From Windows sysadmin to Azure cloud engineer in 12 months.

Why this pivot works in 2026

Azure has spent five years catching AWS on enterprise share, and the install base now skews Microsoft-heavy: hospitals, banks, insurance, manufacturing, and most state-and-local government. The U.S. Bureau of Labor Statistics tracks the broader computer-and-information-systems bucket at a 2024 median wage of $169,510 and 17% projected growth through 2033, but Azure-specialised cloud engineer titles consistently price above the overall median because every Windows-heavy enterprise is migrating something into Azure right now — AVD, Files, SQL Managed Instance, Entra ID, Intune, Sentinel — and most cannot find people who already speak both sides of the wire.

You are that person. Active Directory maps almost cleanly to Entra ID. Group Policy maps to Intune configuration profiles. PowerShell remoting maps to Azure Run Command and Automation Account runbooks. Hyper-V maps to Azure VM Scale Sets. The vocabulary is 60% the same; the rest is the cloud control plane (subscriptions, management groups, RBAC, policy) plus declarative IaC. A junior backend dev hired into Azure cloud engineering has to learn all of that from scratch — you only have to learn the half you do not already know.

The 12-month sequence

Three phases of four months. Each phase has one cert plus a tangible artifact — a real migration, a real Bicep / Terraform module, a real landing zone. Skip either side and the phase does not count.

Months 1–4 — The Azure portal in your hands (AZ-104)

• Cert: Microsoft AZ-104 Azure Administrator Associate ($165, ~100 study hours, ~70% first-attempt pass rate). The single most-referenced Azure credential on LinkedIn cloud-engineer postings and the one that signals “I have actually clicked through the portal,” not just watched a course.
• Artifact: migrate one workload you already own — a file server, a print server, a small line-of-business app — into Azure on a real subscription. Document the cutover in a public GitHub repo with the runbook, the Azure Migrate report, and the cost comparison. Even a personal lab counts; the point is the README.
• Coding: 3 hours/week levelling up PowerShell into the Az module — Connect-AzAccount, Get-AzVM, New-AzResourceGroupDeployment, then your first Bicep template. Avoid the temptation to write everything as imperative az cli one-liners; that is the trap.
• Subscription cost: $20–40/month on pay-as-you-go after the $200 free credit expires. Bake it in as part of your study budget; the AZ-104 exam tests reflexes you only build by paying for resources and watching the cost meter move.

Months 5–8 — Declarative state (Terraform Associate 003 + a real landing zone)

• Cert: HashiCorp Terraform Associate 003 ($70.50, ~50 study hours, ~75% first-attempt pass). Cheapest credential in the stack and the one that proves you can think in declarative state, not bash or PowerShell scripts. Bicep is fine to learn alongside — many Microsoft shops prefer it — but Terraform postings outnumber Bicep postings roughly 4:1 in May 2026 LinkedIn searches, so Terraform first.
• Artifact: a public Terraform repo that stands up a small Azure landing zone — one hub vnet with Azure Firewall, two spoke vnets, an Azure Bastion, a Log Analytics workspace, an Entra ID enterprise application, and a CI job that runs terraform plan on every PR. This is the single most-asked-about portfolio item in Azure cloud engineer interviews in 2026.
• The burnout month is month 6. Most Windows-background candidates hit the wall when state files, workspaces, and provider authentication collide for the first time. Plan a one-week pause around week 22, then come back — do not start a second cert on top of an unfinished landing zone.

Months 9–12 — The architect chair (AZ-305) + apply

• Cert: Microsoft AZ-305 Azure Solutions Architect Expert ($165, ~80 study hours on top of AZ-104, ~65% first-attempt pass). This is the credential that flips your LinkedIn recruiter inbox from sysadmin pings to cloud-engineer and cloud-architect pings. Most Windows-sysadmin pivots stall here because candidates think they need 5 years of Azure before attempting it. They do not.
• Artifact: a write-up — not a code repo — that walks through one architectural decision (multi-region active-active vs. active-passive, AVD vs. Citrix on Azure, SQL Managed Instance vs. self-hosted SQL on IaaS, hub-spoke vs. Virtual WAN) with the cost numbers, the failure modes, and the RTO/RPO trade-offs. Publish it as a blog post or LinkedIn article. The AZ-305 measures exactly this reasoning, and the article doubles as interview material.
• Apply month 10 onward. 5–8 applications per week, targeting Microsoft partner shops (Avanade, Insight, SoftwareOne, regional MSPs), large-enterprise platform teams, and any shop already running Azure AVD or Azure Files. Cloud Engineer I/II postings in 2026 want AZ-104 plus one IaC artifact plus a migration story more than they want years.
• Salary anchor: $115–140k in mid-cost metros, $135–175k coastal/tech-heavy, per Levels.fyi Cloud Engineer data, May 2026. Below $105k means the role is “sysadmin in a trench coat” and the on-call rotation will not improve — negotiate or walk.

