Microsoft typically runs four to five onsite rounds split between coding, design, and behavioural, with formats varying by org. A senior interviewer known as the As Appropriate, or AA, joins near the end and acts as the team's final sign-off. The behavioural thread leans heavily on the Growth Mindset framing the company promotes.
Process timeline
1
Recruiter screen
Background, level, and which org you fit.
2
Coding rounds (x2-3)
Data structures and algorithms at a moderate bar.
3
Design
System or component design scaled to your level.
4
As Appropriate (AA)
Senior cross-check on bar, plus team and culture fit.
What Microsoft looks for
What they value
Clear thinking and steady communication over flash
Willingness to learn from mistakes openly
Solid fundamentals plus customer awareness
Culture signals
Growth Mindset: learn-it-all over know-it-all
Collaboration across teams and boundaries
Empathy for customers and teammates
Interview questions
DevOps engineer questions worth preparing alongside the Microsoft rounds described above, drawn from our devops engineer question bank.
As asked
A new Deployment rollout is stuck at 3 out of 10 pods Ready. Walk me through how you would debug it in production.
Sample answer outline
Start with kubectl rollout status and kubectl describe deployment. Look at the events: ImagePullBackOff, CrashLoopBackOff, FailedScheduling all point in different directions. Check pod events and pod logs for the failing replicas. Common causes: readiness probe failing because the app needs longer to start, resource requests too high for the available nodes, a config map or secret reference that does not exist, or a PodDisruptionBudget blocking eviction of old pods. Resist the urge to delete pods until you know the cause.
Reference implementation (bash)
Bash
# Triage sequencekubectl rollout status deployment/api -n prodkubectl describe deployment/api -n prodkubectl get pods -n prod -l app=apikubectl describe pod <pending-pod> -n prodkubectl logs <crashlooping-pod> -n prod --previouskubectl get events -n prod --sort-by=.lastTimestamp | tail -20
Expect these follow-ups
What if the readiness probe passes but the service is still returning 503s?
How do you set sane defaults for readiness and liveness probes?
When would you use a startup probe?
kubernetesdebuggingrollout
As asked
Tell me about the worst on-call shift you have personally had. What broke, what did you do in the moment, and what changed afterwards?
Sample answer outline
Pick a real story with measurable user impact. Cover detection (was it self-detected or customer-reported), the diagnosis path (especially the dead ends), the mitigation, and the postmortem actions that actually landed. Interviewers are listening for ownership without blame, calm under pressure, and process changes that prevent the next one. Avoid 'we just restarted it' answers, dig into the root cause.
Expect these follow-ups
What did the postmortem find as the contributing factors?
Did the action items actually ship, or did they slip?
What would you do differently in the first 10 minutes if it happened again?
incidentson-callpostmortem
As asked
An engineer commits an AWS access key to a public GitHub repo. Walk me through what you do in the next hour.
Sample answer outline
Treat the key as compromised. Rotate immediately, do not wait. Revoke the old key, generate a new one, push it via the secret manager so dependent services pick it up. Check CloudTrail for any usage of the key in the window between commit and rotation, especially from unfamiliar IPs. Remove the key from history (git filter-repo or BFG) but understand that GitHub may have already cached it and bots scrape new commits within seconds, so rotation is what matters, not rewriting history. Talk to the engineer without blame, and add pre-commit hooks (gitleaks, trufflehog) so it does not happen again.
Expect these follow-ups
Why is rewriting history less important than rotating?
How would you scan all current repos for past leaks?
What is your policy for repeat offenders?
secretsincident-responsegit
As asked
Tell me about the biggest incident you handled that lived in the platform layer: a broken deploy pipeline, an infrastructure change gone wrong, a certificate expiry, or a cluster failure. Walk me through detection, mitigation, and what changed in the platform afterwards.
Sample answer outline
Frame it through a platform lens, where the blast radius is every team that depends on you. Describe the impact across consumers, not just one service. Detection: what alerted you, and whether it was your monitoring or a downstream team that noticed first. Mitigation: the rollback or break-glass procedure, and whether it existed before the incident or had to be improvised. The strong answer ends with platform-level prevention: a guardrail in the pipeline, a pre-deploy check, an expiry alert, automated rollback. Interviewers listen for ownership of shared infrastructure and the discipline to turn one painful event into a control that protects every team.
