Microsoft Certified auto_stories Free Compressed Course : 20% preview

AZ-104 Azure Administrator Associate Certification Course

bolt Everything you need to pass : in one free course.

73 expert modules derived from 50+ exam-style questions. Covers every domain and scenario : organized by blueprint weight so you study what matters most.

Full access from $ 29 One-time · No subscription

play_arrow Start Learning Free payments See Plans

check_circle 13 of 73 modules free · No account needed

Modules

50+

Questions

star star star star star

4.9/5

description Also available: 3-Page Cheat Sheet by Experts

200+ Microsoft Certified 93% First-Attempt Pass Rate 4.9/5 Rating

About This Course

AZ-104 Azure Administrator Associate · 73 modules

This course covers every domain tested on the AZ-104 Azure Administrator Associate exam. Based on our 50+ real practice questions and prepared by certification experts.

info What you'll learn:

Every exam domain with detailed explanations
Common exam traps that catch unprepared candidates
Key concepts, syntax, and configurations
Real-world scenarios aligned with exam objectives
Quick-reference cheat sheets for last-minute review

Your AZ-104 Azure Administrator Associate Roadmap

AZ-104 Azure Administrator Associate certification preparation infographic

You're viewing 13 of 73 free modules

The remaining 60 modules cover advanced topics, exam traps, and scenarios that appear on the certification exam.

Unlock All : $ 29

Compressed Complete Study Guide

Exam: AZ-104: Microsoft Azure Administrator
Certification: Microsoft Certified: Azure Administrator Associate
Blueprint version used: Skills measured as of April 17, 2026
Purpose: A practical, scenario-focused course for rapid learning, realistic revision, and exam-day decision making.

Exam Overview
Exam Domains
Start-to-Finish Study Path
Core Concepts by Domain
Service Selection Guide
Architecture Patterns
Exam Traps
Quick Memory Rules
Final Revision Notes
Exam-Day Checklist

1. Exam Overview

AZ-104 tests whether you can operate an Azure environment safely and efficiently. It is not mainly a memorization exam. Most scenarios ask you to choose the most appropriate administrative action while balancing:

Least privilege
Minimum operational effort
Scope
Availability
Security
Recoverability
Cost
Troubleshooting efficiency

A passing score is 700 or greater. Microsoft periodically updates the exam. This guide follows the skills measured as of April 17, 2026.

What an Azure administrator is expected to manage

You should be comfortable administering:

Microsoft Entra users, groups, licenses, and external identities
Azure role-based access control (Azure RBAC)
Subscriptions, management groups, policies, locks, tags, budgets, and Advisor recommendations
Azure Storage accounts, blobs, Azure Files, access controls, replication, tiers, and recovery controls
Azure virtual machines, disks, availability, scale sets, templates, and Bicep
Azure Container Registry, Azure Container Instances, and Azure Container Apps
Azure App Service plans, apps, TLS, DNS, deployment slots, backups, networking, and scaling
Virtual networks, subnets, peering, routes, NSGs, Bastion, private endpoints, service endpoints, DNS, and load balancers
Azure Monitor, Log Analytics, alerts, Network Watcher, Backup, and Site Recovery

The core AZ-104 mindset

When a scenario gives several valid-looking options, ask:

What exact requirement is being tested?
Is the requirement about management-plane control, data-plane access, routing, filtering, monitoring, availability, or recovery?
What is the smallest scope that meets the requirement?
Does the chosen feature solve the requirement directly, or is it only related?
Is there an Azure-native feature that avoids a manual workaround?

A common exam pattern is to offer a distractor that is technically useful but solves the wrong layer of the problem.

2. Exam Domains

Domain	Official Weight	Study Priority	Main Question Style
Manage Azure identities and governance	20–25%	Very high	Scope, roles, policy, locks, costs
Implement and manage storage	15–20%	High	Access, redundancy, data protection, tiering
Deploy and manage Azure compute resources	20–25%	Very high	Deployment, availability, scaling, App Service, containers
Implement and manage virtual networking	15–20%	High	Routing, filtering, private access, DNS, load balancing
Monitor and maintain Azure resources	10–15%	High	Logs, alerts, insights, Backup, Site Recovery

Suggested effort allocation

Because the official weights are ranges, use this revision split:

