Complete guide
AZ-104 Azure Administrator
Tap any service to see more details and official docs.
Exam breakdown
40–60
Questions
~55
Min read
700
Passing score
Identity & governance
20–25% of the examMicrosoft Entra ID — identity management
The identity pillar in Azure. Manages users, groups, roles, and application access. In AZ-104 the focus is on administration: creating users, assigning groups, configuring MFA, and managing enterprise applications.
Users
Individual accounts — member or guest
Groups
Security groups and Microsoft 365 groups
Roles
Built-in and custom for RBAC
Tenant
One Entra ID instance per organization
B2B
Invite external users as guests
Device mgmt
Register and manage devices
RBAC and access control
Click any service to see more details
| Role | Permissions | Can assign roles |
|---|---|---|
| Owner | Full control over resources and permissions | ✅ Yes |
| Contributor | Full control over resources | ❌ No |
| Reader | Read only | ❌ No |
| User Access Admin | Assign roles only | ✅ Yes |
Azure Policy and governance
Azure Policy enforces compliance rules on resources. It's essential for ensuring the whole organization follows configuration standards.
| Effect | What it does |
|---|---|
| Deny | Blocks creation/modification if it doesn't comply |
| Audit | Allows it but logs the non-compliance |
| Append | Adds extra fields to the resource |
| DeployIfNotExists | Deploys resources if they don't exist |
| Modify | Adds or modifies tags and properties |
On the AZ-104 exam: Owner can assign roles, Contributor cannot. RBAC is additive — if you have two assignments granting different permissions, they accumulate.
Storage
15–20% of the examStorage Accounts and redundancy
Click any service to see more details
Redundancy options
Locally Redundant
3 copies in the same datacenter
Zone Redundant
3 copies across different zones
Geo Redundant
LRS + replica in a secondary region
Geo-Zone Redundant
ZRS + replica in a secondary region
Access and security in Storage
| Access method | Description | Use case |
|---|---|---|
| Access Keys | Master keys for the account | Internal administrative access |
| SAS (Shared Access) | Token with permissions and expiry | Temporary access for clients |
| Azure AD / RBAC | Identities with roles | Apps and users in the organization |
| Anonymous access | No authentication | Public content (images, blobs) |
Access Keys grant FULL access to the storage account. For granular access use SAS tokens or Azure RBAC. Store keys in Azure Key Vault, never in code.
Compute
20–25% of the examAdvanced Virtual Machines
Click any service to see more details
High availability for VMs
🔄 Availability Sets
Protects against hardware failures within a datacenter. Uses fault domains (racks) and update domains (patching).
📈 Scale Sets
A group of identical VMs with autoscaling. Can scale from 0 to 1000 instances automatically.
🏙️ Availability Zones
Deploys VMs across physically separate zones within a region. 99.99% SLA.
🔒 Azure Bastion
RDP/SSH access from the portal with no public IPs. Removes the attack surface of VMs.
Availability Sets vs Availability Zones: Availability Sets protect within a datacenter. Availability Zones protect against the failure of an entire datacenter within the region.
Virtual networking
15–20% of the examAdvanced VNet and connectivity
Click any service to see more details
Interactive diagram — real traffic distributed by the Load Balancer across backends. Hover over each node for more info.
NSG — Network Security Groups
NSGs are subnet/NIC firewalls with numerically prioritized rules. Lower number = higher priority. Default rules allow traffic within the VNet and block everything else.
| Direction | Default priority | Rule |
|---|---|---|
| Inbound | 65000 | AllowVnetInBound — allows traffic within the VNet |
| Inbound | 65001 | AllowAzureLoadBalancerInBound — allows health probes |
| Inbound | 65500 | DenyAllInBound — blocks everything else |
| Outbound | 65000 | AllowVnetOutBound — allows outbound traffic within the VNet |
| Outbound | 65001 | AllowInternetOutBound — allows outbound traffic to the internet |
| Outbound | 65500 | DenyAllOutBound — blocks everything else |
VNet Peering is NOT transitive. If VNet-A peers with VNet-B, and VNet-B peers with VNet-C, resources in VNet-A CANNOT communicate with VNet-C. You need direct A↔C peering.
Monitoring & maintenance
10–15% of the examAzure Monitor and observability tools
Click any service to see more details
Log Analytics and KQL basics
The Log Analytics workspace centralizes all logs. KQL (Kusto Query Language) lets you analyze millions of records in seconds.
// Example KQL: VMs with CPU > 90% in the last 24h
Perf
| where TimeGenerated > ago(24h)
| where CounterName == "% Processor Time"
| where CounterValue > 90
| summarize avg(CounterValue) by Computer
Diagnostic settings are the bridge — without configuring them, resources don't send logs to Log Analytics. Each resource needs its own diagnostic setting.
Tips for exam day
RBAC is additive — permissions accumulate. Deny Assignments do block access even if a role allows it.
LRS = 3 copies in the same datacenter. ZRS = 3 copies across different zones. GRS = also replicates to a secondary region.
Availability Sets ≠ Scale Sets. Availability Sets = high availability (fault/update domains). Scale Sets = autoscaling.
VNet Peering is NOT transitive. If A↔B and B↔C, A cannot reach C without direct A↔C peering.
NSGs apply to a subnet or NIC. Application Gateway WAF protects HTTP/S apps. These are different layers.
The Log Analytics workspace stores the logs. Diagnostic settings are what send logs there.
Recovery Services Vault = backup + Site Recovery. Same vault for both services.
Service Endpoints vs Private Endpoints: both keep traffic off the internet, but Private Endpoint gives an IP inside your VNet.
App Service Plan defines the capacity. Multiple apps can share the same plan.
Owner can assign roles. Contributor can manage resources but CANNOT assign roles.
Want to go deeper?
This guide is a quick summary. Visit the Deep Dive section for an exhaustive walkthrough with real cases, cost analysis and architecture decisions.
Practice AZ-104 with interactive simulations
Click-through labs: navigate a step-by-step portal simulation, with clear objectives and verification on every action — no real costs.
Ready to practice?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Was this guide helpful?
Not ready to start yet?
Save your email so you don't have to type it again — pick up later and unlock AZ-104 with a Pro plan or individual purchase.