How to Pass the Microsoft AZ-700 Exam in 2026: An 8-Week Azure Network Engineer Study Plan for the New 27 July Objectives

The AZ-700 exam is the one Azure certification that punishes vague knowledge more than any other. You can recognise every service on the syllabus and still fail, because Microsoft does not ask you what Azure Firewall is. It asks you which SKU to pick when a customer needs TLS inspection across a Virtual WAN hub with forced tunnelling already in place.

That is the gap this plan closes. Below is an eight-week schedule for AZ-700: Designing and Implementing Microsoft Azure Networking Solutions, built around the skills measured that Microsoft published on 27 July 2026. If you are studying from a course or a blog post written before that date, you are studying a slightly different exam.

Eight weeks at eight to ten hours a week is the realistic window for someone who already works with Azure. If networking is new to you, treat this as a twelve-week plan and stretch the early weeks.

What the AZ-700 Exam Actually Covers in 2026

Microsoft splits AZ-700 into five domains. These are the official weightings from the skills measured document dated 27 July 2026.

The first domain is the largest single block at 25 to 30%, and it is also the one that quietly underpins everything else. If your subnetting and name resolution are shaky, you will lose marks in the private access and connectivity domains too, because private endpoints and VPN gateways both depend on getting DNS right.

Exam Tip: Add the two connectivity-heavy domains together and hybrid networking accounts for up to 55% of the exam. ExpressRoute and VPN are not side topics on AZ-700. They are the core of it.

What Changed in the 27 July 2026 Objectives Update

Microsoft classed this refresh as a set of minor changes rather than a rewrite. The domain names and weightings did not move. What changed sits inside three functional groups: IP addressing for Azure resources, monitoring networks, and network security groups.

The practical effect is that several newer services are now explicitly named in the objectives rather than being implied:

• Azure Virtual Network Manager appears in both the connectivity and security domains, for managing VNet connectivity and security rules at scale.
• Azure DNS Private Resolver is called out by name under name resolution, so conditional forwarding between on-premises and Azure is fair game.
• Virtual network flow logs now sit in the NSG objectives. This matters because Microsoft has moved away from NSG flow logs, and older study material still teaches the retired version.
• Microsoft Defender for Cloud shows up under monitoring, including Secure Score network recommendations, attack path analysis, and Cloud Security Explorer.
• Azure Extended Network and Bidirectional Forwarding Detection are named under site-to-site VPN and ExpressRoute respectively.

None of these are large enough to change your study order. They are large enough to cost you three or four questions if you revise from a 2024 course and never see them.

Exam Tip: If a practice question asks you to configure NSG flow logs, the material is out of date. Learn virtual network flow logs instead, including how to read them in Traffic Analytics.

AZ-700 Exam Format, Cost and Pass Mark

Microsoft publishes some of these figures and leaves others deliberately vague, so here is what is actually confirmed versus what candidates consistently report.

Two things are worth understanding about the pass mark. First, 700 out of 1000 is not 70% of the questions. Microsoft uses a scaled score, so questions carry different weights and there is no fixed number of correct answers that guarantees a pass. Second, the certification expires every year, but renewal is free and done through a short unproctored assessment on Microsoft Learn rather than by resitting AZ-700.

If you are sitting this online rather than at a test centre, read our guide to the OnVUE online proctored exam rules before booking. The room scan and check-in rules catch out more Azure candidates than the networking content does.

Do You Need AZ-104 First? AZ-700 Prerequisites Explained

Microsoft enforces no prerequisites for AZ-700. You can book it today with no prior certification. Whether you should is a different question.

The audience profile expects you to already have experience creating and managing compute, storage, and networking resources in Azure, plus a working understanding of name resolution, network protocols, and network address management. That is roughly the knowledge AZ-104 gives you, which is why most successful candidates take that route.

Here is how to decide:

• Take AZ-104 first if you have never built a VNet from scratch, or if the Azure portal is still unfamiliar. AZ-700 assumes portal fluency and will not teach it to you.
• Go straight to AZ-700 if you are an experienced on-premises network engineer who already works in Azure day to day. Your BGP, routing and IPsec knowledge transfers directly, and it is the strongest possible foundation for ExpressRoute.
• Skip AZ-900 unless you are completely new to cloud. It is a fundamentals exam and adds little to an AZ-700 attempt.

Traditional network engineers usually find AZ-700 easier than Azure generalists do. The concepts are familiar and only the implementation is new.

The 8-Week AZ-700 Study Plan

This plan front-loads the heaviest domains and leaves the final fortnight for practice and weak-spot repair. Every week pairs reading with hands-on work, because AZ-700 questions are written around configuration decisions rather than definitions.

