What is it?

What exactly is the Microsoft Certified: Azure Network Engineer Associate?

The Azure networking associate exam that proves you can design and run Azure's network fabric end to end.

Microsoft Certified: Azure Network Engineer Associate (AZ-700) is the associate credential for engineers who plan, implement, and manage Azure networking solutions. It spans core network infrastructure, hybrid and connectivity services, application delivery, private access to Azure services, and network security. Azure network engineers optimize performance, resiliency, scale, and security, proactively monitor for issues, and resolve connectivity problems. They work with solution architects, cloud administrators, security engineers, application developers, and DevOps engineers. Candidates should have experience creating and managing compute, storage, and networking resources in Azure, plus networking fundamentals such as name resolution, network protocols, and address management. AZ-700 complements AZ-104 for engineers who specialize in networking rather than general administration.

The path in brief

1. Build Azure admin + networking fundamentals
2. Study the free AZ-700 Microsoft Learn paths
3. Practice with VNets, VPN, ExpressRoute, and Firewall
4. Schedule the $165 exam via Pearson VUE
5. Pass with 700/1000 and renew yearly for free

Before you book

Who is eligible to sit the Microsoft Certified: Azure Network Engineer Associate?

Open to all. Anyone may register and sit AZ-700; Microsoft recommends relevant experience but does not restrict eligibility.

Who it is for: Azure network engineers, cloud engineers, and infrastructure specialists.

The test itself

What is the format of the Microsoft Certified: Azure Network Engineer Associate?

The Microsoft Certified: Azure Network Engineer Associate is administered by Pearson VUE and runs 120 minutes, contains 40–60 (includes hands-on lab tasks) questions and requires 700 / 1000 (scaled) to pass.

The fine print

What are the retake and renewal rules for the Microsoft Certified: Azure Network Engineer Associate?

Proctoring & delivery

Delivered by Pearson VUE. You can sit the exam at a Pearson VUE test center or take it online through OnVUE remote proctoring; the fee is the same for both. Online proctoring requires a quiet, private space, a working webcam, and a system check beforehand.

Retake policy

If you do not pass, you may retake the exam after 24 hours. A second failed attempt requires a 14-day waiting period, and any further attempts also require a 14-day wait between them, up to a maximum of five attempts in a 12-month period.

Score reporting

A pass/fail result is shown immediately after the exam. The official score report is emailed within about 24 hours and is also available in your Microsoft certification profile, with section-level feedback on how you performed.

Recertification

Microsoft role-based, specialty, and fundamentals certifications are valid for 12 months from the date earned. Renew at no cost by passing the shorter online renewal assessment on Microsoft Learn before the credential expires. Retired certifications cannot be renewed and must be re-earned through the active successor if one exists.

Refunds & rescheduling

Exam fees are generally non-refundable once a seat is purchased, but you can cancel or reschedule through Pearson VUE at no charge if you do so at least 24–48 hours before the appointment (exact window varies by region).

What it pays

How much does this credential pay?

$130,390 median for computer network architects (BLS, May 2024) — the most literal SOC match of any Azure exam

Of all the exams covered on this site, AZ-700 is the one where the BLS occupation and the certification describe almost the same person. The Bureau of Labor Statistics defines Computer Network Architects (SOC 15-1241) as people who design and implement data communication networks, and the AZ-700 audience profile describes someone who plans, implements and manages Azure networking solutions including core infrastructure, hybrid connectivity, application delivery, private access and network security. That is the same sentence written twice. The median is $130,390 as of May 2024, employment is projected to grow 12% through 2034 — much faster than average — and BLS notes that entry to the occupation typically requires five or more years of prior experience in a related role such as network and computer systems administration. That last detail is the honest framing for AZ-700. It is not an entry-level credential and it does not function as one. Its value shows up in a specific and well-paid transition: the enterprise network engineer with a CCNA or CCNP and a decade of switches, routing and MPLS behind them who needs to prove they can carry that competence into Azure. Organisations running hybrid connectivity — ExpressRoute into a colocation facility, a hub-and-spoke topology with forced tunnelling, an on-premises datacenter that is not going away — pay for exactly this and struggle to hire it, because the population that understands both BGP and Azure resource manager is small. Two caveats. If you have no networking background at all, AZ-700 is the wrong first exam and the salary figure above will not describe you; start with AZ-104. And note the Skillsoft self-reported figure below is the lowest in the Azure family, which almost certainly reflects survey respondent mix rather than anything real about network engineer pay — it is a good illustration of why we anchor on BLS and label survey data as survey data.

Job growth.12% projected growth 2024-2034 for computer network architects — much faster than average, with about 11,200 openings a year (BLS OOH)

Source: BLS Occupational Outlook Handbook — Computer Network Architects

Your schedule

How long should I study for it?

