AZ-104 is an operational exam, and that word should govern how you prepare. It does not mainly test whether you can recite what a service is; it tests whether you can carry out the day-to-day tasks of administering an Azure environment, often through interactive, lab-style items that ask you to actually do something. Microsoft’s audience profile is explicit: it expects subject-matter expertise in implementing, managing and monitoring an organisation’s Azure environment across networking, storage, compute, identity, security and governance, and familiarity with PowerShell, the Azure CLI, the portal, and ARM templates or Bicep. This guide is a full self-study course built around the five skill areas Microsoft measures. It explains each one, says why it matters to a working administrator, shows where people go wrong, and turns it all into a week-by-week plan. It is original teaching material and study guidance only. It contains no real or simulated exam questions, and you should always confirm the current skills and weights against Microsoft’s own AZ-104 study guide before you book.
Chapter 1: Exam overview and how to use this guide
What AZ-104 actually measures
AZ-104 measures whether you can run an Azure environment competently, day to day. Microsoft organises the exam into five skill areas with published weight ranges: Manage Azure identities and governance at 20 to 25 percent, Implement and manage storage at 15 to 20 percent, Deploy and manage Azure compute resources at 20 to 25 percent, Implement and manage virtual networking at 15 to 20 percent, and Monitor and maintain Azure resources at 10 to 15 percent. Those weights are the single most important planning fact in this guide, because they tell you where your hours belong. The two largest areas are identities and governance and compute, but the area that most often decides results is virtual networking, which is dense and easy to under-prepare relative to its weight.
The exam runs in spirit like the job. Alongside multiple-choice and case-study questions, Microsoft exams can include interactive, lab-style items where you complete a task in a simulated environment, so reading alone is not enough; you need the muscle memory of having done the task. The pass mark is 700 out of 1000, and the score is scaled rather than a literal percentage of questions correct. Unlike the never-expiring fundamentals certification, AZ-104 is a role-based certification that expires after one year, but renewal is free: you pass a short, unproctored online assessment on Microsoft Learn in the months before it lapses.
Why hands-on practice is the method, not an extra
Because the exam mirrors real administration, the most reliable preparation is to perform every task in a free Azure account rather than only watching or reading. Where a task can be done in more than one way, practise it more than one way: in the portal, with the Azure CLI, and with Azure PowerShell. Microsoft expects you to recognise command-line approaches, and seeing the same outcome achieved by clicking and by a command cements both what the task does and how Azure represents it. This is also why deploying with ARM templates or Bicep belongs in your practice from early on, since infrastructure-as-code is part of the compute area, not a niche topic.
How to use this course
Read the five content chapters in order, because the early ones scope the later ones. Identities and governance comes first because role-based access control and the resource hierarchy frame every other action you take, and networking sits late because it ties compute, storage and security together. Treat every bold term as a checklist item you can both explain and configure. The final chapters turn the content into a plan, a final-review routine, and a description of exam day. Short teaching examples appear where a concept is easy to misread; none are exam questions.
Chapter 2: Manage Azure identities and governance (20 to 25 percent)
This area comes first because it scopes everything else: who can do what, where, and within which organisational and financial boundaries. It has three strands in Microsoft’s skills list, and a working administrator touches all three constantly.
Microsoft Entra users and groups
Microsoft Entra ID is Azure’s cloud identity service, the directory where users, groups and applications live, and managing it is the foundation of access. The tasks the exam expects you to perform include creating users and groups, managing their properties, and managing licenses in Entra ID. Two areas deserve specific attention. External users let you grant access to people outside your organisation, such as partners or contractors, and knowing how external (guest) identities are added and managed is a recurring theme. Self-service password reset (SSPR) lets users reset their own passwords securely without calling a help desk, and configuring it is a named skill. The reason groups matter so much is that they are how access scales: rather than assigning permissions to individuals, you assign them to groups, which is the bridge to the next strand.
Manage access to Azure resources with RBAC
Azure role-based access control (RBAC) is how permissions are granted in Azure, and it is one of the most important ideas on the whole exam. You grant access by assigning a role to a user, group or identity at a scope. The scope is where the resource hierarchy becomes concrete: a role can be assigned at a management group, a subscription, a resource group, or a single resource, and access inherits downward, so a role granted at a subscription applies to all the resource groups and resources beneath it. The exam expects you to manage built-in roles, the most important of which are Owner (full access including granting access to others), Contributor (full management but cannot grant access), and Reader (view only), alongside many service-specific roles. You also need to assign roles at different scopes deliberately and to interpret access assignments, which means reading a situation and working out what effective access someone actually has, given assignments at different levels. As a teaching example of the principle: granting Contributor at a resource group lets someone manage everything in that group but nothing outside it, whereas the same role at the subscription would extend across every group in the subscription. Choosing the narrowest scope that meets the need is the habit the exam rewards, and it is the principle of least privilege in practice.
