AZ-900 gives candidates a foundation in cloud concepts, Azure architecture and services, and Azure management and governance. It is useful because it teaches the vocabulary and service categories that appear across Azure work. It is not, however, a mandatory first rung in a fixed certification ladder. After the fundamentals, the right next exam depends on which responsibilities you want to perform.
The most useful decision is to move from “What comes after AZ-900?” to “Which Azure role should I be able to perform?” Administration, architecture, networking, and security all reuse the same platform concepts at different depths. The person operating virtual networks needs different mastery from the person designing enterprise connectivity; the person implementing security controls needs a different decision model from the architect defining organization-wide security strategy.
Within Microsoft certifications, AZ-104, AZ-305, AZ-700, and the current security portfolio provide distinct next directions. One important 2026 update is that AZ-500 retired on August 31, so candidates should not build a new path as if the Azure Security Engineer exam were still active.
AZ-900 is a foundation, not a prerequisite gate
AZ-900 is designed around foundational knowledge. It helps candidates understand shared responsibility, cloud models, Azure regions and resource organization, common compute and networking concepts, identity and security ideas, cost and governance, deployment tooling, and monitoring. Those concepts make later role-based training easier because the learner no longer has to decode basic Azure terminology while also learning operational skills.
Foundational knowledge should therefore be treated as readiness rather than as a rule. An experienced Azure administrator may not need AZ-900 before studying AZ-104. A newcomer may benefit greatly from it. The important transition is moving from “describe what Azure offers” to “perform a role using Azure,” which requires hands-on configuration, troubleshooting, or design judgment depending on the route.
Choose AZ-104 when you want to operate Azure environments
AZ-104 is the strongest next step for candidates aiming at Azure administration or cloud operations. The exam covers implementation, management, and monitoring across identity and governance, storage, compute, virtual networking, and monitoring and maintenance. Those are the day-two responsibilities that begin after a resource has been proposed or provisioned.
AZ-104 study should become practical quickly. Create identities and role assignments, organize subscriptions and resource groups, deploy compute, configure storage, build virtual networks, test name resolution, restrict access, create monitoring signals, and restore from backup. The goal is to understand not only what a feature does, but how resources depend on one another and how to troubleshoot when the expected behavior does not occur.
Choose AZ-305 when your work is becoming architecture
AZ-305 is aimed at designing Azure infrastructure solutions. The architect translates requirements into designs across identity, governance, monitoring, storage, business continuity, and infrastructure. That requires comparing alternatives and explaining why one pattern fits requirements better than another.
There is an important certification detail: earning the Azure Solutions Architect Expert certification requires the Azure Administrator Associate certification in addition to passing AZ-305. That requirement should not be confused with saying every person must pass AZ-104 before learning architecture concepts. The deeper point is that architecture benefits from operational knowledge. Designs are more credible when the architect understands implementation friction, failure modes, monitoring, recovery, and governance in real Azure environments.
Choose AZ-700 when networking is the work, not just one topic
AZ-700 is for candidates who need dedicated depth in Azure networking. The role covers core network infrastructure, hybrid connectivity, application delivery, private access, network security, monitoring, resiliency, and troubleshooting. Networking appears in AZ-104 and AZ-305, but AZ-700 turns it into the center of the job.
This route makes sense when you routinely design or operate virtual networks, connectivity to on-premises environments, routing, name resolution, load balancing, private access, network security, or connectivity monitoring. Hands-on work matters because cloud networking failures can come from overlapping address plans, incorrect routes, name-resolution paths, security rules, or asymmetric designs that are difficult to diagnose from theory alone.
A practical Azure networking lab mindset is therefore more useful than memorizing service names. Build paths, break them intentionally, inspect traffic and DNS behavior, and learn which telemetry confirms the actual failure domain.
Do not treat AZ-500 as a current security destination
AZ-500 remains useful for historical context because it represented Azure Security Engineer skills, but Microsoft retired the exam on August 31, 2026. A current path should say that explicitly. Presenting it beside active exams without the retirement status can send new candidates toward outdated preparation.
Microsoft’s current implementation direction is SC-500, which focuses on implementing end-to-end security controls for cloud and AI workloads. That shift broadens the security conversation beyond a resource-by-resource Azure framing. Candidates interested in hands-on security should inspect SC-500’s current scope, while candidates moving toward organization-wide cybersecurity architecture should separately consider SC-100.
