TLDR
Your current job already picked your cloud path. Find your row in the table below and it tells you the role to aim at first, why you are closer than you think, the one gap you have to close, and what to do this week. Six target roles cover every row: identity, cloud platform security, security operations, platform engineer, data engineer and AI cloud developer. Each one is one project and one certification, at 6 to 8 hours a week next to your job.
🗺️ Find your job, find your path
Read across your row. If two rows fit, the tie-break table further down settles it.
| Your job now | Aim at first | Why your skills transfer | The gap to close | First step this week |
|---|---|---|---|---|
| Helpdesk | Identity (SC-300) | Password resets, MFA problems and locked accounts are identity tickets. You already know what breaks for users | Azure basics, then Conditional Access, PIM and reading sign-in logs | Run the Entra ID users, groups and roles lab |
| Microsoft 365 admin | Identity (SC-300) | You already live in the Entra admin center: users, groups, licences, MFA | The Azure side: the difference between an Entra ID role and an Azure RBAC role, and PIM | Run the Conditional Access and MFA lab |
| Sysadmin | Identity (SC-300) | Active Directory, groups and permissions map straight onto Entra ID | Cloud identity instead of domain identity: Conditional Access, workload identities, no standing admin rights | Run the Entra ID users, groups and roles lab |
| Network engineer | Cloud platform security (SC-500) | Segmentation, firewalls, DNS and private connectivity are half of this lane | Azure Policy, Key Vault, Defender for Cloud, and doing it from the CLI | Run the NSGs and ASGs lab |
| SOC analyst | Security operations (SC-200) | You already triage alerts and work incidents | Moving from triage to engineering: writing detections and KQL hunts by hand | Run the free Sentinel workspace lab |
| QA engineer or SDET | Platform engineer, start at step 1 | Real code: test frameworks with design, CI and maintenance behind them | Infrastructure: Azure, containers and networking | Run the Container Apps lab |
| DevOps engineer | Platform engineer, start at step 2 | Pipelines, containers, some Kubernetes and infrastructure as code | Building for the person who uses your module or pipeline, not for yourself | Run the Bicep modules in ACR lab |
| Software developer | AI cloud developer (AI-200) | You write code, use Git and call APIs. AI-200 is the developer associate exam now | Python with the Azure SDKs, containers, vector search, and messaging with Service Bus | Run the Container Apps lab |
| SQL or BI analyst, or DBA | Data engineer (DP-700 or DP-750) | SQL is the first of the five skills both data exams test | PySpark, the lakehouse and medallion layers, orchestration, and Git | Count which of Fabric or Databricks the job ads near you ask for |
| AWS or Google Cloud engineer | Cloud platform security (SC-500) | You already think in networks, identity and policy. Only the service names change | Azure's versions: private endpoints, Azure Policy, Key Vault, Defender for Cloud | Run the private endpoints lab |
| Azure admin | Cloud platform security (SC-500) | You already run the resources this lane locks down | Policy that denies instead of reports, private access to PaaS, posture work | Run the private endpoints lab |
The rule behind every row: aim at the role closest to the work you already do every day, not the one that sounds best. You can move later. The first move is the one that has to be short.
🧱 The Azure basics most rows share
Security lanes and AI-200 both expect AZ-104 level skills. You do not need to sit AZ-104, but you need to be able to do what it tests. You are ready to move on when you can do all four:
| Check | Lab |
|---|---|
| Deploy a VNet, a subnet and a VM with no public IP using only the Azure CLI | Creating your first virtual machine (free) |
| Give a user Reader on one resource group and explain why not the subscription | Entra ID users, groups and roles |
| Explain an Entra ID role and an Azure RBAC role in one sentence each | Same lab |
| Write a KQL query that counts sign-ins or events by hour | Introduction to KQL in Log Analytics |
The data engineer row is the exception. It leans on SQL and Python more than on Azure admin skills, so start with the five shared data skills instead.