60-90 hours of focused study

There is a trap in the official material for this exam and you should know about it before you plan anything. The Microsoft Learn course for AZ-700 is a single learning path of eight modules running to roughly six and a half hours — by far the smallest official content set of any exam on this site, less than a third of what AZ-104 offers. It would be easy to read that as evidence that AZ-700 is a small exam. It is not. The path is a skeleton, and the depth the exam actually tests lives in the Azure networking product documentation, not in the modules. Candidates who work the learning path, score well on the practice assessment and book immediately are the most reliable failure group for this exam. Budget 60 to 90 hours if you have a genuine networking background, and treat the Learn path as a table of contents that tells you which documentation sections to read properly. The second planning reality is ExpressRoute. It is a substantial part of the connectivity domain, it is the topic candidates find hardest, and you almost certainly cannot lab it — a circuit costs real money and requires a connectivity provider. That means ExpressRoute has to be learned conceptually and precisely: peering types, routing domains, gateway SKUs and their bandwidth ceilings, FastPath, Global Reach, and the difference between what the circuit does and what the gateway does. Give it disproportionate reading time to compensate for the absent hands-on. Everything else on the blueprint you can and should build. The plan below assumes AZ-104-level Azure familiarity and real networking fundamentals — name resolution, protocols, address management — which the audience profile explicitly requires.

1. Week 0 — baseline5-7 hrs

   Establish where you actually are before spending hours

   • Take the free official Practice Assessment cold to get a bar chart across the five skill areas
   • Read the change log on the study guide: the current blueprint is "Skills measured as of July 27, 2026", with minor revisions to IP addressing, network monitoring and network security groups
   • Create a subscription with a spending limit and a budget alert — you will build a lot of small, cheap resources and a few expensive ones (gateways) that must be deleted the same day
   • Refresh the non-Azure fundamentals the audience profile assumes: subnetting and CIDR arithmetic, DNS resolution order, TCP versus UDP, and BGP path selection basics
2. Weeks 1-212-15 hrs/week

   Design and implement core networking infrastructure (25-30%)

   • Do CIDR arithmetic by hand until it is fast — the exam gives you address spaces and asks whether a subnet fits, and mental arithmetic under time pressure is a real constraint
   • Build VNets and subnets, then peer them within a region and across regions; prove to yourself that peering is non-transitive and understand gateway transit and the allow-forwarded-traffic settings
   • Public and private IP addressing: Basic versus Standard SKU behaviour, static versus dynamic, prefixes, and the default outbound access changes
   • Azure DNS: public zones, private zones, VNet links with and without auto-registration, and the 168.63.129.16 resolver — private DNS resolution is one of the most heavily tested topics on the exam
   • Azure DNS Private Resolver: inbound and outbound endpoints and forwarding rulesets, which is how hybrid name resolution is now expected to be done
   • Routing: system routes, user-defined routes, route tables, BGP route propagation, and the precedence order when they conflict
   • Network monitoring: Network Watcher, connection troubleshoot, NSG flow logs, and the objectives flagged as minor changes in July 2026
3. Weeks 3-412-15 hrs/week

   Design, implement, and manage connectivity services (20-25%) — including the ExpressRoute reading block

   • Build a site-to-site VPN with a virtual network gateway and, if you can, a second on-premises simulation to see active-active and BGP over VPN
   • Point-to-site VPN: certificate authentication versus Microsoft Entra ID authentication, tunnel types, and address pool design
   • Virtual WAN: hubs, hub-to-hub connectivity, secured virtual hub with Azure Firewall, and when Virtual WAN replaces a hand-built hub-and-spoke
   • ExpressRoute — read, do not lab. Private peering versus Microsoft peering, circuit SKU and gateway SKU and which limits which, FastPath, Global Reach, ExpressRoute Direct, and coexistence with a site-to-site VPN as a failover path
   • Draw the hybrid topology from memory three times across the fortnight: which resource holds the circuit, which holds the connection, which holds the gateway, and where routes are exchanged
4. Week 512-15 hrs

   Design and implement application delivery services (15-20%)

   • Build all four and compare them side by side: Azure Load Balancer, Application Gateway, Azure Front Door, Traffic Manager
   • Nail the two axes the exam decides on — global versus regional, and layer 4 versus layer 7. Nearly every question in this domain resolves on those two
   • Load Balancer detail: SKUs, health probes, inbound NAT rules, outbound rules and SNAT port exhaustion
   • Application Gateway detail: listeners, rules, backend pools, path-based and multi-site routing, WAF policies, autoscaling
   • Front Door detail: routing rules, caching, origin groups, WAF at the edge, and why it is not a drop-in replacement for Traffic Manager
5. Week 614-18 hrs

   Private access (10-15%) + network security services (15-20%)

