az-104-exam-and-become-a-microsoft-certified-azure-administrator-associate" data-autoinject="link_injection">AZ-104 is Microsoft’s role-based certification exam for validating the practical administration skills needed to manage Microsoft Azure environments.
The exam is tied to the Microsoft Certified: Azure Administrator Associate credential, which makes it most relevant for administrators, cloud operations engineers, and infrastructure professionals who implement and maintain Azure resources. It is a different path from AZ-305, which focuses on solution design, and from AZ-700, which goes deeper into Azure networking; AZ-104 is centred on day-to-day implementation, configuration, monitoring, and governance.
What AZ-104 Measures
Microsoft publishes the current AZ-104 Skills Measured on the official Microsoft Learn exam page, and candidates should check that page before booking because objectives and weightings can change. As of the current blueprint, the exam covers five broad domains: managing Azure identities and governance, implementing and managing storage, deploying and managing compute resources, configuring and managing virtual networking, and monitoring and maintaining Azure resources.
The value of the blueprint is that it shows where study time should go. A candidate who spends most of the preparation period memorising product names will usually struggle, because the exam expects administrative judgement: choosing the right scope for an RBAC assignment, deciding whether a storage access issue is caused by network rules or permissions, or identifying why a VM cannot resolve a private endpoint name.
| Skills area | Typical focus | Example administrator tasks |
|---|
| Manage Azure identities and governance | Microsoft Entra ID, RBAC, subscriptions, policies, tags, resource locks | Assign least-privilege access, enforce tagging with Azure Policy, manage resource groups and subscriptions |
| Implement and manage storage | Storage accounts, Azure Files, blob lifecycle, replication, access controls | Configure blob tiers, secure storage access, manage file shares, troubleshoot SAS and RBAC access |
| Deploy and manage compute resources | Virtual machines, availability options, scale sets, containers, App Service | Create and resize VMs, configure backup, deploy app workloads, manage extensions and updates |
| Configure and manage virtual networking | VNets, subnets, NSGs, routing, DNS, peering, VPN, load balancing | Build hub-spoke networking, configure private DNS, troubleshoot route tables and connectivity |
| Monitor and maintain Azure resources | Azure Monitor, alerts, Log Analytics, backups, Network Watcher | Create alerts, query logs, review metrics, test VM backup and restore, diagnose network flow |
This mapping also helps separate AZ-104 preparation from general Azure awareness. Knowing that Azure Policy exists is not enough; the candidate should be able to apply a policy that requires tags, understand where it is assigned, and explain how remediation works for existing resources. Similarly, knowing what a virtual network is will not be enough if the candidate cannot reason through peering, DNS, NSGs, and user-defined routes in the same scenario.
How to Build a Study Plan That Matches the Exam
A strong AZ-104 plan should alternate between concepts and implementation. Reading Microsoft Learn modules can build the vocabulary, but the exam rewards candidates who can recognise how features behave together. The practical rhythm is to study one domain, implement the same features in a sandbox, then revisit the domain with practice questions and troubleshooting scenarios.
Six to eight weeks is a realistic cadence for many candidates with some Azure familiarity, although the exact timing depends on current experience. The first phase should cover identity, subscriptions, and governance because these topics appear throughout the platform. Storage and compute should follow, then networking, and finally monitoring, maintenance, backup, and mixed review.
In practice, the most useful study sessions are small and specific. For example, one session might focus only on creating a storage account, restricting public network access, creating a private endpoint, and validating name resolution. Another might focus only on assigning RBAC at different scopes and confirming which identity can perform which action. These focused repetitions build the administrative muscle that broad video watching rarely creates by itself.
Candidates using instructor-led preparation, including Readynez AZ-104 training, should still reserve time for independent lab work. Guided instruction can shorten the path through the objectives, but Azure administration is learned most reliably when the learner has to make configuration choices, observe errors, and correct them.
Setting Up a Safe Azure Lab Environment
Hands-on practice is essential, but it should be controlled. A personal Azure sandbox can become expensive if resources are left running or if high-cost services are created casually. The safest approach is to use a separate subscription or resource group for study, apply a strict budget alert, tag every resource with a purpose such as AZ104-Lab, and delete resources after each scenario unless they are needed for the next session.
Auto-shutdown should be enabled for virtual machines, and candidates should avoid deploying large VM sizes unless a lab explicitly requires them. Storage accounts, public IP addresses, VPN gateways, and Log Analytics ingestion can also create costs, so the habit of reviewing resource groups at the end of every lab matters. A good closing routine is to check the resource group, confirm what must remain, export or note the configuration, and remove everything else.
The lab environment should mirror the exam’s administrative scope rather than attempt to replicate an enterprise estate. A small number of reusable scenarios can cover a large part of the blueprint: a policy-enforced resource group with required tags, a secured storage account with private endpoint access, a hub-spoke VNet with peering and route inspection, a VM protected by backup and monitored with alerts, and a simple App Service or container deployment with diagnostics enabled.
These scenarios are valuable because they force cross-domain thinking. A hub-spoke VNet exercise touches virtual networking, DNS, routing, NSGs, and monitoring. A policy-enforced tagging exercise touches governance, resource organisation, remediation, and operational reporting. A VM backup exercise touches compute, storage, recovery services, identity permissions, and alerting.
Portal, Azure CLI, and PowerShell Should Reinforce Each Other
Many candidates prepare almost entirely in the Azure portal because it is visual and approachable. That is a reasonable starting point, but it can create shallow understanding if the learner never sees the underlying resource model. A better method is to perform important tasks three times: once in the portal, once in Azure CLI, and once in PowerShell.