🎯 The six target roles
Each role is one proof project and one certification, in that order. The exam goes last, so it confirms something you already built. Timings assume 6 to 8 hours a week next to a full-time job.
🔐 Identity
| Day to day | Entra ID, Conditional Access, MFA and passwordless, PIM and access reviews. You decide who can sign in, from where, and with what rights |
| First cert | SC-300, Identity and Access Administrator |
| Proof project | An MFA policy run in report-only mode, the gaps fixed from the sign-in logs, then switched on, with admin roles made eligible in PIM |
| Time | About 8 months from zero: basics months 0 to 3, the lane and project months 3 to 7, the exam in month 8 |
| Lab to start | Conditional Access and MFA in Entra ID |
🛡️ Cloud platform security
| Day to day | Network segmentation, private endpoints, Key Vault, Azure Policy, Defender for Cloud, and securing AI workloads |
| First cert | SC-500, Cloud and AI Security Engineer. It replaced AZ-500, which retired on August 31, 2026 |
| Proof project | Storage, SQL and Key Vault behind private endpoints with public access off, plus a policy that blocks a public storage account, with the screenshot of the deny |
| Time | About 8 months from zero, on the same timeline as identity |
| Lab to start | Private endpoints for storage and SQL |
🚨 Security operations
| Day to day | Defender XDR and Sentinel, writing detections, hunting with KQL, and automating responses to the incidents you see every week |
| First cert | SC-200, Security Operations Analyst |
| Proof project | One custom analytics rule triggered on purpose, one KQL hunt written by hand, and one automation rule, with a write-up of how you would tune them |
| Time | About 8 months from zero, on the same timeline as identity |
| Lab to start | Your first Sentinel workspace (free) |
🛣️ Platform engineer
| Day to day | Building a path to production other engineers use without opening a ticket. Microsoft calls it self-service with guardrails |
| First cert | None needed. AZ-400 fits after the project, and it needs AZ-104 or AZ-204 as well. AZ-204 has retired, so plan on AZ-104 |
| Proof project | One app taken from repo to container to pipeline, turned into a Bicep module, run from Git on AKS, guarded by policy, offered as one form, and measured with DORA metrics |
| Time | About 9 months from step 1. Starting at step 2 takes the first 2 months off |
| Lab to start | Depends on your step, see below |
Where you start on the six steps depends on the job you have:
| Starting job | Start at | Where you fit on a platform team |
|---|---|---|
| DevOps engineer | Step 2, build a module | Golden paths, CI/CD templates, GitOps |
| QA engineer or SDET | Step 1, walk the path | Conformance: testing templates, policies and the platform itself |
| Network engineer | Git first, then step 1 | Cluster networking: Azure CNI, Gateway API, private clusters and egress |
If Git is your gap, the Git for infrastructure work note covers the workflow. The Bicep learning roadmap covers step 2 in more depth.
🧪 Data engineer
| Day to day | Ingesting, cleaning and shaping data into tables people can use, on a schedule, with governance on top |
| First cert | DP-700 for Microsoft Fabric or DP-750 for Azure Databricks. DP-203 retired on March 31, 2025 |
| Proof project | One public dataset taken from bronze to silver to gold, run on a schedule, kept in Git, with a short write-up of your decisions |
| Time | About 7 months: five shared skills months 0 to 3, pick a platform in month 3, project months 3 to 6, exam in month 7 |
| Lab to start | Getting started with Azure Storage, then the platform's own free trial |
The five skills both data exams test, so you can learn them before you pick:
| Skill | What you already have if you work in SQL |
|---|---|
| SQL | Most of it. Make sure you can write a MERGE from memory |
| Python with PySpark | Usually nothing yet. This is the biggest gap |
| Lakehouse and medallion layers | Some, if you have built a warehouse or staging tables |
| Orchestration | Some, if you have scheduled SQL Agent jobs or SSIS packages |
| Governance and Git | Row and column security, yes. Git, often not |
🤖 AI cloud developer
| Day to day | Building the back end around a model, not training one: the containers that host it, the databases that store embeddings, the queues that feed it work, and the monitoring that says when it broke |
| First cert | AI-200, Azure AI Cloud Developer Associate. It replaced AZ-204, which retired on July 31, 2026 |
| Proof project | One Python app that stores embeddings and runs a vector search, takes work from a Service Bus queue, and scales a Container App with KEDA |
| Time | The study guide sets no month count. Book an exam date first and plan your study weeks backwards from it |
| Lab to start | KEDA scaling with Service Bus queue workers |
Python is listed as a required skill. If you write C# or Java today, Microsoft's first steps with Python path is the place to close that gap before anything else.