   • Private endpoints and Private Link: build one, then follow the DNS chain end to end — the private DNS zone, the A record, and what an on-premises client needs in order to resolve it
   • Service endpoints and service endpoint policies, and be able to state the difference from private endpoints in terms of consequence rather than definition
   • Private Link Service: publishing your own service behind a Standard Load Balancer for consumers in other tenants
   • Network security groups and application security groups: rule priority evaluation, effective rules, and the July 2026 minor revision to this objective
   • Azure Firewall and Firewall Manager: policy hierarchy, application versus network versus NAT rules, threat intelligence, forced tunnelling, and the premium features
   • WAF policies on Application Gateway and Front Door, and DDoS Protection tiers
6. Week 710-14 hrs

   Consolidation and format rehearsal

   • Draw a complete hub-and-spoke topology from memory with firewall, gateway, UDRs, private endpoints and DNS — then do it again as Virtual WAN
   • Work through the Azure Architecture Center networking reference architectures and, for each, identify the requirement that forced each choice
   • Re-take the official Practice Assessment and compare with your Week 0 baseline; spend remaining hours on the two weakest areas only
   • Run one session in the free exam sandbox at aka.ms/examdemo so no item format is unfamiliar on the day

What to buy

Which study resources are worth paying for?

The AZ-700 market is small and that cuts both ways: fewer options, but the good ones are easy to identify. The official learning path is unusually thin for this exam, which raises the value of documentation and of the free video content relative to paid courses.

Prices checked 2026-08-04 and expressed as USD list prices before regional adjustment, sales, employer discounts or student pricing. Udemy list prices are close to fictional; the sale price is the real price. We take no commission from any provider listed and the ordering reflects our editorial judgement of usefulness for this specific exam, not any commercial relationship.

What you'll face

What question types will I see?

AZ-700 is an associate role-based exam with 100 minutes of exam time, and it uses Microsoft's full item library: multiple choice and multiple response, drag-and-drop and build-list, hot area, active screen, repeated-scenario yes/no sets, possible case studies, and on some forms a live lab. Microsoft does not publish a question count and it varies by form; forms that may include a lab carry 120 minutes of exam time and 140 of seat time rather than 100 and 120, and you are told which you have when the exam launches. Two things distinguish this exam's feel from its Azure siblings. The first is topological reasoning: a large share of items describe a network shape in prose — a hub, two spokes, an on-premises site, a firewall, a route table — and ask what a packet does. You are effectively being asked to build a diagram in your head and trace a path through it, which is why we push drawing so hard in the study plan. The second is precision about resource properties. Where AZ-305 asks which service to recommend, AZ-700 asks which SKU, which peering type, which probe protocol, which priority number. Hot-area items rendering an NSG rule table, an Application Gateway listener configuration or a gateway SKU picker are common, and they are unforgiving of vague knowledge. Because this is associate role-based, the Microsoft Learn panel is available — learn.microsoft.com minus Q&A, practice assessments and your profile, split-screen, clock running, no extra time — which makes it genuinely useful for the SKU comparison tables this exam loves. Rehearse every format free at aka.ms/examdemo. Most items cover generally available features; preview features appear only where commonly used.

Samples are written by our editors to illustrate the published AZ-700 skills outline (skills measured as of 27 July 2026). They are not real exam items, are not drawn from any question bank, and no live Microsoft exam content is reproduced anywhere on this page. Microsoft's free exam sandbox at aka.ms/examdemo is the authoritative place to rehearse the interface.

Reference

What are the key facts about the Microsoft Certified: Azure Network Engineer Associate?

Microsoft Certified: Azure Network Engineer Associate is a certification credential; awarded by Microsoft; the exam fee is $165 USD; typical preparation is 2–4 months of study; holders typically earn $100,000 – $140,000.

In short

Is the Microsoft Certified: Azure Network Engineer Associate worth it?

• AZ-700 is the Azure Network Engineer Associate exam covering core networking, connectivity, app delivery, private access, and security.
• The exam is 40–60 questions (with labs) in about 120 minutes; the passing scaled score is 700/1000.
• Microsoft's published weights are core networking 25–30%, connectivity 20–25%, app delivery 15–20%, private access 10–15%, and network security 15–20%.
• It costs $165 and renews for free every 12 months via a Microsoft Learn assessment.

Worth comparing

How does the Microsoft Certified: Azure Network Engineer Associate compare with similar credentials?

• Microsoft Certified: Azure Administrator Associate Microsoft
• Cisco Certified Network Associate Cisco Systems

Trust

Where does this information come from?

Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.

• Microsoft Awarding body
• Official Microsoft Certified: Azure Network Engineer Associate exam page Exam page
• Microsoft certification programme Programme rules

Research confidence: high · Last reviewed 2026-08