Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
What the Microsoft Certified: Azure Network Engineer Associate covers as of October 2026, from the AZ-700 exam and its five skill areas on the July 2026 outline to the passing score, the $165 fee, the free annual renewal, DoD 8140 status, and the cloud and hybrid networking jobs it fits.
The Microsoft Certified: Azure Network Engineer Associate, earned by passing exam AZ-700, is Microsoft's role-based certification for the engineers who plan, build, and troubleshoot networks in Azure.
Microsoft writes the exam around five skill areas: core network infrastructure, hybrid connectivity, application delivery, private access to Azure services, and network security. In practice that means address plans and routing, site-to-site VPN and ExpressRoute, load balancers and Front Door, private endpoints, and Azure Firewall. Each skill area is framed as design and implementation work, so expect to pick the right gateway SKU for a set of requirements, not just name what a gateway does.
AZ-700 carries no formal prerequisites, but Microsoft expects you to have created and managed compute, storage, and networking resources in Azure and to understand name resolution, network protocols, and address management. It is issued and maintained by Microsoft, and the skills-measured outline was last updated on July 27, 2026.
IP addressing, DNS, peering, routing, NAT Gateway, and network monitoring. The largest domain at 25 to 30%.
Site-to-site and point-to-site VPN, ExpressRoute, and Virtual WAN. 20 to 25%.
Load Balancer, Traffic Manager, Application Gateway, and Front Door. 15 to 20%.
Private Link, private endpoints, and service endpoints. The smallest domain at 10 to 15%.
Network security groups, Azure Firewall, Firewall Manager, and Web Application Firewall. 15 to 20%.
Four things that set the Azure Network Engineer apart from the rest of the Microsoft lineup in 2026.
AZ-700 is the Microsoft role-based certification written for the network engineer job role. Where other Azure exams cover networking as one section, AZ-700 is networking from start to finish, from address planning and DNS to ExpressRoute, Virtual WAN, Front Door, and Azure Firewall.
AZ-104 gives virtual networking one domain worth 15 to 20 percent. AZ-700 spends the whole exam there, with objectives such as Azure Route Server, ExpressRoute Global Reach and FastPath, Virtual WAN hub routing, and Private Link services.
Hybrid connectivity gets its own domain worth 20 to 25 percent, covering VPN, ExpressRoute, and Virtual WAN, the links that keep on-premises users talking to Azure workloads. Our Microsoft certifications guide shows where AZ-700 fits next to AZ-104.
AZ-700 is valid for 12 months and renews free through a short, open-book online assessment on Microsoft Learn. That's a shorter cycle than the three-year continuing education cycles behind CCNA and Network+, but it costs nothing. It is not a DoD 8140 credential and does not appear in the Qualification Matrix. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from employers instead. Organizations running production workloads in Azure need someone who can design the network those workloads sit on, and AZ-700 is the Microsoft credential that names that job.
The certification, the AZ-700 exam, and how to keep it current, as of October 2026.
AZ-700 is a specialist associate credential, so the next step depends on whether you want to design whole solutions, own security, or go deeper on the on-premises end of the network. These three are the common moves.
The move from building networks to designing whole Azure solutions. AZ-305 tests design across identity, governance, monitoring, data storage, business continuity, and infrastructure. Microsoft requires the Azure Administrator Associate (AZ-104) for the Expert credential, and AZ-700 doesn't stand in for it, so plan for both.
The security step for engineers who already own firewalls and segmentation. AZ-500 retired on August 31, 2026, and SC-500 is now Microsoft's Azure security engineer exam. One of its four skill areas is securing storage, databases, and networking, so the NSG, Azure Firewall, and WAF work from AZ-700 carries straight over.
The on-premises side of a hybrid network. ExpressRoute circuits and VPN tunnels end on routers in your own data center, and CCNP Enterprise (the 350-401 ENCOR core plus one concentration exam) covers that enterprise routing depth. See our CCNP Enterprise guide.
AZ-700 sits at the associate tier of Microsoft's role-based Azure path, next to AZ-104 rather than above it. Microsoft expects Azure admin skills and networking fundamentals before you sit it, and from AZ-700 the path branches into architecture and security.