⚖️ When two rows fit you
Most people fit two rows. Use the question in the middle column to break the tie.
| You fit | Ask yourself | If yes | If no |
|---|---|---|---|
| Helpdesk or sysadmin: identity or platform security | Are most of my tickets about accounts, sign-ins and MFA? | Identity | Platform security, if your work is servers, networks and firewalls |
| Network engineer: platform security or platform engineer | Do I want to write code in pull requests every day? | Platform engineer, Git first | Platform security |
| DevOps engineer: platform engineer or AI cloud developer | Do I want to build for other engineers rather than ship features? | Platform engineer | AI cloud developer. AI-200 lists DevOps and platform engineers who deploy containers as part of its audience |
| Software developer: AI cloud developer or platform engineer | Do I enjoy the app more than the pipeline it ships through? | AI cloud developer | Platform engineer, step 1 |
| SQL analyst or DBA: data engineer or AI cloud developer | Do I want to move data more than build apps on top of it? | Data engineer | AI cloud developer. Its outline includes PostgreSQL with pgvector |
| SOC analyst: security operations or identity | Are most of my alerts sign-in and account alerts? | Still security operations first, identity second. The two overlap | Security operations |
| AWS or Google Cloud engineer: platform security or platform engineer | Is my current job closer to securing workloads or to building pipelines? | Platform security | Platform engineer |
| Still a tie | Which of the two do three job ads near me name more? | That one | Pick either. The skills overlap more than the cert names suggest |
🚫 What to skip
The honest list. Each of these costs months and gets you no closer to the role.
| Skip this | Why | Do this instead |
|---|---|---|
| A fourth certification before a project | A comment on one of my videos listed AZ-900, SC-900, AZ-104 and SC-300 passed, and still on helpdesk. The badges were not the missing part | Finish one proof project in your lane, then book its exam |
| Learning Fabric and Databricks at once | You end up with two half-used trials and no project | One platform, one project, then the cert |
| The platform you would want | A platform nobody uses has failed, however good the tooling | Ask one developer what slows them down before you build self-service |
| Retired exams | AZ-500, AZ-204 and DP-203 cannot be booked | SC-500, AI-200, and DP-700 or DP-750 |
| Starting MS-102 now as an M365 admin | It retires on November 30, 2026, and AB-650 is still in beta | Sit MS-102 only if you are exam-ready now, otherwise go to the identity lane |
The full 2027 exam picture, including every replacement, is in the Azure Certification Roadmap 2027. For the steps after you pick a role, from resume to first 90 days, use The 50 Step Checklist to Your First Cloud Job.
Hands-on LabCloudlearn.io - Interactive Cloud & Security Learning Platform
Start your row's first lab
Every lab in the table runs in a real Azure environment with guided steps and checks on your work, with no subscription of your own and nothing left running.
labs.cloudlearn.ioStart the lab
🔗 Related notes
- Cloud portfolio projects for more proof project ideas
- Azure cloud learning roadmap if you need the Azure basics from scratch
- Terraform learning roadmap if your job ads say Terraform rather than Bicep
