who get hired is the sequence they put them in. Build first, certify second, and never let the certifications outrun the things you've actually shipped.
