What to Learn After AZ-104: The 2026 Map (After the Retirements)

Most “what to take after AZ-104” roadmaps still tell you to sit AZ-500 for security, AZ-204 if you lean towards code, or AI-102 for AI work. You can no longer sit any of them. Microsoft retired AI-102 on 30 June 2026, AZ-204 on 31 July and AZ-500 on 31 August, and replaced each with a new exam that half the roadmaps on the first page of search have never heard of.

This is the current map: every exam status checked on Microsoft Learn today, the prerequisites that actually apply, the order an architect would take them in, and for each path the lab project that proves you can do the job rather than pass the test. The exam is the receipt. The lab is what you talk about in the interview.

Last updated 3 October 2026. Every exam status, prerequisite and price checked on Microsoft Learn, HashiCorp and the Linux Foundation on 3 October 2026. UK job figures from ITJobsWatch, six months to 3 October 2026.

Short answer: pick by the job you want next

Your next job	Next exam	Status, 3 Oct 2026	The lab that proves it
Azure or cloud architect	AZ-305 (Solutions Architect Expert)	Live; outline updated 17 Apr 2026; needs AZ-104	A small landing zone with written design decisions
Cloud security engineer	SC-500 (Cloud and AI Security Engineer)	New; replaced AZ-500 on 31 Aug 2026	Detections over your own logs, written in KQL
Identity engineer	SC-300 (Identity and Access Administrator)	Live; English outline changes on 28 Oct 2026	Conditional Access and workload identities in a test tenant
DevOps or platform engineer	AZ-400 (DevOps Engineer Expert), plus Terraform Associate and CKA	Live; outline updated 27 Jul 2026; needs AZ-104	Git, a pipeline, IaC and a cluster wired together
Network engineer	AZ-700 (Azure Network Engineer)	Live; outline updated 27 Jul 2026	Hub and spoke, private DNS, a VPN back to your lab
AI engineer	AI-103 (Azure AI Apps and Agents Developer)	Live; replaced AI-102 on 30 Jun 2026	An agent with its own identity and scoped permissions
Data engineer	DP-700 (Fabric) or DP-750 (Databricks)	Live; DP-700 outline changes on 19 Oct 2026	A pipeline over data you actually own

If you do not yet know which job you want, take the specialist associate that matches the work you already touch every day, then AZ-305 once you have had real design decisions to make. Do not stack associates you cannot practise.

What changed in 2026

In March 2026 Microsoft announced a batch of new AI-aligned certifications and retired the ones they replaced. Learn’s retirement page now shows the casualties:

Retired exam	Retired	Replaced by	What is different
AI-102 Azure AI Engineer	30 Jun 2026	AI-103 Azure AI Apps and Agents Developer	Built around Microsoft Foundry: generative and agentic solutions are the largest domain (30 to 35%)
AZ-204 Azure Developer	31 Jul 2026	AI-200 Azure AI Cloud Developer	Containers (Container Apps, AKS), Cosmos DB, PostgreSQL and Redis for AI apps, event-driven pipelines
AZ-500 Azure Security Engineer	31 Aug 2026	SC-500 Cloud and AI Security Engineer	Keeps identity, network, storage and compute security; adds Defender for AI, Foundry guardrails, AI Gateway and Security Copilot
AI-900 exam	30 Jun 2026	AI-901 (same Azure AI Fundamentals certification)	Updated exam, certification not retired
AZ-800 and AZ-801	30 Sep 2026	AZ-802 (Windows Server Administrator)	Two exams merged into one

Two things from Microsoft’s own announcement are worth knowing if you hold one of the retired certifications. It stays valid until it expires; retirement does not revoke it. But once the exam and renewal assessment are retired you cannot renew it, so it will lapse at its next expiry date. AZ-104 is not on the retirement list, and nor are AZ-305, AZ-400, AZ-700 or SC-300.

A status note on the newest exams. Microsoft’s June 2026 credentials roundup listed SC-500 and AI-200 as in beta with general availability planned for July 2026, and AI-500 (the new AI expert exam) with beta in July and general availability in September. On 3 October 2026 the Learn pages for SC-500 and AI-200 still said the practice assessment was “not currently available”, which Microsoft says usually follows within eight weeks of an exam leaving beta. Expect less third-party study material for these than for anything older.

AZ-104 vs AZ-305: run it, then design it

This is the comparison people search for most, and the difference is the verb. AZ-104 asks how you configure a VNet, a storage account or an RBAC assignment. AZ-305 asks which of several options you would choose for a stated requirement, and why: the identity, governance and monitoring design (25 to 30%), data storage (20 to 25%), business continuity (15 to 20%) and infrastructure (30 to 35%), which covers compute, application architecture and migrations. Its skills outline was last updated on 17 April 2026, the same day as AZ-104’s.

