What Certification Should You Take After Azure Fundamentals?

One warning before the routes: Microsoft is in the middle of its largest certification refresh since 2019. The Azure Developer Associate (AZ-204) is retired, the Azure Security Engineer Associate (AZ-500) retires on 31 August 2026, and several AI and data certifications have been replaced. Any "what next after AZ-900" advice written before mid-2026 is likely to point you at exams you can no longer sit, so check the current status of any certification on Microsoft Learn before you book.

First, understand what AZ-900 did and did not give you

Microsoft Azure Fundamentals is a beginner credential: a 45-minute proctored exam with no prerequisites, covering cloud concepts, Azure architecture and services, and Azure management and governance. It never expires, which makes it a permanent line on your CV — but it certifies vocabulary and concepts, not the ability to build or run anything.

Associate-level certifications are different in three ways that should shape your decision:

1. They are hands-on in spirit. The associate exams verified here run 100 minutes and may include interactive components; Microsoft recommends real experience with the portal, Azure CLI, PowerShell and infrastructure-as-code tools for AZ-104. You cannot flashcard your way through them the way some people do with AZ-900.
2. They expire after 12 months — but renewal is free, via an unproctored, open-book online assessment on Microsoft Learn that you can retake as often as needed within the renewal window. This is one of the friendliest renewal models in the industry (CompTIA, Cisco and ISC2 renewals all cost money or continuing-education effort), so do not let the one-year validity put you off.
3. They are role exams, not platform exams. Each one maps to a job: administrator, security analyst, identity administrator, data engineer, data analyst, network engineer. Choosing your next certification is really choosing which of these jobs you want to be interviewed for.

The decision framework: pick by target role, not by exam popularity

Ask yourself which of these four statements best describes the work you want to be doing in 18 months. Each maps to one route below.

• "I want to run cloud infrastructure — resources, networks, storage, identities." → Route 1: AZ-104.
• "I want to work in security — a SOC, identity management, or cloud security." → Route 2: the SC-series.
• "I want to work with data — pipelines, analytics, or business intelligence." → Route 3: DP-700 or PL-300.
• "I honestly don't know yet; I just enjoyed learning Azure." → Route 4: a second fundamentals exam as a cheap probe, then commit.

Route 1: Azure Administrator Associate (AZ-104) — the default next step

AZ-104 is the closest thing Azure has to a mainline. The exam covers managing Azure identities and governance, storage, compute, virtual networking, and monitoring — the daily work of a cloud operations role. There are no formal prerequisites (you can even skip AZ-900 entirely, though you have presumably already passed it), but Microsoft recommends practical experience with PowerShell, the Azure CLI, the portal and ARM or Bicep templates.

Two structural facts make AZ-104 the highest-leverage choice:

• It is the mandatory prerequisite for Azure Solutions Architect Expert (AZ-305). Passing AZ-305 alone does not award the Expert certification — you must hold AZ-104 first. If architecture is anywhere in your long-term plan, AZ-104 is unavoidable.
• It is now the practical route into DevOps Engineer Expert (AZ-400) as well. AZ-400 requires either AZ-104 or AZ-204, and with AZ-204 retired, AZ-104 is the door new candidates walk through.

Be honest with yourself about the jump in difficulty. AZ-900 asks what a virtual network is; AZ-104 expects you to configure one. If you have never deployed resources outside a guided tutorial, spend time in a free-tier subscription before booking. When you feel close to ready, a timed run through some AZ-104 practice questions will show you which of the five domains needs another pass before exam day.

Once you hold AZ-104, the question becomes AZ-305 versus AZ-400 versus a security specialisation — that decision has its own trade-offs, covered in our guide to what comes after Azure Administrator.

Route 2: security — SC-900 as a bridge, then SC-200 or SC-300

If security is the goal, do not default to AZ-104 just because it is popular. Microsoft's security track has its own fundamentals-to-associate ladder.

SC-900 (Security, Compliance, and Identity Fundamentals) is a 45-minute, no-prerequisite exam covering security and identity concepts, Microsoft Entra capabilities, and Microsoft's security and compliance solutions. Like AZ-900 it never expires. It is optional — you can go straight to an associate exam — but it is a fast, low-cost way to confirm the field suits you, and the SC-900 exam page plus free sample questions will show you the flavour of the material quickly.

