Why AZ-700 matters in 2026

Network engineering in enterprise environments has shifted decisively toward hybrid and multi-cloud architectures over the past three years. Organizations that once managed on-premises data center networks through dedicated WAN links now route critical traffic across Azure Virtual WAN, connect branch offices via SD-WAN integrations, and protect workloads with cloud-native firewalls rather than physical appliances. The engineers who design and operate these environments need a different skill set from those who built traditional MPLS networks — and the AZ-700 is the credential that validates it.

The certification was introduced by Microsoft in 2021 and has gained steady adoption as Azure became the dominant enterprise cloud provider in regulated industries. By mid-2026, AZ-700 appears as a preferred qualification in a significant share of senior network engineer, cloud infrastructure engineer, and platform engineering job postings that specify Azure environments. The credential signals that a candidate can implement Azure networking from scratch, design for high availability, and troubleshoot complex hybrid connectivity issues — capabilities that take time to develop and are difficult to assess from a resume alone.

Salary data across platforms in mid-2026 puts Azure Network Engineer Associate holders at $130K–$160K for mid-level roles and $150K–$185K at the senior level. Engineers who hold both AZ-700 and the AZ-500 (Security Engineer) see the strongest compensation outcomes, as the combination covers both network design and security posture in Azure-heavy organizations.

Exam format and logistics

Attribute Detail
Exam codeAZ-700
Official nameDesigning and Implementing Microsoft Azure Networking Solutions
Questions40–60 (multiple choice, case studies, drag-and-drop, hotspot)
Duration120 minutes
Passing score700 / 1000
Cost$165 USD (Pearson VUE, online or test center)
RenewalFree annual renewal assessment via Microsoft Learn (no re-exam required)
PrerequisitesNone formal; AZ-104 knowledge strongly recommended

Microsoft’s annual renewal model means the AZ-700 does not expire as long as you complete the free online renewal assessment each year. This is a significant advantage over vendor certifications that charge for renewal exams or require a fixed number of continuing education credits through paid channels. The renewal assessment is shorter than the original exam (20–30 questions, 45 minutes) and focuses on content that has changed in the past year — updated Azure networking features, new service capabilities, and any shifts in best practice guidance from the Microsoft Azure Networking team.

The five skill areas and what they test

1. Design and implement core networking infrastructure (20–25%)

This is the foundation of the exam and the area where most candidates who come from on-premises networking backgrounds feel most comfortable — though Azure introduces new concepts at every layer. The skill area covers IP address planning for Azure virtual networks (CIDR allocation, subnetting for Azure-reserved addresses, avoiding overlap with on-premises address spaces), Azure Virtual Networks (VNets) and their properties, VNet peering (local peering within a region and global peering across regions), Azure Bastion for secure RDP/SSH without public IPs on VMs, Azure DNS (public zones, private zones, autoregistration, and the split-horizon design where the same FQDN resolves differently inside and outside a VNet), and public IP addresses (Standard vs Basic SKU, allocation methods, and zone-redundancy for resilience).

Candidates who have worked with AWS VPCs or GCP VPCs will find Azure VNet concepts familiar at a high level, but the details differ significantly — particularly around DNS resolution (where Azure Private DNS Zones replace Route 53 private hosted zones), Bastion (a managed service rather than a self-managed jump host), and peering (which is non-transitive by default, requiring hub-and-spoke or Azure Virtual WAN to route between spokes).

2. Design and implement hybrid networking (10–15%)

Hybrid connectivity is where the AZ-700 most directly overlaps with traditional network engineering expertise, and where candidates with Cisco or Juniper backgrounds have an advantage. The exam covers three primary hybrid connectivity technologies:

  • Site-to-Site VPN — IPsec/IKEv2 tunnels between Azure VPN Gateway and on-premises VPN devices. The exam tests gateway SKU selection (Basic, VpnGw1–5, VpnGw1AZ–5AZ), active-active vs active-passive configurations, BGP over VPN for dynamic routing, and tunnel monitoring. Zone-redundant gateway SKUs (the AZ variants) are a frequent exam topic for high-availability scenarios.
  • Point-to-Site VPN — client VPN for individual users. The exam covers OpenVPN and IKEv2 protocol options, certificate-based authentication vs Azure AD authentication, client configuration, and the split-tunneling decision.
  • ExpressRoute — dedicated private connectivity from on-premises to Azure via a carrier or co-location provider. ExpressRoute is the most complex hybrid topic in the exam: the exam tests circuit provisioning, peering types (Microsoft peering for Microsoft 365 and Azure PaaS services vs private peering for VNet connectivity), FastPath for bypassing the gateway in high-throughput scenarios, ExpressRoute Global Reach for site-to-site connectivity routed through the Microsoft backbone, and ExpressRoute Direct for dedicated 10Gbps or 100Gbps port pairs.