Subscriptions and governance
The third strand is keeping the environment organised, compliant and cost-controlled. Resource groups are logical containers for related resources, and managing them, along with the subscriptions above them, is foundational. Management groups sit above subscriptions and let you apply governance and access across many subscriptions at once, which matters in larger organisations. The governance tools themselves are essential: Azure Policy enforces rules on resources, such as restricting allowed regions or requiring particular tags, so deployments stay compliant automatically; resource locks protect important resources from accidental change (a read-only lock) or deletion (a delete lock); and tags are name-value labels you apply to resources to organise them and track cost. Finally, the exam expects you to manage costs using alerts, budgets and Azure Advisor recommendations, so you can spot and control spend rather than discover it on the bill. The conceptual thread tying this strand together is the same downward inheritance you met with RBAC: policy applied at a management group or subscription flows to everything beneath it, which is exactly what makes governance scalable.
Common traps in this area
Two slips cost marks here. The first is misreading scope: when a question describes assignments at several levels, the answer depends on inheritance, so trace it from the top down. The second is confusing the governance tools, particularly Azure Policy with resource locks; remember that Policy controls how resources are configured and created, while a lock prevents an existing resource from being changed or deleted.
Chapter 3: Implement and manage storage (15 to 20 percent)
This area is about creating storage, controlling who can reach it, and configuring the data services and protections on top of it. Microsoft’s skills list breaks it into three parts: access, the accounts themselves, and the file and blob services.
Configure access to storage
Securing storage is its own discipline because storage accounts often hold an organisation’s most sensitive data. The named skills include configuring Azure Storage firewalls and virtual networks so that an account is reachable only from approved networks, creating and using shared access signature (SAS) tokens that grant time-limited, scoped access without sharing the account key, and configuring stored access policies that let you manage and revoke groups of SAS tokens centrally. You also need to manage access keys, the account-level keys that grant full access (and which should be rotated and protected carefully), and to configure identity-based access for Azure Files, which lets users authenticate to file shares with their directory identities rather than a shared key. The judgement the exam rewards is matching the access method to the need: a SAS token for limited, temporary, delegated access, and identity-based access where you want users to authenticate as themselves.
Configure and manage storage accounts
The storage account is the container for everything, and several configuration choices are heavily tested. Redundancy determines how many copies of your data are kept and where, and you should know the progression: locally redundant storage (LRS) keeps copies within a single datacentre and is cheapest; zone-redundant storage (ZRS) spreads copies across availability zones in a region to survive a datacentre failure; and geo-redundant storage (GRS) replicates to a paired region for protection against a regional outage. Object replication copies blobs between storage accounts, for example to bring data closer to users in another region. The exam also expects you to configure storage account encryption and to manage data using tools such as Azure Storage Explorer (a graphical client) and AzCopy (a command-line tool for high-performance transfers). Choosing a redundancy level is a classic trade-off question: more geographic spread means more resilience at more cost, so the right answer is the cheapest option that meets the stated durability requirement.
Configure Azure Files and Azure Blob Storage
On top of the account sit the data services. For Azure Files you create and configure file shares, and for Azure Blob Storage you create and configure containers. Two themes run through this part. The first is storage tiers: a hot tier for data accessed often, a cool tier for infrequently accessed data, and an archive tier for rarely accessed data that is cheapest to store but slowest to retrieve. The second is data protection, where the exam names several specific features: soft delete for blobs and containers and snapshots and soft delete for Azure Files, which let you recover data deleted by mistake; blob lifecycle management, which automatically moves blobs between tiers or deletes them on a schedule to control cost; and blob versioning, which keeps previous versions of a blob so changes can be undone. As a teaching example of lifecycle management: a rule might move blobs to the cool tier after thirty days without access and to archive after ninety, so old data costs less to store without anyone managing it by hand. Knowing which feature solves which protection or cost problem is exactly what these questions test.
Chapter 4: Deploy and manage Azure compute resources (20 to 25 percent)
This is one of the two largest areas, and it covers the workloads that actually run your applications: virtual machines, containers and managed app hosting, plus the infrastructure-as-code tooling that deploys them repeatably.
Automate deployment with ARM templates or Bicep
Microsoft places automated deployment at the front of this area, which signals its importance. Azure Resource Manager (ARM) templates are JSON files that declare the resources you want to deploy, and Bicep is a more concise language that compiles to the same thing. The named skills are practical: interpret an ARM template or Bicep file (read it and understand what it deploys), modify an existing template or Bicep file, deploy resources from one, and export a deployment as a template or convert an ARM template to Bicep. You are not expected to author complex templates from scratch, but you must be comfortable reading and adjusting them, because infrastructure-as-code is how administrators deploy consistently and at scale rather than clicking the same steps repeatedly.