Set up a free Azure account before week one and set a spending limit. Almost everything in weeks one to three runs inside the free tier or costs pennies. Gateways and ExpressRoute do not, so tear those down the same day you build them.

Week 1: Core networking and IP addressing

Start with the largest domain. Cover virtual networks, address spaces, subnetting, subnet delegation, public IP addresses and public IP prefixes, and custom IP prefixes (bring your own IP).

Build a hub and spoke topology by hand in the portal. Do not use a template. You need to feel which settings are locked once a subnet is created and which are not.

Spend real time on subnet sizing for gateway subnets, Azure Bastion, Azure Firewall and Application Gateway. Each has its own minimum size and naming requirement, and Microsoft loves asking about them.

Week 2: Name resolution and routing

Cover Azure DNS public zones, private zones, VNet links, autoregistration, and Azure DNS Private Resolver. Then move to routing: VNet peering, gateway transit, service chaining, user-defined routes, route tables, forced tunnelling, Azure Route Server and NAT Gateway.

This is the week where most candidates find their first real gap. Build a UDR that forces spoke traffic through a network virtual appliance in the hub, then trace the effective routes on the NIC. Understanding route precedence, where user-defined routes beat BGP routes which beat system routes, is worth several marks on its own.

Finish the week with Network Watcher: connection troubleshoot, IP flow verify, next hop, and virtual network flow logs.

Week 3: Site-to-site and point-to-site VPN

Cover virtual network gateway SKUs, active-active configurations, policy-based versus route-based VPN, local network gateways, and IPsec/IKE policies.

Deploy a VPN gateway even though it takes around 30 minutes to provision and costs money while it exists. Configure a point-to-site connection with Microsoft Entra ID authentication, download the client configuration, and connect. Then delete the gateway.

Learn the SKU table properly. Which SKU supports how many tunnels, which supports BGP, and which supports active-active is straight recall that Microsoft tests directly.

Week 4: ExpressRoute and Virtual WAN

The hardest week for anyone without a telco or WAN background. Cover connectivity models, SKUs and tiers, private peering versus Microsoft peering, Global Reach, FastPath, ExpressRoute Direct, encryption over ExpressRoute, and Bidirectional Forwarding Detection.

Then move to Virtual WAN: virtual hubs, hub routing, scale units, secured hubs, and integrating a third-party network virtual appliance.

You will not be able to build ExpressRoute in a lab, so compensate with architecture reading. Work through Microsoft's ExpressRoute design documentation and draw each redundancy pattern yourself. Being able to sketch cross-region redundancy from memory is a good proxy for being ready.

Week 5: Application delivery services

Cover Azure Load Balancer (public versus internal, regional versus cross-region, SKUs, inbound NAT rules, outbound rules and SNAT), Traffic Manager routing methods, Gateway Load Balancer, Application Gateway (listeners, backend pools, health probes, HTTP settings, TLS, rewrite rules) and Azure Front Door (tiers, origins, routing, caching, TLS termination).

The recurring exam question in this domain is a selection question: given a requirement, which of these four services do you use? Build a comparison table of layer, scope, protocol support and typical use case, and rehearse it until it is automatic.

Deploy an Application Gateway with a WAF policy attached. It is the single most cost-effective lab in the whole plan because it touches two domains at once.

Week 6: Private access and network security

Cover Private Link service, private endpoints, DNS integration for private endpoints, on-premises access to Private Link, and service endpoints including service endpoint policies.

Then the security domain: network security groups, application security groups, inbound and outbound rule processing order, virtual network flow logs, Azure Firewall SKUs and rule types, Azure Firewall Manager policies, secured virtual hubs, and Web Application Firewall on both Front Door and Application Gateway.

Understand the private endpoint DNS pattern completely. Creating the endpoint is easy. Getting name resolution working from on-premises through a DNS Private Resolver is the part that appears in case studies.

If you are also working towards a security certification, our comparison of AZ-500 and SC-500 explains how the Azure security path has changed this year.

Week 7: Full-length practice and gap analysis

Stop learning new material. Sit a full timed practice exam under real conditions, then score by domain rather than overall.

Any domain below 70% gets a dedicated rebuild day: reread the objectives, redo the lab, then retest only that domain. Any domain above 85% gets left alone. Chasing a strong domain higher is the most common way candidates waste their final fortnight.

Take Microsoft's free practice assessment for AZ-700 on Microsoft Learn as well. It is not as hard as the real exam, but the phrasing is authentic and it exposes vocabulary gaps quickly.

