CertQuests
Azure Cloud Engineer Roadmap: 4 certs, 12–18 months, the order Microsoft shops actually hire in
The path is AZ-900 → AZ-104 → AZ-305 → AZ-500, in that order. Fundamentals → Administrator → Solutions Architect Expert → Security Engineer. AZ-104 is the floor; AZ-305 is the lever that pushes salary above the entry band.
Many candidates get hired after AZ-900 + AZ-104 and finish the rest on the job. That's a legitimate path. Azure dominates Fortune 500, government, and finance; if your target metro is Microsoft-heavy, Azure is the better bet over AWS. Don't waste time on AZ-204 (Developer) unless you're going into a developer-shaped role specifically.
Who this path is for
This roadmap is built for someone targeting a Cloud Engineer / Azure Administrator / Cloud Operations Engineer role at a Microsoft-shop — meaning the company runs primarily on Azure (often alongside Microsoft 365, Active Directory, and Windows infrastructure). The job involves managing subscriptions and resource groups, deploying via Bicep or Terraform, integrating with Entra ID, and building toward solutions-architecture or platform-engineering work.
It is not the right path if your target is:
- AWS-shop work — see the AWS Cloud Engineer roadmap instead.
- DevOps / SRE generalist — see the DevOps roadmap for the multi-cloud + Kubernetes shape.
- SOC / blue team — even with AZ-500, the SOC Analyst path is shaped differently.
The 4-step path, in order
Microsoft AZ-900 Azure Fundamentals
3–5 weeks ~50 hours FoundationWhy here: AZ-900 builds the Azure vocabulary — resource groups, subscriptions, tenants, regions, the difference between IaaS and PaaS in Microsoft's lexicon. Skip if you've used Azure daily; otherwise it pays for itself in faster AZ-104 study.
Microsoft AZ-104 Azure Administrator
10–12 weeks ~140 hours ATS gateWhy here: AZ-104 is the cert most "Azure Engineer" job postings list. It's broad and operational: managing identities, virtual networks, storage, compute, monitoring, and backup. This is where you stop memorizing Azure and start using Azure.
AZ-104 has a reputation for being heavier on hands-on portal/CLI work than its AWS equivalent. Budget extra time on the Azure portal — you'll be tested on it.
Microsoft AZ-305 Azure Solutions Architect Expert
12–16 weeks ~180 hours Salary leverWhy here: AZ-305 is the cert that turns "Azure Administrator" into "Azure Architect" on the resume. Designing identity and governance at scale, choosing between data store options, building reliable multi-region architectures.
AZ-305 is the toughest cert in this path — it expects you to make architecture trade-offs, not just describe services. Most candidates report it being noticeably harder than AWS SAA. Budget the extra weeks.
Microsoft AZ-500 Azure Security Engineer
10–14 weeks ~140 hours SpecialtyWhy here: regulated industries (finance, healthcare, government) expect every cloud engineer to understand Defender for Cloud, Sentinel, Key Vault, and Conditional Access. AZ-500 is also the cleanest gate into Cloud Security Engineer roles if you decide to specialize later.
AZ-500 is optional in pure dev or SaaS environments. If your target metro is finance- or government-heavy, treat it as required.
What you'll be able to do at the end
- Design a hub-spoke VNet topology with hybrid connectivity, ExpressRoute or VPN, and segmented network security groups.
- Provision Azure resources via Bicep or Terraform, with parameterized environments and CI/CD via Azure DevOps or GitHub Actions.
- Set up Entra ID Conditional Access policies, RBAC at scale, and PIM for privileged accounts.
- Triage a Defender for Cloud secure-score gap and write the remediation runbook.
- Articulate the cost trade-offs between App Service / Functions / AKS for a given workload.
What this path is worth
Snapshot of the Azure Cloud Engineer market in 2026 (US). Verify against current postings before negotiating.
Entry base (US)
$90k–$125kMid-market shops at the lower end. Finance, healthcare, gov-adjacent at the upper end.
Mid-level after 2–3 yrs
$125k–$165kSenior Azure Engineer or Cloud Solutions Architect track.
Open postings (US)
~42,000Behind AWS in volume but ahead in regulated-industry concentration.
Top hiring sectors
FinServ · Health · GovMicrosoft's enterprise dominance pays here. Pure-tech and SaaS lean AWS more often.
Common mistakes that cost candidates offers
- No homelab. Two certs without one Bicep- or Terraform-deployed Azure project on GitHub looks like memorization. Build something. The free credits are enough.
- Skipping IaC. Azure portal is fine for learning, fatal for jobs. Real work is Bicep, ARM, or Terraform. Don't graduate without writing all three at least once.
- Confusing AZ-104 and AZ-204. AZ-104 is admin/operations. AZ-204 is developer-focused. If you're not going into a dev role, AZ-104 is the correct choice — AZ-204 is a detour.
- Treating AZ-104 as the finish line. AZ-104 is the entry-level floor; AZ-305 is the salary lever. The delta between AZ-104 and AZ-305 holders is typically $20–35k base.
Start step 1 right now — no signup
Every cert in this path has a free practice pack on CertQuests with engineer-written explanations on every question.
Frequently asked questions
How long does it take to become an Azure Cloud Engineer?
Realistic range: 12–18 months part-time (8–12 hours/week) for the four-cert path. Most candidates get hired after AZ-900 + AZ-104 (months 5–8) and finish AZ-305 + AZ-500 on the job.
Should I learn AWS or Azure first?
Pick by employer market in your metro. Azure dominates Fortune 500 and government work; AWS dominates SaaS and tech. If you're on the East Coast, in finance, or anywhere Microsoft has a heavy enterprise footprint, Azure has more local jobs. The skills cross-translate after about 3 months on either platform.
Can I skip AZ-900 and start with AZ-104?
Yes if you have prior cloud experience. AZ-900 is a 3-week breadth cert that doesn't unlock anything. The benefit of doing it first: you'll burn through AZ-104 faster because the vocabulary is already in place.
Is AZ-305 worth it after AZ-104?
For senior or architect-track roles, yes. AZ-305 (Solutions Architect) is the cert that pushes you above the entry-level salary band. For pure operations or admin roles, AZ-104 is enough; AZ-305 is a $20–35k base-salary lever.
Do I need AZ-500 if I'm not in security?
It's optional. AZ-500 is most valuable in regulated industries (finance, healthcare, government) where every cloud engineer touches IAM, Sentinel, and compliance. In pure dev or platform roles, AZ-204 (Developer) or AZ-400 (DevOps) might be more relevant after AZ-305.
What does an Azure Cloud Engineer earn?
US median for entry-level Azure Cloud Engineer in 2026 is roughly $90,000–$125,000 base, with finance/government metros (NYC, DC, Seattle) pushing 20–30% higher. AZ-104 alone anchors the middle of the entry band; AZ-305 pushes you to the upper end.
Are hands-on labs required?
Yes. Microsoft offers a $200 free credit for 30 days plus 12 months of free-tier services. Build a project end-to-end: a 3-tier app on App Service + Azure SQL, a Function App with Storage triggers, a Bicep-deployed VM with monitoring. Document on GitHub.
How we wrote this roadmap
No Microsoft or training-vendor revenue. We don't take money from Microsoft, John Savill, MS Learn, or any cert vendor mentioned. The sequence is based on what Microsoft-shop job descriptions actually list, plus interviews with hiring managers across enterprise, finance, and government in 2025–2026.
What we'll change without being asked: if Microsoft retires or replaces a cert (they've done both with AZ-303/304 → AZ-305 history), we'll re-sequence within days. Tell us what you'd change. Last reviewed: April 27, 2026.