Create and configure virtual machines
Azure Virtual Machines are the core IaaS compute option, full virtual servers where you control the operating system, and the exam expects fluency in their lifecycle. The named skills include creating a virtual machine, configuring encryption at host for stronger data protection, moving a virtual machine to another resource group, subscription or region, managing virtual machine sizes (resizing as needs change), and managing virtual machine disks. Availability is a key theme: you should know how to deploy virtual machines to availability zones and availability sets, the two mechanisms for spreading machines across hardware or datacentres so a single failure does not take them all down. You also need to deploy and configure Azure Virtual Machine Scale Sets, which are groups of identical virtual machines that scale out and in automatically to meet demand. The distinction worth holding is that availability sets and zones are about resilience, while scale sets are about elastic capacity, even though they often appear together in a resilient, scalable design.
Provision and manage containers
Containers package an application with its dependencies so it runs consistently anywhere, and the exam covers the administrator’s view of running them. The named skills include creating and managing an Azure Container Registry (a private store for your container images), provisioning a container with Azure Container Instances (the simplest way to run a single container without orchestration), provisioning a container with Azure Container Apps (a managed, serverless platform for running containerised microservices that scale), and managing the sizing and scaling of both. The judgement the exam tests is when each fits: Container Instances for a simple or short-lived single container, and Container Apps for scalable, longer-running microservices that need more than a single container.
Create and configure Azure App Service
Azure App Service is the managed platform for hosting web apps and APIs, where the platform handles the operating system and scaling so you deploy just your application. The named skills are detailed: provision an App Service plan (which defines the compute and pricing for your apps) and configure its scaling; create an App Service; configure certificates and Transport Layer Security (TLS) so the app is served securely; map a custom DNS name to the app; configure backup; configure networking settings; and configure deployment slots, which are live staging environments that let you deploy and test, then swap into production with no downtime. Deployment slots are a favourite topic because they capture a real administrative practice: validating a release in a slot and swapping it in, rather than deploying straight to production and hoping.
Chapter 5: Implement and manage virtual networking (15 to 20 percent)
Networking is the area most candidates underestimate, and it is frequently where the exam is won or lost, because it ties compute, storage and security together and rewards precise understanding. Microsoft’s skills list has three parts: the networks themselves, secure access to them, and name resolution and load balancing.
Configure and manage virtual networks
An Azure Virtual Network (VNet) is your private network in Azure, and a subnet divides it into segments. The named skills include creating and configuring VNets and subnets, creating and configuring virtual network peering to connect two VNets so resources can communicate privately across them, configuring public IP addresses, and configuring user-defined routes, which override Azure’s default routing to send traffic where you want it (for example, through a network appliance). The exam also expects you to troubleshoot network connectivity, which means reasoning about why two resources cannot talk to each other, a skill that draws on everything else in this chapter. Peering and routing reward careful thought because connectivity problems usually come down to how networks are joined and how traffic is directed.
Configure secure access to virtual networks
Security is woven through networking, and several named skills cover it. Network security groups (NSGs) are stateful sets of allow and deny rules that filter traffic to and from resources, and application security groups let you group resources so NSG rules can target them by role rather than by individual address. You must be able to evaluate effective security rules in NSGs, which means working out what traffic is actually permitted when several rules and groups interact, a task that mirrors real troubleshooting closely. Azure Bastion provides secure access to virtual machines directly through the browser without exposing them to the public internet, removing the need for public IP addresses on those machines. Finally, service endpoints and private endpoints both secure access to Azure platform (PaaS) services: a service endpoint extends your VNet’s identity to the service over the Azure backbone, while a private endpoint brings the service into your VNet with a private address so traffic never touches the public internet. As a teaching example of evaluating effective rules: if one NSG rule allows traffic and a higher-priority rule denies it, the deny wins, so reading priority order is essential. This kind of rule-precedence reasoning is exactly what the networking questions probe.
Configure name resolution and load balancing
The last part covers getting traffic to the right place. Azure DNS provides name resolution, turning names into addresses. For distributing traffic, you need to configure an internal or public load balancer and to troubleshoot load balancing. An internal load balancer distributes traffic to resources within a private network, while a public one accepts traffic from the internet, and knowing which fits a scenario, plus how to diagnose a load balancer that is not sending traffic where expected, completes the networking picture. Because this area is so interconnected, the most effective way to learn it is to build a small network end to end in a free Azure account: two subnets, an NSG, a peering, a load balancer, and then deliberately break and fix connectivity.
Chapter 6: Monitor and maintain Azure resources (10 to 15 percent)
This is the smallest area, but it offers reliable marks once you know the tools, and it covers two practical responsibilities: watching the environment and protecting it against data loss.