Azure and networking groundwork
The Azure networking specialist
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue AZ-700 specifically. Here's a straight answer to both.
No prerequisite credential required.
AZ-700 has no formal prerequisites, and AZ-104 is not required. You register through Pearson VUE and take the exam at a test center or online with a remote proctor. That open door makes AZ-700 a realistic option for experienced network engineers who already work in Azure and don't want to sit an admin exam first.
Microsoft assumes you can already build in Azure.
The audience profile expects experience creating and managing compute, storage, and networking resources in Azure. Build a hub-and-spoke network with peering, user-defined routes, and a private DNS zone in a test subscription before you book. ExpressRoute is hard to lab at home because a working circuit needs a real physical connection, so learn its connectivity models, SKUs, and peering options from the documentation and Microsoft's free AZ-700 practice assessment.
AZ-700 maps to the cloud and hybrid networking roles that sit between the data center and Azure. Microsoft describes the job as keeping Azure networks fast, resilient, scalable, and secure, and fixing connectivity when it breaks.
The job Microsoft wrote AZ-700 for. Plans, builds, and manages Azure networks, tunes them for performance, resiliency, scale, and security, and tracks down connectivity problems when traffic stops flowing.
Owns the virtual networks, routing, DNS, and load balancing behind workloads running in Azure. Hub-and-spoke design, peering, and user-defined routes are the daily work.
Connects data centers and branch offices to Azure with site-to-site VPN, ExpressRoute, and Virtual WAN. The AZ-700 connectivity domain, worth 20 to 25 percent, maps directly to this job.
Designs and runs network security groups, Azure Firewall, Firewall Manager policies, and Web Application Firewall rules. AZ-700 covers this layer in a domain worth 15 to 20 percent.
Builds the shared platform other teams deploy into, including the network, private endpoints for platform services, and NAT Gateway for outbound traffic. AZ-700 proves the network half of that job.
Sets the target design for address space, segmentation, hybrid links, and traffic flow across an organization. AZ-700 pairs well with AZ-305 for architects who want to show Azure network depth and broader solution design.
AZ-700 is the Azure networking specialist exam. Here's how it lines up against the Azure admin exam that Microsoft's experience expectations point to, and two networking certifications that cover the on-premises side.
| Azure Network Engineer (AZ-700) | Azure Administrator (AZ-104) | Cisco CCNA (200-301) | CompTIA Network+ (N10-009) | |
|---|---|---|---|---|
| Issuer | Microsoft | Microsoft | Cisco | CompTIA |
| Level | Associate | Associate | Associate | Foundational, vendor-neutral |
| Focus | Designing and implementing Azure networks | Operating Azure environments | Cisco enterprise networking | Networking fundamentals |
| Prerequisites | None (Azure experience expected) | None (rec. 6 months) | None (about 1 year suggested) | None (A+ and 9 to 12 months rec.) |
| Exam | Count not published, 100 min | Count not published, 100 min | Count not published, 120 min | Up to 90 items, 90 min |
| Passing Score | 700 of 1000 | 700 of 1000 | Not published | 720 of 900 |
| Cost | $165 | $165 | About $300 | About $399 |
| Validity | 1 year, free renewal | 1 year, free renewal | 3 years, exam or CE credits | 3 years, CE program |
| DoD 8140 | Not listed | Not listed | Approved at Advanced | Approved at Basic |
| Best For | Azure and hybrid network engineers | Cloud administrators | Enterprise network engineers | Entry-level networking roles |
Pricing varies by region and taxes. No Microsoft certification appears on the DoD 8140 Matrix, so their recognition is market-driven. AZ-104, CCNA, and Network+ facts come from our Azure Administrator, CCNA, and Network+ guides.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
As an authorized Microsoft training partner, our Azure Network Engineer boot camp covers all five AZ-700 skill areas in four days of live instruction, in person or live online. It includes Microsoft Official Courseware, the Microsoft Official Practice Test, 24/7 online practice labs, your $165 exam voucher, and a free retake.
Where AZ-700 sits in the Microsoft lineup, how the 2026 retirements changed the path, and what multi-cloud and networking careers look like.
