Design and implement build and release pipelines
Infrastructure as Code and Configuration
CoreVersion and validate Azure resource definitions, maintain guest desired state with the right configuration layer, and provide governed self-service environments.
Aligned to AZ-400 skills measured as of July 27, 2026; guide and product behavior verified September 25, 2026.
Why this matters
Infrastructure becomes repeatable only when the repository, validation pipeline, identity, deployment engine, drift response, and ownership model agree on the source of truth.
Must Know
- Bicep and ARM templates declaratively deploy Azure resources through Resource Manager; references establish many dependencies automatically.
- Configuration management governs operating-system or application state after or alongside resource provisioning.
- Store IaC in source control, lint and validate it, preview changes, require review, deploy with scoped identity, and preserve deployment evidence.
- Azure Machine Configuration uses policy-backed assignments to audit or configure operating-system state on Azure and Arc-enabled machines.
- Azure Automation State Configuration remains in the blueprint, but Microsoft documents retirement on September 30, 2027 and migration toward Azure Machine Configuration.
- Azure Deployment Environments uses dev centers, projects, environment types, catalogs, definitions, and managed identities to provide governed on-demand environments.
- Microsoft documents Azure Deployment Environments retirement on February 22, 2027. Existing implementations must inventory environments and control-plane objects and validate replacement workflows such as Bicep or ARM through GitHub or Azure DevOps.
Compare and Distinguish
- Bicep or ARM provisions Azure resources; Machine Configuration audits or applies guest state.
- A deployment environment is a governed self-service instance from a catalog definition; a Dev Box is a developer workstation.
- What-if or preview predicts resource changes; policy or drift detection evaluates deployed state.
Scenario examples
- Scenario: New Arc-enabled servers must enforce guest configuration. Think: Azure Machine Configuration rather than a new Automation State Configuration design.
- Scenario: Developers need self-service environments without subscription Contributor. Think: curated catalog plus project environment type and managed deployment identity.
Exam traps
- A resource template does not continuously enforce every setting inside a virtual machine.
- A portal hotfix creates drift unless reconciled into source.
- The current objective still names Deployment Environments, but a production plan that ignores its February 22, 2027 retirement is incomplete.
Key takeaways
- Separate resource provisioning from guest desired state.
- Treat State Configuration and Deployment Environments as current-blueprint capabilities with explicit retirement planning.
- For replacement self-service, validate IaC, identity, policy, lifecycle, networking, cost, and developer-experience requirements.
How it works
- Resource Manager computes a dependency graph from references and applies the approved desired Azure state at a declared scope.
- Machine Configuration assignments evaluate guest compliance and can audit or remediate according to the selected policy behavior.
Objects and administrative surfaces
- Bicep and ARM templates, deployment scopes, modules, what-if, deployment history, template specs, and stacks.
- Azure Policy Machine Configuration assignments and compliance.
- Azure Deployment Environments dev centers, projects, catalogs, environment types, definitions, and roles.
When to use it
- Use configuration management when state must converge repeatedly after resource creation across machines or application platforms.
Security and governance implications
- Separate requester access from deployment identity, restrict unmanaged changes, and review retirement replacements against existing controls.
Troubleshooting signals
- For drift, determine whether source, parameters, deployment history, policy, or an out-of-band mutation represents the intended state.
More detail
- Keep infrastructure definitions in source, validate and preview them, deploy with scoped identities, and reconcile legitimate portal changes.
- Use Azure Machine Configuration for new Azure and Arc guest-state designs and plan migration from retiring Automation State Configuration.
- Inventory Azure Deployment Environments behaviors and control-plane objects before its February 22, 2027 retirement.
Ready for the quiz?
- Which layer should configure an operating-system setting?
- What does a Deployment Environments catalog contain?
- Which controls must an ADE replacement preserve before February 22, 2027?
Related objectives
- D3.5.S1 — Recommend a configuration management technology for application infrastructure
- D3.5.S2 — Implement a configuration management strategy for application infrastructure
- D3.5.S3 — Define an IaC strategy, including source control and automation of testing and deployment
- D3.5.S4 — Design and implement desired state configuration for environments, including Azure Automation State Configuration, Azure Resource Manager, Bicep, and Azure Machine Configuration
- D3.5.S5 — Design and implement Azure Deployment Environments for on-demand self-deployment