AZ-104 Cheat Sheet
Azure Administrator Associate — Quick reference for the exam
CLI Commands
47az ad user create --display-name <nombre> --password <pass> --user-principal-name <upn>TOPCreate a user in Entra ID
az ad user list --output tableList Entra ID users
az ad group create --display-name <nombre> --mail-nickname <nick>TOPCreate a security group
az ad group member add --group <id> --member-id <uid>Add a member to a group
az role assignment create --assignee <upn> --role <rol> --scope <scope>TOPAssign an RBAC role to a user
az role assignment list --assignee <upn>View a user's role assignments
az role definition list --query "[].roleName" -o tsvList available RBAC roles
Comparisons
6| Role | Manage Resources | Assign Roles | View Costs | Typical Scope |
|---|---|---|---|---|
| Owner | Yes | Yes | Yes | Subscription |
| Contributor | Yes | No | Yes | RG or resource |
| Reader | No | No | Yes | RG or resource |
| User Access Admin | No | Yes | No | Subscription |
| Virtual Machine Contributor | VMs only | No | No | RG |
| Storage Blob Data Contributor | Blobs only | No | No | Storage |
Quick Reference
36RBAC and Permissions
Management Group > Subscription > Resource Group > Resource
Roles inherit downward. Owner at sub level = Owner in all RGs
Block specific actions even if the role allows them
Privileged Identity Management — just-in-time role activation
Entra ID roles = tenant management. RBAC = Azure resource management
4000 per subscription
VM — Key Facts
Fault Domains = physical racks (max 3). Protects against rack failure
Update Domains = update groups (max 20)
The only way to stop paying for compute. Stop without deallocate still bills
Microsoft manages the underlying Storage Accounts
Up to 90% discount. Can be evicted with 30 sec notice
Use your own Windows/SQL licenses in Azure to reduce cost
Networking — Key Facts
Lower number = higher priority. Range: 100–4096
Implicit DenyAllInBound at the end. AllowAzureLoadBalancer and AllowVNetInBound are default rules
NOT transitive. A↔B, B↔C does not mean A↔C. Use a VPN Hub or Firewall
Overrides system routes to force traffic through an NVA or Firewall
Private IP for a PaaS service inside the VNet (no internet)
Optimized route to PaaS over the Azure backbone. IP is still public
Storage — Key Facts
StorageV2 (general), BlobStorage, BlockBlobStorage, FileStorage
Retention for deleted blobs/containers (1-365 days)
Automatically move blobs between tiers based on rules
Shared Access Signature — temporary, granular access without credentials
Prefer Azure AD (RBAC) over account keys for security
Moving from Archive to Hot/Cool: Standard (15h) or High Priority (1h)
Monitoring and Diagnostics
Central hub for metrics, logs, and alerts across all resources
KQL queries over logs. Workspace centralizes logs from multiple resources
APM: traces, dependencies, exceptions for apps
Send logs/metrics to Log Analytics, Storage, or Event Hub
Record of control-plane operations (who did what and when)
Activity Log: 90 days. Log Analytics: 30 days (configurable up to 730)
Governance
Deny, Audit, Modify, DeployIfNotExists, AuditIfNotExists, Disabled
Policy = WHAT resource. RBAC = WHO can do what
Group subscriptions. Up to 6 levels + root. Inherit Policy and RBAC
Package ARM + Policy + RBAC for reproducible environments
No one can modify the resource, not even Owner. Only delete/read
Cost analysis, budgets, and spending alerts by scope
Ready to practice?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan