Microsoft Azure Administrator (AZ-104)

The exam at a glance

AZ-104 uses Microsoft's standard associate format: a scaled score with 700 required to pass, a mix of question types that can include multiple choice, drag-and-drop ordering, hot-area and build-list items, case studies with a shared scenario, and possibly performance-based labs in a live Azure environment. Question counts and time vary by form; plan for roughly 40 to 60 items over about 100 minutes and read the exam page for the current figures. The certification renews annually through a free online assessment on Microsoft Learn, which is easier than re-sitting the exam. Microsoft offers a free practice assessment for AZ-104; use it early to see the style.

Identities and governance (20–25%)

Microsoft Entra ID is the identity plane: create and manage users and groups (assigned versus dynamic membership), manage licences and external (guest) users, and configure self-service password reset. Azure RBAC controls what identities can do with resources: built-in roles (Owner, Contributor, Reader, and service-specific ones), assigned at a scope — management group, subscription, resource group or resource — and inherited downward. Questions ask you to interpret effective access: a Reader at subscription scope plus Contributor on one resource group means Contributor there and Reader elsewhere; a deny assignment or a missing data-plane role explains why a user with Owner still cannot read blobs (they need Storage Blob Data Reader for identity-based data access).

Governance is Azure Policy (definitions, initiatives, assignments at scope, effects such as Deny, Audit, DeployIfNotExists, remediation tasks), resource locks (CanNotDelete, ReadOnly, inherited by children, blocking even Owners until removed), tags (not inherited by default; enforce with Policy), resource groups (a resource lives in exactly one; moving between groups or subscriptions has service-specific restrictions), and management groups to organise subscriptions for Policy and RBAC. Cost questions cover budgets and alerts, Cost Management analysis by tag, and Azure Advisor's cost recommendations.

# Contributor on one resource group only
az role assignment create --assignee alice@acme.example --role "Contributor" \
  --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-app

# deny resources outside allowed regions across the whole subscription
az policy assignment create --name allowed-locations --display-name "Allowed locations" \
  --policy "e56962a6-4747-49cd-b67b-bf8b01975c4c" \
  --scope /subscriptions/00000000-0000-0000-0000-000000000000 \
  --params '{"listOfAllowedLocations": {"value": ["westeurope", "northeurope"]}}'

# nobody deletes the production resource group, Owners included, until the lock is removed
az lock create --name no-delete --lock-type CanNotDelete --resource-group rg-prod

Storage (15–20%)

Storage accounts hold Blob, Files, Queue and Table services; know the account kinds and performance tiers (Standard general-purpose v2 for most, Premium for low latency), and the redundancy options and what each survives: LRS (three copies, one data centre), ZRS (three AZs), GRS and GZRS (plus a paired region, asynchronous), and the RA- variants that allow reading from the secondary. Access questions distinguish account keys (full access, rotate them), shared access signatures (scoped, time-limited; account, service or user-delegation SAS; stored access policies to revoke), identity-based access with RBAC data roles, and the storage firewall with virtual network rules, private endpoints and the "allow trusted Microsoft services" exception. Azure Files supports identity-based SMB access through Entra Domain Services or on-premises AD.

Blob features: access tiers (Hot, Cool, Cold, Archive; archive must be rehydrated before reading), lifecycle management rules that tier or delete by age or last access, soft delete for blobs and containers, versioning, snapshots, immutability policies, and object replication between accounts. Azure Files: SMB and NFS shares, snapshots and soft delete, Azure File Sync for caching on Windows servers. Tools: Storage Explorer for interactive work and AzCopy for bulk copies (azcopy copy with SAS or login, azcopy sync for incremental).

Compute (20–25%)

Infrastructure as code appears as reading and modifying ARM templates and Bicep files: parameters, variables, resources, outputs, dependencies, and deploying with az deployment group create; exporting a deployment as a template; converting ARM to Bicep with az bicep decompile. Virtual machines: sizes and resizing (some require deallocation), disk types (Standard HDD/SSD, Premium SSD, Ultra) and adding data disks, encryption at host, moving VMs between resource groups, subscriptions or regions, and availability: availability sets (fault and update domains in one data centre) versus availability zones (separate data centres, higher SLA) and Virtual Machine Scale Sets with autoscale rules and flexible orchestration.

