AZ-104 is the foundation. AZ-700 is the specialty. The question is whether the specialty pays back the time investment, and the answer depends almost entirely on the kind of work you target. Below is the direct comparison plus the honest take on where AZ-700 actually moves the needle.
Exam facts side by side
| Dimension | AZ-104 | AZ-700 |
|---|---|---|
| Cost | $165 USD | $165 USD |
| Duration | 100 minutes | 120 minutes |
| Questions | 40-60 | 40-60 |
| Passing score | 700/1000 | 700/1000 |
| Tier | Associate | Associate (specialty) |
| Renewal | 1 year, free online | 1 year, free online |
| Prerequisites | None formal | None formal; AZ-104 strongly recommended |
Source: learn.microsoft.com certification pages, accessed May 2026.
Scope difference
AZ-104 covers Azure operations broadly: identities and governance, storage, compute, virtual networking basics, and monitoring. The networking domain on AZ-104 is roughly 15-20% of the exam and tests foundational concepts: VNets, subnets, NSGs, basic load balancers, simple peering, and VPN Gateway basics.
AZ-700 is networking-specific and goes deep on the topics AZ-104 only touches:
- VNet peering at scale: hub-and-spoke topologies, transit, gateway transit, encrypted peering
- ExpressRoute: circuit types, peering models, ExpressRoute Direct, ExpressRoute Global Reach, FastPath
- Azure Firewall: Standard vs Premium, rule processing order, threat intelligence, IDPS, TLS inspection
- Azure Front Door: Standard, Premium, classic; routing rules, WAF integration, caching behaviour
- Application Gateway: v1 vs v2, autoscaling, WAF v2, mutual TLS, header rewrite
- Azure Bastion: Standard vs Premium SKU, host pools, native client support
- Private DNS, Private Endpoints, Private Link, Service Endpoints: the four overlapping options for private connectivity, when each applies, cost trade-offs
- Network monitoring: Network Watcher, Connection Monitor, NSG flow logs, Traffic Analytics, VNet flow logs (the newer offering replacing some NSG flow log scenarios)
Time to prep AZ-700 from AZ-104
Most candidates with a fresh AZ-104 need 50-70 hours of focused study over 6-8 weeks. Candidates without strong networking fundamentals (TCP/IP, BGP, routing tables) need additional time on the foundations. Candidates with prior Cisco or Juniper networking experience can compress this to 30-40 hours because the conceptual layer transfers directly.
Salary delta in 2026
Azure Network Engineers (AZ-700 holders) in the US earn $130,000-$160,000 mid-level and $165,000-$220,000 senior, per Glassdoor 2026 data. Compared with AZ-104-only Azure Administrators at the same experience level, the specialty cert correlates with roughly a 10-20% salary uplift in roles where networking is the primary responsibility.
In the EU, AZ-700 holders at consultancies (Avanade, Insight, Atos, Sopra Steria) earn EUR 75,000-95,000 mid-level versus EUR 65,000-85,000 for AZ-104-only consultants. The premium is consistent and reflects the genuine scarcity of engineers who can design ExpressRoute topologies and Azure Firewall rule sets.
In-house roles at SaaS companies show a smaller delta (5-10%) because most SaaS companies do not run complex hybrid network topologies; the specialty knowledge has fewer use cases.
Job market reality
Where AZ-700 matters most
- Enterprise Azure migrations: banks, healthcare, government, large retail. These companies move on-prem workloads to Azure and need engineers who can design ExpressRoute, hub-and-spoke topologies, and complex firewall rules. AZ-700 is frequently a hiring filter.
- Microsoft consultancies: Avanade, Insight, EPAM, Sopra Steria. Migration projects involve heavy networking work, and partner-status requirements push consultancies to maintain certified networking specialists.
- Hybrid cloud and multi-cloud connectivity roles: companies running Azure plus on-prem or Azure plus AWS need network engineers who can wire the two together. AZ-700 plus AWS Advanced Networking specialty is a powerful combination.
Where AZ-700 matters less
- Cloud-native SaaS: companies building applications that run entirely in the cloud, often without on-prem connectivity. The networking design is simpler and AZ-104 networking knowledge is usually sufficient.
- Pure DevOps and platform engineering: the focus is CI/CD, Kubernetes, and observability. Networking is a smaller part of the job.
- Startup engineering: small teams, simple architectures. Networking specialists are rarely hired below 50 engineers.
The decision framework
Take AZ-700 if:
- Your current or target job involves enterprise hybrid connectivity (ExpressRoute, VPN, hub-and-spoke)
- You work at or want to work at a Microsoft consultancy doing migration projects
- You enjoy networking work and want to specialise rather than stay general-purpose
- You have already cleared AZ-104 and are looking for a high-signal next cert that is not a full architecture jump
Skip AZ-700 if:
- Your job runs cloud-native SaaS workloads with simple network topologies
- You target DevOps or platform engineering roles where Kubernetes and CI/CD are the differentiators
- You plan to move to AZ-305 (Azure Solutions Architect Expert) next; the architecture cert covers networking at the design level and is more broadly recognised
AZ-305 versus AZ-700: a common confusion
AZ-305 tests architecture design across all Azure domains, including networking design at the conceptual level (when to choose Front Door vs Application Gateway vs Traffic Manager, when to use ExpressRoute vs VPN, etc.). AZ-700 tests implementation of the networking topology that an AZ-305 architect would design. They are complementary, not competing.
Practical recommendation: if you are an architect or aspire to be one, AZ-305 is the right next cert. If you are an engineer who will own the implementation and operation of complex Azure networking, AZ-700 is the right next cert. Many senior engineers in enterprise consultancies hold both.
Study plan: 8 weeks for AZ-700 from AZ-104
- Weeks 1-2: Microsoft Learn AZ-700 paths. Cover hybrid connectivity (VPN Gateway, ExpressRoute) and core VNet topics.
- Weeks 3-4: Application delivery (Application Gateway, Front Door, Load Balancer) and security (Azure Firewall, NSG, ASG, Private Link).
- Weeks 5-6: Hands-on labs in a personal Azure subscription. Build a hub-and-spoke topology with Azure Firewall, deploy Application Gateway with WAF, set up Private Endpoint to a Storage Account.
- Week 7: Practice exams (MeasureUp official, plus Whizlabs for volume). Review every wrong answer against documentation.
- Week 8: Final practice exam, targeted review, and book the real exam.
Useful CLI commands for AZ-700 hands-on prep
# Create a hub VNet (typical AZ-700 lab starting point)
az network vnet create \
--name vnet-hub \
--resource-group rg-network-lab \
--address-prefix 10.0.0.0/16 \
--subnet-name AzureFirewallSubnet \
--subnet-prefix 10.0.1.0/26
# Set up VNet peering between hub and spoke
az network vnet peering create \
--name hub-to-spoke \
--resource-group rg-network-lab \
--vnet-name vnet-hub \
--remote-vnet vnet-spoke \
--allow-vnet-access \
--allow-forwarded-traffic
# Verify effective routes on a NIC (the most useful AZ-700 troubleshooting command)
az network nic show-effective-route-table \
--name nic-vm01 \
--resource-group rg-network-lab \
--output table
The effective route table command is the single most useful tool for diagnosing networking issues in Azure. AZ-700 questions repeatedly probe scenarios where the effective routes are not what the candidate expects; muscle memory on this command translates to faster troubleshooting in real production work.