The full Microsoft map after the 2026 retirements, including a role-to-certification table that pairs AZ-104 with AZ-700 for cloud administrators who spend real time on networking.
Which Microsoft exams people are actually sitting in 2026 after AZ-204, AI-102, and AZ-500 retired, what each one costs, and who it fits.
What changed when AZ-500 retired, what the SC-500 blueprint adds, and why there is no conversion path from the old Azure security credential.
The multi-cloud case for adding Azure to AWS experience, including how AWS security groups map to Azure network security groups and where Azure fits best.
One student's path from a retail tech counter to a network engineer role through the CCNA, the kind of routing and addressing background Microsoft expects AZ-700 candidates to have.
Which enterprises run on Azure, including BMW, Starbucks, and Verizon, and why they chose it. Useful context for where Azure networking jobs come from.
What happens at check-in, what ends a session early, and how Microsoft's 24-hour and 14-day retake waits compare with other certification programs.
The AZ-700 exam is organized into five skill areas, each with its own weight. Core networking infrastructure is the heaviest at 25 to 30 percent, but connectivity is where much of the hard material lives, and ExpressRoute alone lists 13 skills. Click any domain for what it covers.
The heaviest domain. IP addressing and subnetting, including the subnets that gateways, private endpoints, firewalls, and Azure Bastion need, plus public IP prefixes and bring your own IP. It also covers name resolution with public and private DNS zones and Azure DNS Private Resolver, VNet peering and Azure Virtual Network Manager, user-defined routes, forced tunneling, Azure Route Server, NAT Gateway, and monitoring with Network Watcher, Azure Monitor for Networks, DDoS protection, and Microsoft Defender for Cloud network recommendations.
Hybrid connectivity. Site-to-site VPN design for high availability, gateway SKUs, policy-based versus route-based VPN, IPsec/IKE policies, and Azure Extended Network. Point-to-site VPN tunnel types and authentication with RADIUS or Microsoft Entra ID. ExpressRoute connectivity models, SKUs, private and Microsoft peering, Global Reach, FastPath, ExpressRoute Direct, encryption, and Bidirectional Forwarding Detection. Virtual WAN SKUs, virtual hubs, hub routing, and third-party NVA integration.
Getting traffic to applications. Azure Load Balancer SKUs, public versus internal and regional versus cross-region designs, Gateway Load Balancer, inbound NAT and outbound SNAT rules, and Azure Traffic Manager. Application Gateway backend pools, health probes, listeners, routing rules, TLS, rewrite rules, and autoscale. Azure Front Door tiers, routing, caching, TLS, URL rewrite and redirect, and Private Link origins.
The lightest domain. Planning and creating private endpoints, creating a Private Link service, integrating Private Link with DNS, and reaching a Private Link service from on-premises clients. It also covers when to choose service endpoints, how to create them, and how service endpoint policies restrict access.
Network security groups and application security groups, virtual network flow logs, IP flow verify, NSGs for remote administration through Azure Bastion, and security rules in Azure Virtual Network Manager. Azure Firewall SKUs, rules, and Firewall Manager policies, including a secured virtual hub in Virtual WAN. Web Application Firewall on Front Door and Application Gateway, detection versus prevention mode, and WAF policies.
Domains and weights reflect the Microsoft AZ-700 skills-measured outline dated July 27, 2026. Microsoft refreshes role-based exams periodically, so confirm the current outline in the AZ-700 study guide on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the Microsoft Azure Network Engineer certification.
The Microsoft Certified: Azure Network Engineer Associate, earned by passing exam AZ-700, is Microsoft's role-based certification for the engineers who plan, implement, and manage networking in Azure. It covers core network infrastructure, hybrid connectivity with VPN and ExpressRoute, application delivery, private access to Azure services, and network security. It takes one exam, and there's no prerequisite certification.
The current exam is AZ-700: Designing and Implementing Microsoft Azure Networking Solutions. Microsoft's skills-measured outline is dated July 27, 2026, and its change log lists minor updates to IP addressing, network monitoring, and network security groups, with no change to the five skill areas. As of October 2026, AZ-700 is not on Microsoft's list of exams scheduled to retire.