A common exam scenario presents a requirement for guaranteed bandwidth and private connectivity (pointing to ExpressRoute) versus cost constraints and acceptable latency variability (pointing to Site-to-Site VPN). Candidates should be able to justify the tradeoff in both directions and identify when a dual approach (ExpressRoute primary, VPN failover) is the appropriate design.

3. Design and implement Azure routing (25–30%)

Routing is the highest-weighted skill area on AZ-700 and the one that trips up the most candidates. Azure routing is based on system routes that are applied automatically, but the exam focuses on how to modify and extend that default behavior using User-Defined Routes (UDRs), Route Server, and Virtual WAN routing policies.

UDRs are the primary tool for overriding Azure’s default system routes. The exam tests attaching UDRs to subnets, setting next-hop types (VirtualAppliance, VirtualNetworkGateway, Internet, None), and designing hub-and-spoke topologies where all inter-spoke traffic is forced through a Network Virtual Appliance (NVA) in the hub for inspection. The None next-hop type is a critical concept: routes with a None next hop drop matching traffic, functioning as a routing-level black-hole.

Azure Route Server is a newer service that simplifies NVA deployments by enabling dynamic BGP route exchange between NVAs and the Azure network. Without Route Server, operators managing NVAs had to maintain static UDRs manually as address spaces changed — Route Server eliminates that operational burden. The exam tests Route Server branch-to-branch transit, its interaction with VPN Gateway and ExpressRoute Gateway, and the scenario where it replaces multiple static UDRs with dynamic routing.

Azure Virtual WAN (Virtual WAN routing) is the managed hub-and-spoke alternative to a self-managed hub VNet. The exam covers both Basic and Standard SKUs, hub-to-hub routing, routing intents for private traffic and internet traffic, and the integration with partner SD-WAN devices via the Virtual WAN hub. Candidates who have worked with enterprise WAN providers (Cisco Meraki, VMware SD-WAN, Barracuda) will recognize the conceptual model.

4. Secure and monitor networks (15–20%)

This skill area covers Azure’s native network security stack: Network Security Groups (NSGs), Application Security Groups (ASGs), Azure Firewall, Azure DDoS Protection, and monitoring via Azure Network Watcher.

NSGs are stateful Layer 4 packet filters applied to subnets or individual NIC (network interface) resources. The exam tests rule priority (lower number = higher priority), default allow/deny rules, the difference between inbound and outbound rule sets, and flow log configuration for traffic auditing. ASGs group VMs by role (e.g., WebServers, AppServers) and replace IP-address-based NSG rules — a significant operational improvement in environments where VM IP addresses change frequently.

Azure Firewall is a stateful, fully managed Layer 4 and Layer 7 network firewall. The exam distinguishes between Azure Firewall Standard (FQDN filtering, network rules, application rules, NAT rules) and Azure Firewall Premium (TLS inspection, IDPS, URL filtering, web categories). Azure Firewall Manager provides centralized policy management across multiple firewalls and Virtual WAN hubs. The exam tests forcing internet-bound traffic from spoke VNets through a Firewall in the hub by combining UDRs and Firewall policy.

Azure DDoS Protection has two tiers: Network Protection (per-VNet, ~$2,944/month per protected public IP resource group) and the platform-level Infrastructure Protection that applies to all Azure services at no additional cost. The exam asks candidates to identify when Network Protection is appropriate (high-value public endpoints, gaming, financial services) versus when Infrastructure Protection is sufficient.

Network Watcher tools — IP flow verify, next hop, connection monitor, packet capture, and VPN diagnostics — appear in troubleshooting scenario questions. Candidates should know which tool to use for each symptom: IP flow verify for security rule diagnostics, next hop for routing path verification, connection monitor for proactive latency tracking between endpoints.

5. Design and implement Private Access to Azure Services (10–15%)

Private access is one of the most important architectural patterns in modern Azure deployments, driven by compliance requirements that prohibit traffic to Azure PaaS services (Storage, SQL, Key Vault, Service Bus, etc.) from traversing the public internet. The exam covers two mechanisms:

  • Service Endpoints — extend the VNet identity to Azure PaaS services over the Microsoft backbone. Traffic stays on the Microsoft network and the PaaS service can restrict access to specific VNets, but the service still has a public IP. Service Endpoints are simpler to configure and have no additional cost, but they don’t provide a private IP for the service within the VNet.
  • Azure Private Link and Private Endpoints — project a PaaS service (or a custom service behind a Standard Load Balancer) into the VNet as a private IP address. Traffic from clients to the Private Endpoint stays entirely within the private network — no public IP is involved. Private Endpoints require DNS integration: Azure Private DNS Zones are used to override public DNS resolution so that mystorageaccount.blob.core.windows.net resolves to the private IP inside the VNet rather than the public IP. The exam tests Private DNS Zone linking, autoregistration, and the split-DNS pattern for hybrid environments where on-premises clients also need to resolve to Private Endpoints.