Expect these follow-ups
Did a self-service guardrail exist, or did you have to build one after?
How did you communicate with the many teams affected at once?
What pipeline or infrastructure check would have caught this earlier?
incidentsplatformpipelinesownership
As asked
Two engineers run terraform apply at the same time against the same workspace. What happens with state locking, what backend are you using, and what do you do if a lock is stuck after a failed apply?
Sample answer outline
Strong answers explain that backends like S3 with DynamoDB or Terraform Cloud implement state locking via DynamoDB conditional writes. The candidate should describe the lock record format, how to use terraform force-unlock with the lock ID found in the error output, and why force-unlocking without confirming no apply is running can corrupt state. Good answers also mention remote backends vs local and the risk of partial state writes.
Expect these follow-ups
What does a corrupted terraform state file look like and how do you recover from it?
How would you structure workspaces and state files for a multi-environment setup?
terraformstatelockings3dynamodb
As asked
How do you inject secrets into a GitHub Actions pipeline without exposing them in logs or baking them into container images? Walk me through your approach from secret storage to the running container.
Sample answer outline
Strong answers cover GitHub Actions encrypted secrets or OIDC-based short-lived credentials to pull from AWS Secrets Manager or HashiCorp Vault at runtime. The candidate should explain why secrets must not be printed with echo, that GitHub masks registered secrets in logs but this can be defeated with base64 encoding, and how to use build-time ARGs versus runtime ENV correctly to avoid baking secrets into image layers. Mention secret scanning tools like truffleHog or GitGuardian as a defense layer.
Expect these follow-ups
How do you rotate a secret that is already in use by a running Kubernetes deployment?
What is OIDC federation and why is it preferable to long-lived AWS IAM access keys in CI?
secretsgithub-actionsvaultoidcsecurity
DevOps engineer interview detail at Microsoft
How the Microsoft loop applies to DevOps engineer candidates
Microsoft is a big-tech employer headquartered in Redmond, and the same 4-stage process described above is what a devops engineer candidate walks through, with the technical stages tuned to the infrastructure discipline. Microsoft typically runs four to five onsite rounds split between coding, design, and behavioural, with formats varying by org. A senior interviewer known as the As Appropriate, or AA, joins near the end and acts as the team's final sign-off. The behavioural thread leans heavily on the Growth Mindset framing the company promotes.
For a devops engineer, the load concentrates on coding rounds (x2-3) and design. Those are the stages where the infrastructure signal is read most closely, so they are where preparation pays off most. The non-technical stages (recruiter screen and as appropriate (aa)) still gate the offer, but they assess fit and communication rather than role-specific depth.
What the devops engineer question mix signals
The 6 most-reported devops engineer questions cluster around role-specific (4), behavioral (2). That distribution is the clearest read on what Microsoft actually probes for this role: the more a topic recurs, the more reliably it shows up in the loop, so it is worth weighting practice the same way.
The set spans a easy-to-medium difficulty range, topping out at medium problems. Because the topics are concentrated rather than scattered, depth in the leading area matters more than breadth for this particular role.
What moves a devops engineer offer forward at Microsoft
Across the loop, the traits that consistently move a Microsoft devops engineer offer forward are clear thinking and steady communication over flash, willingness to learn from mistakes openly, and solid fundamentals plus customer awareness. These are not abstract values; interviewers score against them, so a devops engineer who demonstrates them explicitly - naming the tradeoff, stating the assumption, checking the edge case out loud - reads stronger than one who only reaches the right answer silently.
The behavioural and culture stages are checking for growth mindset: learn-it-all over know-it-all, collaboration across teams and boundaries, and empathy for customers and teammates. For a devops engineer, the most credible way to show these is through specific, recent examples from real infrastructure work rather than rehearsed generalities.
How to read the devops engineer salary band
The salary signal shown for this role is the approximate senior median of $291,000 in San Francisco, reported as total compensation including bonus and equity and modelled from BLS, ONS, and Levels.fyi reference medians. It is a market band for the devops engineer role and city, not a Microsoft offer.
San Francisco carries a cost-of-living index of 112 on the scale where New York City equals 100, so read the headline figure alongside that index when comparing it with another market. Individual pay at Microsoft varies by level, team, equity refresh, and negotiation, which the open salary breakdown for this role lays out city by city.