At associate level, two currently active certifications matter:

• SC-200 (Security Operations Analyst Associate): a 100-minute exam on managing a security operations environment, responding to incidents and threat hunting, built around Microsoft Defender XDR, Microsoft Sentinel and KQL. Choose this if you want SOC analyst or detection work.
• SC-300 (Identity and Access Administrator Associate): a 100-minute exam on user identities, authentication, workload identities and identity governance, centred on Microsoft Entra. Choose this if identity and access management appeals — an unglamorous specialism that underpins almost everything else in cloud security.

What you should not target is AZ-500. The Azure Security Engineer Associate certification retires on 31 August 2026 and cannot be earned or renewed after that date; secondary sources name SC-500 as its successor, but official details were not yet published at the time of writing, so watch Microsoft Learn rather than committing to an unannounced exam.

Route 3: data — DP-900 as a probe, then DP-700 or PL-300

Azure's data track splits into engineering and analysis, and the two lead to different jobs.

If you have never worked with data professionally, DP-900 (Azure Data Fundamentals) — 45 minutes, no prerequisites, never expires — covers core data concepts plus relational, non-relational and analytics workloads on Azure. It is a cheap way to test your appetite before an associate commitment; the DP-900 exam page is the place to start if you go this way.

At associate level:

• DP-700 (Fabric Data Engineer Associate) is Microsoft's current data-engineering certification: 100 minutes on implementing analytics solutions, ingesting and transforming data, and monitoring and optimisation, with SQL, PySpark and KQL as the working skills. Important history: the older Azure Data Engineer Associate (DP-203) retired on 31 March 2025, and older articles still recommend it. DP-700, focused on Microsoft Fabric rather than Azure Synapse, is the replacement.
• PL-300 (Power BI Data Analyst Associate) is the analyst-side credential: 100 minutes on preparing, modelling, visualising and securing data in Power BI, with Power Query and DAX as core skills. Choose this if you want business-facing analytics rather than pipeline engineering.

A caution on the AI-adjacent options: the Azure AI Engineer Associate (AI-102) and Azure Data Scientist Associate (DP-100) both retired in mid-2026. Successor exams have been reported but not fully documented officially, so treat any AI-track plan as provisional until Microsoft publishes the new certification pages.

Route 4: still undecided — buy information cheaply

If none of the roles above clearly fits, resist the urge to book AZ-104 by default and then stall. A second fundamentals exam is a legitimate strategic move: SC-900 or DP-900 each cost a fraction of an associate exam in both money and study time, never expire, and tell you far more about whether security or data work suits you than any blog post can. Spend a few weeks on one, then commit to the matching associate track — or return to Route 1 with confidence that infrastructure really is your lane.

What a second fundamentals badge will not do is substitute for an associate certification in hiring. Two fundamentals credentials still signal "beginner"; one associate credential signals "can do the job". Use fundamentals exams as probes, not as a collection.

Practical notes that apply whichever route you choose

• Costs and booking. Microsoft prices exams by country or region rather than publishing a universal figure; third-party sources commonly cite around US$99 for fundamentals exams and US$165 for associate and expert exams in the US, but confirm the price for your country on the exam's Microsoft Learn page. All of these exams are delivered through Pearson VUE, at a test centre or online proctored from home.
• Scoring. Microsoft technical exams are scored on a 1–1,000 scale with a pass mark of 700 — a scaled score, not 70%. Microsoft also does not publish question counts, so ignore any source that promises an exact number.
• Retakes. If you fail, you can retake after 24 hours, with longer waits for subsequent attempts.
• Sequencing beyond associate. The two Expert certifications, AZ-305 and AZ-400, are the only Microsoft credentials with mandatory certification prerequisites, and both routes now run through AZ-104. Whatever associate exam you pick first, AZ-104 tends to reappear later in an Azure career.
• Keep perspective on the ecosystem question. If you are also weighing AWS or Google Cloud rather than committing to Azure, that comparison is a different decision — see our guide to the best cloud computing certifications for a cross-provider view.