A recurring exam question type presents a compliance scenario requiring that PaaS data (Azure SQL, Azure Storage) must not be accessible over the public internet, then asks candidates to design the Private Endpoint configuration and associated DNS zone setup. This is also a practical skill gap that many AZ-700 candidates find in production: Private Endpoint DNS integration is consistently the most common source of connectivity failures in new Azure deployments.

AZ-700 vs AZ-104: which should you take first?

AZ-104 Administrator Associate

Broad Azure administration credential. Covers compute, storage, networking, identity, monitoring — networking is one of six areas. Suitable for generalist cloud admins and engineers moving into Azure for the first time. Recommended as a first Azure certification before specialising.

AZ-700 Network Engineer Associate

Specialist networking credential. Covers everything in AZ-104’s networking section in far greater depth, plus advanced topics (ExpressRoute, Virtual WAN, Route Server, Private Link DNS). Suited to experienced network engineers or AZ-104 holders ready to specialise.

The practical guidance is to hold AZ-104 before sitting AZ-700. The AZ-700 assumes foundational Azure concepts — resource groups, subscriptions, IAM, ARM templates — that AZ-104 covers but AZ-700 does not teach. Candidates who attempt AZ-700 without that foundation typically struggle with exam questions that assume you understand how Azure resources are organized before introducing networking-specific context. For candidates who come from a strong networking background and have existing Azure familiarity, it is possible to self-study for AZ-700 directly without holding AZ-104, but the path is longer.

Who should pursue AZ-700

AZ-700 is best suited to four profiles in 2026. On-premises network engineers who manage Cisco, Juniper, or Palo Alto infrastructure and need to demonstrate Azure capability as their organizations migrate workloads to the cloud. Azure administrators (AZ-104 holders) who want to deepen their networking knowledge and move into infrastructure design roles. Platform engineers who own the Azure landing zone — the VNet topology, hub-and-spoke or Virtual WAN architecture, and private DNS strategy — that all workload teams deploy into. And security engineers who want to understand the network layer deeply enough to design Azure Firewall policies and NSG rule sets that enforce zero-trust segmentation.

If you manage any production Azure environment with more than two VNets, ExpressRoute or VPN connectivity, or PaaS services behind Private Endpoints, the content of AZ-700 is your daily work. The certification structures and validates what you already know — and fills the gaps in the areas you haven’t had to touch yet.

Study approach: what to prioritize

The highest-leverage study areas by exam weight are routing (25–30%) and core networking infrastructure (20–25%), followed by network security (15–20%). Most candidates who fail AZ-700 report failing on routing — specifically on UDR behavior, the interaction between system routes and UDRs, and Route Server configuration. Budget at least 40% of your study time on the routing domain and work through hands-on labs in the Azure portal rather than relying on flashcard-style memorization.

For hybrid networking (10–15%), the exam favors scenario-based questions over recall. Study ExpressRoute by understanding the full provisioning lifecycle (circuit creation, service key, provider configuration, peering setup) rather than memorizing individual commands. The exam will present a partial scenario and ask what step is missing or what symptom suggests a misconfiguration — understanding the sequence is more valuable than knowing individual portal fields.

Private Link DNS integration (in the private access domain) is tested more frequently than its 10–15% weight suggests, because it is consistently a pain point in real deployments. Build at least one end-to-end Private Endpoint lab with a custom domain and Azure Private DNS Zone to understand how DNS resolution flows from inside and outside the VNet before sitting the exam.

Microsoft Learn free study path

Microsoft publishes a free, official study path for AZ-700 on Microsoft Learn. The path includes interactive sandbox labs that provision temporary Azure resources at no cost — these are the best way to build hands-on experience with VPN Gateway, ExpressRoute circuits (via circuit simulation), Azure Firewall, and Private Endpoints without incurring Azure charges on your own subscription. The sandbox labs are particularly valuable for ExpressRoute, where live lab environments using real circuits are expensive to maintain.

The Azure networking stack in 2026: what’s evolving

Two areas of Azure networking have seen significant evolution in the 18 months leading up to mid-2026, and both are increasingly represented in the AZ-700 exam content. First, Azure Virtual WAN has matured into the default architectural recommendation for large enterprise hub-and-spoke deployments. Microsoft has consistently invested in Virtual WAN capabilities — routing intent for zero-trust network access, integration with third-party security providers in the Virtual WAN hub, and improved inter-hub routing — to the point where building and operating a self-managed hub VNet is now typically the higher-complexity choice. The exam reflects this shift: Virtual WAN questions have become more detailed and scenario-rich in recent update cycles.

Second, Private Link coverage has expanded to nearly every Azure PaaS service, and the exam increasingly tests candidates on the DNS patterns required for hybrid environments where both Azure-hosted clients and on-premises clients need to reach Private Endpoints. The pattern — on-premises DNS conditional forwarder to Azure DNS private resolver, resolving to Azure Private DNS Zones — is a design decision that appears in real enterprise deployments and is now a reliable exam topic. Candidates who understand this pattern in detail are well-positioned for the private access skill area.

Practice Azure and Microsoft certification questions free on CertQuests.

Browse Azure Certifications →