The investment math

Cash outlay: AZ-104 $165 + Terraform Associate $70.50 + AZ-305 $165 = $400.50 in exam fees, plus $20–40/month for John Savill or Tutorial Dojo or KodeKloud ($360 over 12 months), plus $25–40/month in Azure subscription costs ($360 over 12 months). Round to $1,120 hard cash. Time investment is roughly 480 focused hours. At a $32/hour Windows sysadmin opportunity cost, total investment lands near $16,480.

Expected return: a $30–55k base salary increase (call it $42k median), sustained, with 5–15% bonus typical and modest equity at venture-backed shops typically adding another $5–25k/year on top. Payback is roughly 5–7 months after starting the new role. Five-year cumulative delta usually clears $240,000 before counting the typical Cloud Engineer II → Senior Cloud Engineer promotion at year 2–3, which lands at $155–200k base in most metros.

What your Windows experience is actually worth

More than hiring managers say out loud. Three buckets in particular survive the move:

• Identity. Active Directory, Group Policy, Kerberos, NTLM, conditional access, hybrid join — this is the single hardest Azure topic for non-Windows backgrounds to learn, and Entra ID is just AD with a different surface and a price tag. Lean into it. SC-300 (Identity Administrator) is the natural follow-on cert if you want to specialise.
• Storage and file services. SMB, DFS, NTFS ACLs, profile containers, FSLogix — Azure Files and Azure NetApp Files are nearly drop-in. A migration story here ports straight into AVD work, which is one of the highest-margin Azure consulting motions of 2026.
• Operations muscle. Change windows, runbooks, backups, restore drills, on-call rotations, root cause analysis — Azure SRE and platform-engineering teams hire for this and cannot find enough of it. Make sure your resume bullets show metrics: “reduced patch-window outages from 4/quarter to 0,” not “managed Windows patching.”

When to deviate from the plan

• You hate identity work and love networking. Replace AZ-305 with AZ-700 (Azure Network Engineer Associate) in phase 3. Pays slightly less at junior level, more at senior level, especially in Virtual WAN / ExpressRoute roles at telcos and integrators.
• You target security operations. Replace AZ-305 with SC-200 (Microsoft Security Operations Analyst) and add Microsoft Sentinel to your phase-2 landing zone. Pivot lands as Cloud Security Engineer at $125–160k.
• Your shop runs AWS, not Azure. Translate the plan: AZ-104 becomes AWS SAA-C03, AZ-305 becomes AWS SAP-C02 (in year 2, not year 1), Terraform Associate stays the same. Expect the pivot to take 14–16 months instead of 12 because the AD ↔ Entra carry-over is gone and you are learning a new identity model (IAM + Identity Center) from scratch.
• You hold MCSA / MCSE (retired). They still count on a resume. List them and add “retired” in parentheses so the recruiter knows you know — the alternative is your tenure looking thinner than it is.

Bottom line

Windows sysadmin to Azure cloud engineer in 12 months is achievable specifically because your existing Windows tickets are Azure training in disguise — you just have to add the cloud control plane, declarative IaC, and one migration artifact you can point to. Three certs, three artifacts on GitHub (or one on GitHub plus one Azure subscription plus one architecture write-up), three phases. The candidates who finish are the ones who refuse to skip the paid-Azure-subscription step and produce evidence at the end — a real migration, a real landing zone, a real architecture write-up. The ones who do not finish almost always trip on month 6 (Terraform state and authentication) or never click through the portal on a paid subscription. Plan for both.

Frequently asked questions