What Certification Should You Take After Azure Administrator?

Passing AZ-104 puts you in an unusually strong position, because Azure Administrator Associate is the mandatory prerequisite for Microsoft's Azure Solutions Architect Expert certification and one of the qualifying routes into DevOps Engineer Expert. In other words, the certification you already hold is the key that unlocks both of Microsoft's expert-level Azure credentials. The real question is not "am I ready for the next level?" but "which of the three classic directions — architecture, DevOps or security — matches the work I want to be doing in two years?"

This article assumes you already hold AZ-104. If you are earlier in the journey and deciding what follows AZ-900, that decision is covered in our guide to choosing a certification after Azure Fundamentals.

The three directions open to a certified Azure administrator

Microsoft's role-based portfolio gives an AZ-104 holder three coherent continuations:

1. Architecture — AZ-305, Designing Microsoft Azure Infrastructure Solutions, leading to Azure Solutions Architect Expert.
2. DevOps — AZ-400, Designing and Implementing Microsoft DevOps Solutions, leading to DevOps Engineer Expert.
3. Security — historically AZ-500 (Azure Security Engineer Associate), now in transition as Microsoft overhauls its security line-up.

There are also sideways moves at associate level — AZ-700 for networking specialists, SC-300 for identity — which we will come to, because for some administrators a deeper associate cert is genuinely more useful than an expert badge.

One structural point worth understanding before you choose: Microsoft has only two certifications with mandatory certification prerequisites, and they are AZ-305 and AZ-400. Both accept AZ-104. Every other exam discussed here can be booked with no formal prerequisite at all.

Route 1: AZ-305 and the Solutions Architect Expert title

Why AZ-305 is the default recommendation

AZ-305 examines design rather than implementation: designing identity, governance and monitoring solutions; data storage solutions; business continuity solutions; and infrastructure solutions. As an administrator you have spent your AZ-104 preparation deploying compute, storage, networking and governance controls — AZ-305 asks you to step back and decide which of those services a business scenario calls for, and why.

That makes the knowledge transfer from AZ-104 unusually high. You are not learning a new toolset; you are learning to justify trade-offs between tools you already operate. It is also the credential with the clearest career story: "administrator to architect" is a progression every hiring manager understands, and training-industry salary surveys such as Skillsoft's IT Skills and Salary Report have placed Azure Solutions Architect Expert among the higher-paying certifications (check the current report for exact figures — they vary by country and role).

A crucial mechanic that trips people up: passing the AZ-305 exam alone does not award the Solutions Architect Expert certification. Microsoft only issues the certification to candidates who also hold a current Azure Administrator Associate. Since you already hold AZ-104, one exam stands between you and the expert title — but keep your AZ-104 renewed (it expires after 12 months, with a free, open-book online renewal assessment) so the prerequisite stays valid.

Who should pick this route

Choose AZ-305 if you enjoy the "why" conversations — cost versus resilience, managed service versus IaaS, region pairs and recovery objectives — and want to move towards solution design, pre-sales or cloud consultancy. If the architect role itself is your destination and you want the wider multi-cloud picture (AWS, Google Cloud, TOGAF), our solutions architect certification path guide maps that broader territory.

When you start preparing, working through scenario-style questions matters more than memorising service limits. A set of AZ-305 practice questions will show you quickly whether you can defend design choices under exam conditions or whether you are still thinking like an implementer.

Route 2: AZ-400 and the DevOps Engineer Expert title

What AZ-400 actually tests

AZ-400, Designing and Implementing Microsoft DevOps Solutions, covers DevOps processes and communications, source control strategy, build and release pipelines, a security and compliance plan, and an instrumentation strategy — across both GitHub and Azure DevOps. It is less about running Azure resources and more about the machinery that delivers software onto them.

The prerequisite rule matters here too: DevOps Engineer Expert requires either Azure Administrator Associate or Azure Developer Associate. With AZ-204 retired as of mid-2026, AZ-104 is now the practical entry route for new candidates — another way your existing certification has quietly become more valuable. Existing AZ-204 holders' certifications still count while valid, but nobody new can take that door.

Who should pick this route

Be honest about your current exposure. AZ-400 rewards people who already write YAML pipelines, review pull requests and think about deployment rings. If your administration work is mostly portal-and-policy and you have never owned a release pipeline, the exam will feel like a different profession — because it is. In that case, either build hands-on CI/CD experience first or take the architecture route now and revisit DevOps later.

If pipelines are already your day job, this is arguably the stronger pick: it certifies what you do rather than what you might do. Timed AZ-400 practice tests are a sensible readiness check once you have covered the objectives, particularly for the source-control and pipeline-design scenarios. And if you are weighing Microsoft's DevOps credential against AWS, Kubernetes and Terraform options, our round-up of the best certifications for DevOps engineers compares the wider field.