Domain	Recommended Revision Time
Identities and governance	24%
Storage	18%
Compute	25%
Networking	19%
Monitoring and recovery	14%

Highest-value cross-domain themes

These themes appear repeatedly because they connect multiple domains:

Scope inheritance: tenant, management group, subscription, resource group, resource
Least privilege: choose the smallest role and smallest scope
Private access: private endpoint versus service endpoint
Traffic flow: DNS → route → NSG → load balancer → backend health
Availability: availability zones, availability sets, scale sets, backups, and Site Recovery solve different problems
Recoverability: soft delete, versioning, snapshots, Backup, and Site Recovery are not interchangeable
Automation: prefer ARM templates or Bicep for repeatable deployments
Monitoring pipeline: collect → query → evaluate → notify

3. Start-to-Finish Study Path

Phase 1 : Build the Azure mental model

Learn the basic Azure hierarchy first:

Microsoft Entra tenant
└── Management groups
    └── Subscriptions
        └── Resource groups
            └── Resources

Then separate two types of access:

Access Type	Meaning	Examples
Management plane	Manage the Azure resource configuration	Create a VM, change an NSG, assign a policy
Data plane	Access the data inside a service	Read blobs, upload files, query stored data

This distinction eliminates many wrong answers. For example, Reader can view a storage account configuration but does not automatically grant permission to read blobs.

Phase 2 : Master service selection

Build quick decision rules:

Need to prevent a deployment? Azure Policy
Need to stop accidental deletion? CanNotDelete lock
Need to block changes and deletion? ReadOnly lock
Need time-limited delegated storage access? SAS
Need storage access through a private IP? Private endpoint
Need selected subnet access while using a public PaaS endpoint? Service endpoint
Need secure RDP or SSH without VM public IP addresses? Azure Bastion
Need multiple identical VMs with autoscale? Virtual Machine Scale Sets
Need revisions and scale-to-zero for containerized microservices? Azure Container Apps
Need simple fast serverless container execution? Azure Container Instances
Need logs sent to Log Analytics? Diagnostic settings
Need threshold-based notification? Alert rule + action group
Need regional disaster recovery orchestration? Azure Site Recovery

Phase 3 : Learn the major comparison tables

Spend time on the comparisons that generate the most exam traps:

Azure RBAC versus Azure Policy versus locks
Availability zones versus availability sets versus backups versus Site Recovery
Private endpoints versus service endpoints
Blob soft delete versus container soft delete versus blob versioning versus snapshots
Azure Container Instances versus Azure Container Apps versus Virtual Machine Scale Sets versus App Service
Metrics versus logs versus Activity Log
Recovery Services vault versus Backup vault

Phase 4 : Practice layered troubleshooting

For network failures, use this sequence:

Name resolution
→ Route selection
→ NSG filtering
→ Public/private endpoint design
→ Load balancer probe
→ Backend application state

For monitoring failures, use:

Telemetry source
→ Diagnostic setting or agent
→ Workspace destination
→ KQL query
→ Alert rule
→ Action group
→ Alert processing rule

For access failures, use:

Identity
→ Group membership
→ Role
→ Scope
→ Inheritance
→ Data-plane permission
→ Network restriction

Phase 5 : Final revision

Before the exam:

Re-read the quick memory rules
Rebuild each architecture pattern from memory
Practice explaining why the strongest distractor is wrong
Review high-value traps
Use the exam sandbox to understand the interface

4. Core Concepts by Domain

Domain 1 : Manage Azure Identities and Governance

4.1 Microsoft Entra users and groups

Microsoft Entra ID manages identities used across Azure.

User types

User Type	Use Case
Member user	Internal workforce identity
Guest user	External collaborator using an external identity
Cloud-only user	Identity created directly in Microsoft Entra ID
Synchronized user	Identity synchronized from an external directory

Groups

Group Type	Best Use
Security group	Assign permissions, licenses, or access
Microsoft 365 group	Collaboration scenarios
Assigned membership	Manually maintained membership
Dynamic user membership	Automatically include users based on attributes
Dynamic device membership	Automatically include devices based on attributes

Decision rule

When the question says:

Membership must update automatically when the user's department changes.

Choose:

A dynamic Microsoft Entra security group with a membership rule based on the department attribute.

Do not choose an assigned group. Assigned membership requires manual maintenance.