No. AZ-700 has no formal prerequisites, so anyone can register and sit the exam. Microsoft does expect experience creating and managing compute, storage, and networking resources in Azure, plus an understanding of networking fundamentals such as name resolution, network protocols, and IP address management. That's roughly the ground AZ-104 covers, though AZ-104 is not required.
The five skill areas are Design and implement core networking infrastructure (25 to 30 percent), Design, implement, and manage connectivity services (20 to 25 percent), Design and implement application delivery services (15 to 20 percent), Design and implement private access to Azure services (10 to 15 percent), and Design and implement Azure network security services (15 to 20 percent). Core infrastructure carries the most weight.
Microsoft doesn't publish a question count for AZ-700. Its general guidance is that most Microsoft certification exams contain 40 to 60 questions, and the number can vary. You get 100 minutes to answer them, and Microsoft suggests allowing 120 minutes of seat time for instructions and the candidate agreement. Microsoft doesn't say in advance which question types appear, but its exam sandbox demonstrates the formats it uses, including multiple choice, case studies, drag and drop, build list, and hot area.
You need 700 on a scale of 1 to 1,000 to pass. Microsoft uses scaled scoring, so 700 does not mean 70 percent correct. The passing line reflects the difficulty of the questions you get, there's no penalty for guessing, and some questions may be unscored items Microsoft uses to improve the exam.
As of October 2026, the AZ-700 exam costs $165 USD in the United States. Microsoft sets the price by the country or region where the exam is proctored, and taxes can apply. You schedule through Pearson VUE, at a test center or as an online proctored exam. Training Camp's Azure Network Engineer boot camp includes the exam voucher in the program fee, along with a free retake.
No. Microsoft certifications, AZ-700 included, don't appear on the DoD 8140 Approved Qualifications Matrix, so AZ-700 on its own won't satisfy a cyber-coded position requirement. If your role needs an 8140-listed networking credential, CCNA and CompTIA Network+ are on the matrix. AZ-700's value is with employers that run production networks in Azure. See the full DoD 8140 work role paths.
AZ-700 is valid for 12 months. You renew it for free by passing a short, unproctored, open-book assessment on Microsoft Learn during the six-month window before it expires. Passing extends the certification one year from the expiration date, and you can retake the renewal assessment as many times as you need before the deadline.
AZ-700 maps to roles such as Azure Network Engineer, Cloud Network Engineer, Hybrid Network Engineer, Network Security Engineer, Cloud Infrastructure Engineer, and Network Architect. Microsoft describes the job as optimizing the performance, resiliency, scale, and security of Azure networking, monitoring network environments, and resolving connectivity issues, working alongside solution architects, cloud administrators, and security engineers.
For most people, AZ-104 first. Microsoft expects AZ-700 candidates to already create and manage compute, storage, and networking resources in Azure, and that's what AZ-104 tests. If you're an experienced network engineer who already works in Azure, going straight to AZ-700 is reasonable because there's no prerequisite. If you plan on AZ-305 later, you'll need AZ-104 anyway, since Microsoft requires it for the Solutions Architect Expert credential.
It's an associate exam, but a deep one. AZ-104 gives networking a single domain worth 15 to 20 percent, and AZ-700 spends all 100 minutes there. The material that trips people up tends to be hybrid connectivity (ExpressRoute alone has 13 listed skills) and questions that ask you to choose between services that sound alike, such as Load Balancer, Application Gateway, Front Door, and Traffic Manager, or service endpoints and private endpoints. Hands-on time in a real Azure subscription makes the biggest difference.
For engineers who own networking in Azure or connect data centers to it, yes. AZ-700 is Microsoft's dedicated networking certification, it's current with a July 2026 outline and no retirement announced, it costs $165, and it renews free each year. It's less essential if networking is a small part of your Azure job, where AZ-104 covers virtual networks, NSGs, and load balancing, or if you need a DoD 8140 credential, where CCNA or Network+ fits better.
Tell us what you're weighing, from AZ-700 versus AZ-104 to training a whole network team on Azure, and we'll help you plan the next step.