11.6 After AZ-104: AZ-305, AZ-400, AZ-500, and Job Paths

Choosing the next path after AZ-104

AZ-104 is not an endpoint. It is a working administrator foundation. The certification validates that you can implement, manage, monitor, and troubleshoot an Azure environment across identity, governance, storage, compute, networking, monitoring, backup, and maintenance. Those skills transfer directly into architecture, DevOps, security, platform engineering, and operations roles.

Do not choose the next exam only because it is popular. Choose based on the work you want to do and the gaps between your current job and that work. AZ-305, AZ-400, and AZ-500 each build on Azure administration in a different direction. A strong AZ-104 candidate can move into any of them, but the study focus changes.

AZ-305 after AZ-104

AZ-305 is a natural next step for administrators who want to design Azure infrastructure solutions. AZ-104 asks whether you can implement and manage resources. Architecture asks whether you can choose the right pattern across availability, resiliency, identity, data, governance, migration, network topology, monitoring, and cost. The administrator background is valuable because you know which designs are easy to operate and which ones create hidden work.

If you move toward AZ-305, strengthen design tradeoffs. Practice explaining why a workload needs availability zones, region pairs, backup, Site Recovery, private connectivity, hub-spoke networking, managed identities, policy, or a particular data service. Keep the AZ-104 habit of validation, but add design language: requirements, constraints, risks, tradeoffs, and operational impact.

AZ-400 after AZ-104

AZ-400 fits candidates moving toward DevOps engineering, release automation, infrastructure as code, source control, CI/CD, observability, and collaboration between development and operations. AZ-104 already gives you the resource model: resource groups, RBAC, Bicep or ARM, App Service, containers, registries, networking, monitoring, and recovery. AZ-400 asks you to manage the delivery system around those resources.

If you choose AZ-400, deepen Git, branching strategy, pipeline design, artifact management, deployment strategies, secret handling, infrastructure as code, test automation, monitoring feedback, and incident learning. Practice deploying Azure resources with Bicep from a pipeline and promoting changes through environments. Learn how deployment slots, container registries, managed identities, and role assignments behave when automated.

AZ-500 after AZ-104

AZ-500 fits candidates moving toward Azure security engineering. AZ-104 already covers Microsoft Entra users and groups, RBAC, governance, NSGs, private endpoints, storage access, monitoring, and backup. AZ-500 goes deeper into securing identity, platform, data, applications, and operations. It expects more security-specific reasoning around least privilege, threat protection, posture management, key management, network isolation, and incident response.

If you choose AZ-500, strengthen Microsoft Entra security, privileged access, conditional access concepts, managed identities, Key Vault, Defender for Cloud, secure networking, storage protection, logging, Sentinel-adjacent operations where relevant to your path, and response workflows. Keep the AZ-104 discipline of checking effective configuration. Security answers often fail when candidates rely on intended design instead of actual applied settings.

Job paths from AZ-104

The most direct job path is Azure administrator or cloud administrator. In that role, AZ-104 maps closely to daily work: user and group support, role assignments, policy compliance, storage accounts, VMs, App Service, networking, monitoring, backup, restore, and cost hygiene. To become stronger, add scripting, repeatable deployment, incident response, and documentation skills.

A platform engineering path uses AZ-104 as the base for building reusable Azure patterns. You might own landing zones, subscription vending, policy initiatives, role models, shared networking, DNS, private endpoint standards, image pipelines, monitoring baselines, and backup standards. This path rewards automation and empathy for application teams.

A cloud network operations path leans into VNets, peering, route tables, firewalls, DNS, Bastion, private endpoints, load balancers, hybrid connectivity, Network Watcher, and connection troubleshooting. A cloud infrastructure operations path leans into compute, patching, backup, restore, scale, cost, and monitoring. A security operations path leans into identity, access review, logging, alerts, Defender signals, incident response, and governance.

Building a portfolio after the exam

After passing, create small projects that prove you can operate Azure. Examples include a hub-spoke lab with private endpoint DNS, a Bicep deployment for a monitored App Service with slot swap, a storage account with private access and lifecycle rules, or a VM workload with backup, alerts, and recovery testing. Keep the projects small enough to finish and documented enough to discuss in interviews.

Use job descriptions as a study guide. If target roles mention Terraform, GitHub Actions, Azure DevOps, Kubernetes, Sentinel, Defender for Cloud, or hybrid networking, decide whether those belong in your next learning cycle. AZ-104 gives the base, but role readiness comes from combining certification knowledge with tools used by the teams you want to join.

The strongest post-AZ-104 path is intentional. Choose AZ-305 if you want to design. Choose AZ-400 if you want to automate delivery. Choose AZ-500 if you want to secure Azure. Stay in administration if you want deeper operations ownership. In every path, the administrator foundation remains useful because real cloud roles reward people who understand how Azure behaves after the diagram is deployed.