Containers: Azure Container Registry for images (SKUs, geo-replication in Premium, tasks), Azure Container Instances for single containers or groups without orchestration, and Azure Container Apps for scaled, event-driven containers with revisions and scaling rules (including scale to zero). App Service: plans decide the compute and features (tiers, scaling, deployment slots need Standard or higher), apps get custom domains with TLS certificates (managed or uploaded), backups, networking (VNet integration for outbound, private endpoints for inbound, access restrictions), and deployment slots with swap for zero-downtime releases.

param location string = resourceGroup().location
param vmName string

resource nic 'Microsoft.Network/networkInterfaces@2023-11-01' = {
  name: '${vmName}-nic'
  location: location
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet-app', 'snet-web') }
          privateIPAllocationMethod: 'Dynamic'
        }
      }
    ]
  }
}

resource vm 'Microsoft.Compute/virtualMachines@2024-07-01' = {
  name: vmName
  location: location
  zones: ['1']
  properties: {
    hardwareProfile: { vmSize: 'Standard_D2s_v5' }
    networkProfile: { networkInterfaces: [{ id: nic.id }] }   // implicit dependency on nic
    // osProfile and storageProfile omitted for brevity
  }
}

output vmId string = vm.id

Networking (15–20%)

Virtual networks and subnets, address spaces that must not overlap for peering (regional or global, non-transitive: A–B and B–C does not give A–C without a hub or gateway transit), public IP addresses (Basic versus Standard SKU, static versus dynamic), and user-defined routes to send traffic through a firewall or virtual appliance (route table on the subnet, next hop types). Network security groups are stateful rule sets evaluated by priority (lower number first, first match wins, default rules at the end) applied to subnets and/or NICs — both apply, and the exam asks you to work out the effective rule; application security groups let rules target groups of NICs by role instead of IP. Azure Bastion gives browser-based RDP/SSH without public IPs on VMs. Service endpoints extend a VNet identity to a PaaS service over the Microsoft backbone; private endpoints put a private IP for the PaaS resource inside your VNet (with a private DNS zone) and are the answer when public access must be disabled entirely.

Name resolution and load balancing: Azure DNS public zones and private zones linked to VNets (with auto-registration), Azure-provided resolution by default; Load Balancer (Layer 4, public or internal, Standard SKU, health probes, backend pools, inbound NAT rules) versus Application Gateway (Layer 7, WAF, path-based routing) versus Front Door (global HTTP) versus Traffic Manager (DNS-based). Troubleshooting questions expect Network Watcher tools: IP flow verify, effective security rules, next hop, connection troubleshoot and Connection Monitor.

az network nic list-effective-nsg --name vm-web-nic --resource-group rg-app --output table

az network watcher test-ip-flow --resource-group rg-app --vm vm-web \
  --direction Inbound --protocol TCP --local 10.0.1.4:443 --remote 203.0.113.9:50000
# Access: Allow / Deny, and the rule name that decided it

Monitoring, backup, and the six-week plan

Azure Monitor: platform metrics versus logs, diagnostic settings that send resource logs to a Log Analytics workspace, storage or Event Hubs; Kusto queries in Log Analytics (AzureActivity, Heartbeat, Perf, AzureDiagnostics); alert rules (metric, log, activity log) with action groups (email, SMS, webhook, runbook, ITSM) and alert processing rules to suppress or route; VM Insights, Storage Insights and Network Insights; Network Watcher and Connection Monitor for network health. Backup: Recovery Services vaults (VMs, Files, SQL in VMs) and Backup vaults (blobs, disks, database services), backup policies with schedules and retention, restore options (full VM, disks, file-level), soft delete on the vault, and reports and alerts. Site Recovery replicates VMs to a secondary region with recovery plans, test failovers and real failovers.

Use the free Microsoft Learn learning paths for AZ-104 (they map to the skills measured), the free practice assessment, and the exam sandbox to see the question formats before test day. Labs in a pay-as-you-go subscription with a budget alert cost little if you delete resource groups as you finish. On the day: case studies are worth reading carefully once, then answering all their questions; lab items are scored on end state, so it does not matter whether you use portal, CLI or PowerShell — use what you practised.