A comprehensive, community-driven study guide for the Microsoft Azure Administrator Associate (AZ-104) certification exam.
| Detail | Info |
|---|---|
| Exam Code | AZ-104 |
| Duration | 120 minutes |
| Questions | 40-60 questions |
| Passing Score | 700 / 1000 |
| Cost | $165 USD |
| Format | Multiple choice, drag-and-drop, case studies |
| Domain | Weight |
|---|---|
| 1. Manage Azure Identities and Governance | 15-20% |
| 2. Implement and Manage Storage | 15-20% |
| 3. Deploy and Manage Azure Compute Resources | 20-25% |
| 4. Implement and Manage Virtual Networking | 15-20% |
| 5. Monitor and Maintain Azure Resources | 10-15% |
- Azure AD (Entra ID) — Users, Groups, RBAC
- Subscriptions, Management Groups, Resource Groups
- Azure Policy, Blueprints, Resource Locks
- Cost Management, Tagging strategies
- Storage Accounts — Blob, File, Table, Queue
- Blob access tiers (Hot, Cool, Archive)
- Azure Files, Azure File Sync
- Storage redundancy (LRS, ZRS, GRS, RA-GRS)
- AzCopy, Storage Explorer, Import/Export
- Virtual Machines — sizing, availability sets, scale sets
- Azure App Service — Web Apps, deployment slots
- Azure Container Instances (ACI)
- Azure Kubernetes Service (AKS) basics
- ARM templates, Bicep, Azure CLI, PowerShell
- Virtual Networks, Subnets, NSGs, ASGs
- VNet Peering, VPN Gateway, ExpressRoute
- Azure Load Balancer, Application Gateway
- Azure DNS, Private DNS, Azure Firewall
- Network Watcher, IP flow verify, NSG diagnostics
- Azure Monitor — Metrics, Logs, Alerts
- Log Analytics, KQL queries
- Azure Backup, Recovery Services vault
- Azure Site Recovery (ASR)
- Full-length practice exams
- Review weak areas
- Hands-on labs in Azure Portal
- Entra ID (Azure AD): Cloud identity service, SSO, MFA
- RBAC: Owner > Contributor > Reader. Scope: Management Group > Subscription > Resource Group > Resource
- Azure Policy: Enforce rules (e.g., "only allow certain VM sizes")
- Resource Locks: CanNotDelete or ReadOnly — prevents accidental changes
- Blob Types: Block (files), Page (VHDs), Append (logs)
- Access Tiers: Hot (frequent), Cool (30-day min), Archive (180-day min)
- Redundancy: LRS (3 copies, 1 datacenter), ZRS (3 AZs), GRS (2 regions)
- SAS Tokens: Delegated access with time limits and permissions
- VM Availability Sets: Fault Domains (rack) + Update Domains (maintenance)
- VMSS: Auto-scale VMs based on metrics or schedule
- App Service Plans: Free, Shared, Basic, Standard, Premium, Isolated
- Deployment Slots: Staging → Swap → Production (zero downtime)
- NSG Rules: Priority (100-4096), lower = higher priority
- VNet Peering: Non-transitive! A↔B and B↔C ≠ A↔C
- Load Balancer: Layer 4 (TCP/UDP). App Gateway: Layer 7 (HTTP/HTTPS)
- VPN Gateway: Site-to-Site (IPsec), Point-to-Site (client VPN)
- ExpressRoute: Private connection, not over internet
- Azure Monitor: Metrics (numeric time-series) + Logs (structured, KQL)
- Action Groups: Notifications + actions when alert fires
- Backup: MARS agent (files), Azure Backup (VMs), soft delete (14 days)
- ExamCert — Free AZ-104 Practice Tests — 800+ questions with detailed explanations, free to try
- Microsoft Official Practice Assessment
- Know Azure CLI AND PowerShell — Questions test both
- Understand NSG rule evaluation order — lowest priority number wins
- RBAC inheritance — Permissions flow downward through scope hierarchy
- Storage redundancy — Know when to use LRS vs ZRS vs GRS vs RA-GRS
- Hands-on practice is essential — Use Azure free account ($200 credit)
PRs welcome! Help us keep this guide up-to-date.
MIT License
Good luck with your AZ-104 exam! 🚀
Need more practice? Try ExamCert — free IT certification practice tests for 30+ exams including AZ-104.