Order is not optional for the title: Microsoft awards Azure Solutions Architect Expert only to people who hold Azure Administrator Associate as well as passing AZ-305. Take AZ-104 first. More importantly, AZ-305 is a design exam, and design questions are much easier to answer once you have had to live with a decision you got wrong. If you have never been asked “should this be a new subscription or a new resource group”, do some AZ-104-level work first. Our subscription vs resource group decision guide and landing zone scoping guide are exactly the kind of reasoning AZ-305 tests.

The paths in detail

Architect: AZ-305

Who: engineers already making design calls, or being asked to. UK ads titled Azure Architect numbered 207 in the six months to 3 October 2026, with a median advertised salary of £90,000 (ITJobsWatch).

The lab: design a landing zone for a fictional 200-person company, then build the smallest working slice of it. Management groups, two subscriptions, Policy assignments, a hub network with one spoke, a budget, a Log Analytics workspace. The deliverable that matters is not the deployment, it is the one-page design record: each decision, the options you rejected and why. That page is what makes an architect interview go well, because it is what the job is.

Security: SC-500, then SC-100

Status: SC-500 is the AZ-500 replacement. Its four domains are identity, access and governance (20 to 25%), securing storage, databases and networking (25 to 30%), securing compute (20 to 25%) and managing security posture (20 to 25%), with AI workload security running through it. Cybersecurity Architect Expert (SC-100) then requires one of SC-300, SC-200 or SC-500.

Who: admins who already end up owning NSGs, Defender alerts and access reviews. UK ads titled Cloud Security Engineer: 136, median £75,000.

The lab: collect logs you generate yourself and write detections against them. In my homelab that is Wazuh collecting from the lab’s hosts; on Azure the equivalent is a Log Analytics workspace feeding Microsoft Sentinel, with KQL rules you wrote and tested. Our walkthrough of preventing an Intune bulk wipe with Sentinel KQL is a worked example of the detection-plus-hardening shape SC-500 and SC-200 both reward.

Identity: SC-300

Status: live; Microsoft has announced an updated English outline from 28 October 2026, and its current outline already gives workload identities their own domain (20 to 25%).

Who: anyone whose AZ-104 favourite domain was identity and governance. It is also where AI agents now need permissions of their own.

The lab: a separate test tenant licensed for Entra ID P1 (Conditional Access needs it) with Conditional Access policies, a break-glass account that is excluded and monitored, a managed identity used by an app instead of a secret, and an access review. Background reading: identity is the new castle walls and least privilege in practice.

DevOps and platform: AZ-400, Terraform Associate, CKA

Status: AZ-400 is live with an outline updated on 27 July 2026; build and release pipelines are 50 to 55% of it. DevOps Engineer Expert lists Azure Administrator or Azure Developer as the qualifying associate, and Azure Developer can no longer be earned, so for a new candidate AZ-104 is the way in. Outside Microsoft, HashiCorp’s Terraform Associate is now on version 004, tests Terraform 1.12, costs $70.50 plus local taxes and lasts two years. The Linux Foundation’s CKA is a two-hour, hands-on exam on Kubernetes v1.35, $445, valid for two years.

Who: admins who already script everything twice. UK ads titled Platform Engineer: 655, median £80,000; Azure DevOps Engineer: 192, median £75,000. ITJobsWatch counted 2,379 UK permanent ads citing Terraform and 2,312 citing Kubernetes over the same six months.

The lab: one repository that deploys real infrastructure. Self-hosted Git, a pipeline that runs terraform plan on every pull request and applies on merge, a container image built and pushed to a private registry, and a small Kubernetes cluster that runs it. My own lab does this with Gitea and K3s on a Pi 4 cluster; any two old machines will do. Start from Terraform fundamentals, a Docker CI/CD pipeline and K3s on a Raspberry Pi 5.

Networking: AZ-700

Status: live, outline updated 27 July 2026. Core networking infrastructure is the biggest domain (25 to 30%), then connectivity services (20 to 25%), application delivery, private access and network security.

Who: people who came to Azure from routing and switching, and anyone whose AZ-104 weak spot was private endpoints and DNS. That weak spot is common, and AZ-700 is where it gets fixed.

The lab: hub and spoke with peering, a private endpoint for a storage account, a Private DNS zone linked to the hub, and a site-to-site VPN back to your home network so on-premises name resolution has to work across it. If you can explain why a VM resolves the public IP of a private-endpoint storage account and fix it, you are ahead of most candidates. Refresh the basics with Azure virtual networks and how DNS actually works.

AI engineering: AI-103, then AI-500

Status: AI-103 replaced AI-102 and is built around Microsoft Foundry; its skills outline is dated 16 April 2026 and generative and agentic solutions are the largest domain (30 to 35%). The candidate profile expects Python. The new Multi-Agent AI Solutions Expert (AI-500) requires AI-103. If you are a developer rather than an infrastructure person, AI-200 is the other new AI associate, and it is AZ-204’s replacement.