Monitor resources in Azure
Azure Monitor is the platform for collecting and analysing telemetry, and the exam names specific tasks. You should be able to interpret metrics (numeric measures of resource health and performance), configure log settings so the right data is collected, and query and analyze logs to investigate issues. You also need to set up alert rules, action groups, and alert processing rules, which together notify the right people or trigger automated responses when something needs attention. Azure Monitor Insights provides focused monitoring views for virtual machines, storage accounts and networks, and you should be able to configure and interpret these. For network-specific diagnosis, Azure Network Watcher and Connection Monitor help you observe and troubleshoot connectivity, which links back to the networking chapter. The skill the exam rewards is closing the loop: collecting the right signals, then turning them into an alert or an investigation rather than just looking at dashboards.
Implement backup and recovery
The maintenance half is about resilience and recovery. The named skills include creating a Recovery Services vault and an Azure Backup vault, the containers that hold backups, then creating and configuring a backup policy and performing backup and restore operations with Azure Backup. Beyond backup, the exam covers disaster recovery: configuring Azure Site Recovery for Azure resources, which replicates workloads so they can be brought up elsewhere, and performing a failover to a secondary region using Site Recovery. You should also be able to configure and interpret reports and alerts for backups, so you know that protection is actually working. The distinction worth holding is between backup (recovering data and individual resources from a point in time) and Site Recovery (failing an entire workload over to another region after a major outage); the exam expects you to choose the right one for a stated recovery need.
Chapter 7: Study plan and timeline
With the content understood, the work is pacing it so that nothing, least of all networking and the hands-on practice, gets squeezed out at the end. Two things drive the plan: the domain weights and the operational nature of the exam.
Allocate time by weight, but protect networking
Spend your hours roughly in proportion to the weights, with the most going to identities and governance (20 to 25 percent) and compute (20 to 25 percent), a solid block on storage (15 to 20 percent) and networking (15 to 20 percent), and a focused, smaller pass on monitoring and maintenance (10 to 15 percent). The one adjustment to make is to give networking more time than its weight alone suggests, because it is dense, interconnected, and the area most people find hardest under exam conditions.
Choose a timeline
A balanced self-study plan runs about eight weeks at roughly seven to eight hours a week, with the Azure portal open and every task done by hand: weeks one and two on identities and governance; weeks three and four on storage; weeks five and six on compute; week seven on virtual networking and monitoring; and week eight on full-length, timed reviews. If you already administer Azure, you can compress to a four-week intensive at twelve to fifteen hours a week, working straight through the skills-measured areas in the portal and finishing on mocks. If Azure is new to you, stretch to a twelve-week steady plan at about five hours a week, starting with AZ-900-level basics before building administration skills. To turn whichever timeline you pick into dated weeks for your own start date, use the free study-plan generator.
Build hands-on habits, not just reading
Move from reading to doing within each area, not at the end. For every skill area, perform the named tasks in a free Azure account, and where it matters, do the same task in the portal, the Azure CLI and PowerShell so the command-line approaches feel familiar. Deliberately create and then troubleshoot resources, especially in networking, because the exam’s interactive items and case studies reward people who have actually configured these things rather than only read about them. Avoid unauthorized question-sharing sites that claim to reproduce the test; they breach Microsoft policy and copyright, and they do not teach you to administer Azure.
Chapter 8: Final preparation, exam day, and format
Final preparation
In the last week or two, consolidate rather than learn new material. Revisit networking, governance and the storage and compute essentials, then run full-length, timed reviews, treating each as both a diagnosis of weak skill areas and practice at pacing. Review the reasoning behind every miss rather than only checking your score, and aim to be scoring comfortably above the pass mark of 700 on fresh questions before you book. Start with Microsoft Learn’s free practice assessment to calibrate where you stand, then move to full-length practice tests. Because Azure changes frequently, confirm the current skills-measured list on Microsoft Learn close to your exam date.
Exam day and format
On the day, AZ-104 is delivered through Pearson VUE, either at a test centre or online with a proctor, and you will need government-issued identification. The exam mixes multiple-choice and case-study questions, and Microsoft exams can include interactive, lab-style items where you complete an administrative task in a simulated environment, so check the current duration when you book. You need 700 out of 1000 to pass, on a scaled score. Pace yourself so the lab-style items, which can take longer, do not run away with your time, and apply the disciplined reading you practised: identify the scope an action applies to, choose the narrowest option that meets the requirement, and reason about inheritance and rule precedence rather than guessing. Having actually performed the tasks during your study is the advantage that makes the interactive items feel routine rather than intimidating. Remember that the certification is valid for one year and renews free through a short online assessment, so passing AZ-104 also sets up a low-maintenance way to keep it current and a natural path toward the AZ-305 architect certification when you are ready.