Group-based licensing

Group-based licensing applies licenses to members of a Microsoft Entra group. If assignment fails:

Review license assignment errors.
Identify conflicting service plans or missing prerequisites.
Resolve the license issue.
Reprocess the assignment.

Do not confuse Azure resource roles with Microsoft Entra license management.

External users

Use Microsoft Entra B2B guest invitations when external partners should authenticate with their existing organizational identities.

Avoid:

Sharing one internal account
Sending passwords manually
Creating unnecessary cloud-only member users for partners

Self-service password reset

Use SSPR when users must reset their own passwords.

Key exam clue:

Enable the feature for a pilot group only.

Answer:

Enable SSPR for selected users and choose the pilot group.

4.2 Azure RBAC

Azure RBAC controls who can perform actions on Azure resources.

Role assignment model

Security principal + Role definition + Scope

Component	Meaning
Security principal	User, group, service principal, or managed identity
Role definition	Allowed actions
Scope	Where the permissions apply

Scope hierarchy

Management group
→ Subscription
→ Resource group
→ Resource

Permissions inherit downward. Prefer the smallest scope that meets the requirement.

Important built-in roles

Role	What It Allows	Common Trap
Reader	View Azure resources	Does not modify resources
Contributor	Create and manage resources	Cannot manage role assignments by default
Owner	Full management plus role assignment control	Usually broader than necessary
User Access Administrator	Manage access assignments	Does not provide general resource modification
Virtual Machine Contributor	Manage VMs	Does not grant broad subscription management
Storage Blob Data Reader	Read blob data	Data-plane role
Storage Blob Data Contributor	Read, write, and delete blob data	Data-plane role

Additive permissions

Azure RBAC assignments are additive.

Example:

Reader at subscription scope
Contributor at resource-group scope

Result:

Contributor within that resource group
Reader elsewhere in the subscription

The Reader role does not override Contributor.

Least-privilege pattern

Question:

A developer must upload blobs to one storage account only.

Best answer:

Assign Storage Blob Data Contributor at the storage-account scope.

Wrong answer:

Assign Contributor at subscription scope.

Why wrong:

Contributor is broader
Subscription scope affects unrelated resources
A management-plane role may not be the best fit for blob data access

4.3 Azure Policy, locks, and tags

These are frequently confused.

Feature	Purpose	Example
Azure Policy	Enforce or audit configuration rules	Deny resources outside approved regions
Resource lock	Protect resources from accidental changes or deletion	Prevent deletion of a production database
Tag	Add metadata for organization and cost analysis	Owner=Finance
Azure RBAC	Control who can perform actions	Grant VM restart permissions

Azure Policy

Use Azure Policy to:

Deny unsupported regions
Require tags
Audit configurations
Deploy required settings when missing
Modify supported properties
Apply governance at scale

Policy effects

Effect	Typical Use
Deny	Block noncompliant deployment
Audit	Report noncompliance
Append	Add supported fields
Modify	Adjust supported fields
DeployIfNotExists	Deploy a related configuration when missing
AuditIfNotExists	Report when related configuration is missing

Remediation

A DeployIfNotExists or Modify policy may need a remediation task for existing resources.

Decision rule:

New deployments are corrected, but existing resources remain noncompliant.

Choose:

Create a remediation task.

Policy initiatives

An initiative groups related policy definitions.

Use an initiative when several policies should be managed together, such as:

Allowed locations
Required tags
Diagnostic settings
Encryption controls

Policy exclusions and exemptions

Option	Best Use
Excluded scope	Do not evaluate a child scope under the assignment
Policy exemption	Document an approved exception while preserving the broader assignment

Resource locks

Lock	Prevents Deletion	Prevents Modification
CanNotDelete	Yes	No
ReadOnly	Yes	Yes

Memory rule:

Protect from deletion only: CanNotDelete
Freeze configuration: ReadOnly

Tags

Use tags for:

Cost allocation
Ownership
Environment labeling
Operational grouping
Reporting

Examples:

Environment=Production
Owner=Finance
Application=Billing
CostCenter=CC-2040

Do not treat tags as security boundaries. Tags do not isolate resources or enforce network access.

lock

4.4 Resource groups, subscriptions, and management groups

This module is part of the full course. Unlock all 73 modules + 50+ practice questions.