Who: AZ-104 holders who want to be the person who deploys and secures AI workloads, not only the person who builds prompts. The infrastructure half of AI-103 (planning, deploying and securing Foundry resources, 25 to 30%) is where an admin background helps most.

The lab: an agent that calls a tool, running under its own identity with only the permissions it needs. Try a local model on your own hardware first (I run Ollama on a GPU host at home), then the same idea on Foundry. Read the agent identity toolbox and you can’t MFA an AI agent before you give an agent anything to sign in with.

Data: DP-700 or DP-750

Status: Fabric Data Engineer (DP-700) is live with an updated English outline from 19 October 2026. Azure Databricks Data Engineer (DP-750) is one of the 2026 additions. Choose the one your target employers run.

Who: admins who enjoyed the storage and monitoring domains and want to move towards data platforms. This path moves furthest from AZ-104, so expect more new learning. UK ads titled Azure Data Engineer: 106, median £70,000.

The lab: a pipeline over data you generate, such as your own logs or metrics. Ingest, transform, store, query, and a dashboard someone else could read without asking you what it means.

What the UK job market says about each path

Two readings. First, the generalist titles (Cloud Engineer, Azure Engineer) carry the volume, which is why AZ-104 plus one specialism beats two specialisms with no breadth. Second, the higher medians sit with the narrower titles: architect, platform, security. You get there by depth, and the exam is the smallest part of that. These are advertised salaries from ads that quoted one, not pay surveys, and no source can tell you what a certification alone adds.

The sequencing I would recommend

1. AZ-104 and one complete build. The certificate gets you past CV filters; the build is your interview material. The AZ-104 study guide covers the exam.
2. One specialist associate that matches work you already do. AZ-700 if you own the network, SC-300 if you own Entra, SC-500 if you own Defender, AI-103 if your organisation is building on Foundry. You learn fastest on things you can practise every working day.
3. AZ-305 when you have had design decisions to defend. Usually after a year or more of hands-on Azure work, not straight after AZ-104.
4. Terraform Associate and CKA when your platform uses them. They are vendor-neutral, last two years, and are what platform job ads list alongside Azure.
5. An expert certification (AZ-400, SC-100 or AI-500) only when it matches the job title you are applying for.

What I would not do: collect fundamentals exams after AZ-104, or sit the newest exams in their first months purely because they are new. Study material is thin, and an employer who has not heard of SC-500 yet will still ask what you have secured.

Why this matters at work

Teams do not hire certifications, they hire coverage. An Azure team with three AZ-104 holders and nobody who understands private DNS has a gap that shows up as an outage. The most useful next certification is the one that fills a gap your team actually has, and saying “I took AZ-700 because our private endpoints kept breaking, and here is the hub-and-spoke I built to understand why” is a better appraisal conversation than any badge count. If you are planning your own development, put the lab and the exam in the same objective. If you manage people, ask for the lab write-up as the evidence, not the score report. And put the lab on your CV: how to present your homelab on a CV.

Frequently asked questions

What certification should I take after AZ-104?

Take the one that matches the job you want next: AZ-305 for architecture, SC-500 or SC-300 for security and identity, AZ-400 for DevOps, AZ-700 for networking, AI-103 for AI engineering. If you are unsure, pick the specialism you already practise at work, then take AZ-305 once you have design experience.

Is AZ-104 required for AZ-305?

For the certification, yes. Microsoft only awards Azure Solutions Architect Expert to people who hold Azure Administrator Associate (AZ-104) and pass AZ-305.

Is AI-102 retired, and what replaced it?

Yes. AI-102 retired on 30 June 2026. Its replacement is AI-103, Microsoft Certified: Azure AI Apps and Agents Developer Associate, which focuses on building generative and agentic solutions with Microsoft Foundry.

Is AZ-500 still available?

No. AZ-500 and its renewal assessment retired on 31 August 2026. The replacement is SC-500, Microsoft Certified: Cloud and AI Security Engineer Associate. Existing AZ-500 certifications stay valid until they expire but cannot be renewed.

Related reading

• AZ-104 Study Guide: Azure Administrator Certification Path
• Azure AZ-104 Study Series
• Which Azure landing zone do you need?
• UK IT Skills and Salary Radar

Sources:

• Microsoft Learn: exam and assessment lab retirement
• Microsoft Tech Community: new certifications and 2026 retirements (3 March 2026)
• Microsoft Tech Community: credentials roundup, June 2026
• Microsoft Learn: Azure Solutions Architect Expert (AZ-305)
• Microsoft Learn: DevOps Engineer Expert (AZ-400)
• Microsoft Learn: SC-500 study guide and AI-103 study guide
• HashiCorp: Terraform Associate (004)
• Linux Foundation: Certified Kubernetes Administrator
• ITJobsWatch: Azure Architect, UK permanent (and the matching job-title pages for each role in the chart)