Week 8: Case studies, recall drills and booking

Case studies are where AZ-700 separates people. You get a scenario with requirements, constraints and existing infrastructure, then several questions that all depend on reading it correctly.

Practise the technique rather than the content: read the requirements first, note the constraints that eliminate options, then read the questions. Most wrong answers on case studies are technically correct configurations that violate a stated constraint.

Spend the rest of the week on straight recall: gateway SKU limits, firewall rule processing order, load balancer SKU differences, WAF modes, and private endpoint DNS zone names. Book the exam for the end of the week so the deadline is real.

The Five AZ-700 Topics That Fail Most Candidates

Across candidate reports, the same five areas do the damage.

1. Route precedence. Knowing that user-defined routes take priority over BGP routes, which take priority over system routes, and being able to predict the effective route when all three exist.
2. Private endpoint DNS. Specifically, resolving a private endpoint from on-premises. This needs a private DNS zone, a VNet link, and either a DNS Private Resolver or a forwarder. Missing any one of them breaks it.
3. Gateway SKU selection. Tunnel counts, BGP support, active-active support and throughput per SKU. Pure recall, frequently tested, and easy marks if you memorise the table.
4. Load balancer versus Application Gateway versus Front Door versus Traffic Manager. Layer 4 versus layer 7, regional versus global, and which one handles which protocol.
5. Azure Firewall rule processing order. DNAT rules are evaluated first, then network rules, then application rules. Candidates who guess this get a run of questions wrong rather than one.

Build a one-page sheet covering these five and read it every morning of week eight.

How to Practise for AZ-700 Design Questions

Recall practice and design practice are different skills, and AZ-700 tests both.

For recall, use spaced repetition on the hard numbers: SKU limits, port requirements, subnet minimum sizes, and rule processing orders. Twenty minutes daily beats a three-hour session at the weekend.

For design, use a simple drill. Take any Azure networking service and write down three requirements that would make you choose it and two that would rule it out. If you cannot produce the ruling-out cases, you do not know the service well enough for a case study.

Timed practice questions are the fastest way to find gaps you did not know you had, because AZ-700 questions attack the boundaries between services rather than the middle of each one. Our Azure and cloud practice exams are built to mirror that style, with explanations that tell you why the other three options fail rather than just naming the correct answer.

Frequently Asked Questions

How difficult is the AZ-700 exam?

AZ-700 is generally rated harder than AZ-104 and easier than AZ-305. The difficulty is not the volume of content but its depth: you are expected to choose between similar services under constraints rather than describe what each one does. Candidates from a traditional networking background usually find it manageable, while Azure generalists without routing or VPN experience find week four on ExpressRoute the steepest part.

What is AZ-700 certification?

AZ-700 is the single exam that earns the Microsoft Certified: Azure Network Engineer Associate certification. It validates your ability to design, implement and manage Azure networking, covering virtual networks, hybrid connectivity through VPN and ExpressRoute, application delivery services, private access, and network security. The certification expires after one year and is renewed free through an online assessment on Microsoft Learn.

What is the difference between AZ-900 and AZ-700?

AZ-900 is Azure Fundamentals, a broad entry-level exam covering cloud concepts, Azure services, pricing and governance at a conceptual level. AZ-700 is an associate-level specialist exam covering only networking, in configuration-level depth. AZ-900 asks what a virtual network is, while AZ-700 asks which gateway SKU supports active-active BGP for a given throughput requirement. There is no requirement to hold AZ-900 before AZ-700.

Does AZ-700 have prerequisites?

No. Microsoft enforces no prerequisite certifications for AZ-700, and you can book it at any time. The audience profile does assume you already have hands-on experience with Azure compute, storage and networking, plus a grounding in name resolution, network protocols and address management. Most candidates take AZ-104 first to build that base, though experienced network engineers often go straight to AZ-700.

How long does it take to prepare for AZ-700?

Eight weeks at eight to ten hours a week is realistic for someone already working with Azure. Complete beginners should plan for ten to twelve weeks, and experienced on-premises network engineers moving to Azure often pass in five or six. The variable is almost always hands-on lab time rather than reading time.

Ready to Start Practising?

The AZ-700 objectives changed on 27 July 2026, and most of the material ranking on Google right now was written before that date. Studying current objectives with question practice that matches the exam's decision-making style is the difference between a comfortable pass and a resit.

CertCrush gives you exam-style practice questions with full explanations, so you learn why the wrong answers are wrong, which is exactly what case studies test.

Create your free CertCrush account and start practising today, or browse the full course catalogue to see what else is available for your certification path.