Use your recurring work to choose between administration and networking
AZ-104 and AZ-700 overlap because administrators configure networks and network engineers still need identity, monitoring, and resource-management context. The difference is depth and frequency. If virtual networking is one of several responsibilities you manage, AZ-104 is usually the better foundation. If network design, hybrid connectivity, private access, routing, security, and application delivery occupy most of your work, AZ-700 is the more precise target.
A useful test is to look at the incidents you are expected to own. Administrators may be responsible for a failed virtual machine, storage access issue, backup problem, identity assignment, or network path. Network engineers are more likely to own cross-network reachability, complex routing, hybrid links, application delivery, private endpoints, DNS architecture, and network security patterns. Let that ownership pattern drive the choice.
Move to architecture only when you are ready to reason in trade-offs
Candidates sometimes choose AZ-305 immediately after AZ-900 because “architect” sounds like the most advanced destination. That can produce shallow learning if the person has little experience operating Azure. Architecture questions are difficult not because they require obscure facts, but because several choices can be technically valid and the requirements determine which trade-off is best.
Operational experience gives those trade-offs weight. Someone who has managed role assignments understands permission sprawl. Someone who has debugged DNS understands why name resolution belongs in architecture. Someone who has restored data understands the difference between backup and high availability. Someone who has managed monitoring understands why observability must be designed, not appended. This is why AZ-104-style practice is such a valuable bridge even when the long-term goal is architecture.
Hands-on evidence should guide the next certification choice
Before committing to a role-based exam, spend enough time in Azure to see which problems hold your attention. Build a small environment with resource groups, identity, storage, compute, networking, monitoring, and policy. If you enjoy making the whole environment work reliably, AZ-104 is a natural fit. If you keep redesigning the topology and asking how it should scale, architecture or networking may be more attractive.
Practical work also exposes hidden prerequisites. Someone interested in AZ-700 may discover that weak DNS fundamentals make every lab harder. Someone aiming at security may discover that identity and network basics need improvement first. Someone attracted to AZ-305 may realize that backup, monitoring, and operational access are still abstract. Use those observations to sequence learning rather than assuming an exam title tells you everything you need.
Do not confuse an exam path with a career guarantee
A certification can structure learning and provide a recognizable signal, but it does not replace the ability to operate systems, explain decisions, troubleshoot ambiguity, or communicate with stakeholders. Azure roles are especially dependent on practical experience because cloud services interact. Employers need people who can connect the platform knowledge to production constraints, not only recall the documented feature set.
That means the best “next exam” may sometimes be delayed while you deepen practice. Build a project, support an existing environment, document an architecture decision, or troubleshoot real incidents. When certification study is attached to that experience, the objectives become a framework for organizing what you have seen instead of a list of facts that disappear after the test.
It is also useful to distinguish certification requirements from learning prerequisites. Microsoft may require a specific certification combination for an expert credential, but learning is more flexible. You can study networking before AZ-104, explore architecture patterns before earning an administrator credential, or practice security while building core Azure skills. The formal credential path and the most effective personal learning sequence do not always have to be identical.
Use that flexibility deliberately. If a future role requires architecture, study the operational services deeply enough to understand their consequences before focusing on design. If your future role is networking, strengthen IP addressing, DNS, routing, and security fundamentals alongside Azure-specific services. Certification objectives are most valuable when they expose a real technical dependency you can practice.
Keep a small decision log while practicing. Record what you built, the option you selected, why you selected it, what failed, and what you would change at larger scale. That habit turns labs into reusable experience and makes it easier to see whether your interests are operational, networking-focused, security-focused, or architectural.
Build a path from the role you want six months from now
After AZ-900, choose a route based on the work you want to perform in the near term. For cloud operations, build toward AZ-104. For dedicated Azure networking, build toward AZ-700. For solution design, develop operational depth and then pursue AZ-305 within the requirements of the expert certification. For hands-on security, use the current SC-500 direction rather than planning around retired AZ-500.
You do not need to collect every Azure exam to demonstrate progress. A focused path with practical experience is stronger than a wide set of shallow credentials. Use AZ-900 to establish the common language, then choose the role-based exam that forces you to solve the kinds of problems you actually want to own.