This translation approach improves retention because each interface exposes a different layer of Azure administration. The portal shows relationships and defaults. Azure CLI encourages concise commands and JSON output. PowerShell often makes object handling and automation patterns clearer for administrators coming from Windows Server or Microsoft 365 backgrounds.
The aim is not to memorise every command. The aim is to understand what is being created, which properties matter, and how to verify the result. A candidate who can create a network security group rule in the portal, inspect it with CLI, and modify it with PowerShell is better prepared for scenario-based questions than a candidate who only remembers where the button is.
The same principle applies to troubleshooting. When storage access fails, the learner should check RBAC assignments, shared access signatures, firewall rules, private endpoint configuration, and DNS resolution rather than assuming a single cause. When a VM cannot communicate with another resource, the learner should inspect effective routes, NSG flow, peering settings, and name resolution in a deliberate order.
Practical Troubleshooting Patterns for AZ-104
AZ-104 preparation should include troubleshooting because real administration rarely follows a clean sequence. Identity, networking, and storage issues often look similar at first: something is denied, unreachable, or invisible. The difference between a prepared candidate and an underprepared one is the ability to narrow the problem quickly.
For identity and governance, the common trap is confusing Azure RBAC with other permission systems. RBAC controls management-plane access to Azure resources, while data-plane access may require additional permissions depending on the service and configuration. Scope also matters: an assignment at a resource group behaves differently from an assignment at a single resource, and inherited permissions can obscure the source of access.
For networking, DNS should be checked early. Private endpoints, private DNS zones, custom DNS servers, and VNet links can all affect resolution. A candidate should be able to explain why a resource resolves to a public address in one VNet and a private address in another, and how peering or DNS forwarding changes that result.
For storage, access problems commonly involve a mix of RBAC, SAS tokens, storage account network rules, and blob or file settings. The practical question is not simply “does the identity have access?” but “does the request reach the service, does the authentication method match the operation, and does the data-plane permission allow the action?” That kind of layered reasoning is more useful than memorising a list of storage features.
A Week-by-Week Preparation Cadence
A practical study plan should leave room for repetition. The first week can focus on the exam blueprint, subscription structure, resource groups, RBAC, Microsoft Entra ID basics, policies, locks, and tags. The lab outcome should be a governed resource group where a tag policy is assigned and tested.
The second week can focus on storage accounts, blob tiers, lifecycle rules, Azure Files, replication options, shared access signatures, and network restrictions. The lab outcome should be a secured storage account with controlled access, a lifecycle rule, and a documented test showing which identities and networks can access it.
The third week can move into compute: VMs, disks, availability options, VM extensions, scale sets, App Service, and containers where relevant to the blueprint. The lab outcome should be a VM with backup, monitoring, and a simple recovery test, because restore behaviour is easier to understand after it has been performed.
The fourth week should concentrate on virtual networking. Candidates should build VNets and subnets, apply NSGs, configure peering, test private DNS, inspect routes, and compare service endpoints with private endpoints. This is often the domain where learners discover gaps, because many networking questions require understanding the interaction between several services rather than a single feature.
The fifth week can cover Azure Monitor, alerts, Log Analytics, Network Watcher, backup, update management concepts, and maintenance tasks. The lab outcome should include at least one metric alert, one log query, one connectivity diagnostic, and one backup validation.
The final phase should be mixed review under time pressure. Practice questions are useful at this stage, but they should be treated as diagnostics rather than as a substitute for learning. When an answer is wrong, the candidate should return to the relevant Azure feature, reproduce the scenario where possible, and write a short explanation of why the correct answer works.
How to Use Practice Questions Without Learning the Wrong Lesson
Practice questions can help with timing and wording, but they can also create false confidence. A candidate may recognise a repeated phrase without understanding the service behaviour behind it. That becomes a problem when the exam presents the same concept in a different scenario.
The better approach is to classify missed questions by cause. Some misses come from weak concept knowledge, such as not knowing the difference between an availability set and a scale set. Others come from misreading scope, such as overlooking whether an RBAC assignment is at subscription or resource group level. Others come from missing a dependency, such as forgetting that a private endpoint scenario may also require private DNS configuration.
Timed practice should be saved for the later stage of preparation. Early practice is better used slowly, with notes and lab validation. Near the exam date, mixed timed sets help candidates practise switching between identity, storage, compute, networking, and monitoring without relying on the order of study.
Recent Updates and Blueprint Checks
Microsoft can revise exam objectives, service names, and measured skills over time. Before finalising a study plan or booking the exam, candidates should review the official Microsoft Learn AZ-104 exam page and compare the published Skills Measured with their notes. This is especially important for governance, monitoring, and networking features, where service capabilities and recommended practices can change.
The safest editorial rule is to treat any unofficial study guide as secondary to Microsoft’s current exam page. If a video, book, or practice test uses older service names or omits a current objective, the Microsoft blueprint should take priority. Candidates should also check whether their practice materials reflect Microsoft Entra naming, current Azure portal terminology, and modern Azure CLI or Az PowerShell modules.
Common Mistakes That Slow Candidates Down
The most common preparation mistake is spreading attention evenly across every Azure product mentioned in study materials. AZ-104 is broad, but it is still an administrator exam. The highest return usually comes from understanding the core administrative patterns: identity and access, resource organisation, secure connectivity, compute operations, storage access, monitoring, and recovery.
Another mistake is treating networking as a vocabulary exercise. Terms such as peering, NSG, route table, private endpoint, service endpoint, Azure DNS, and private DNS need to be understood through traffic flow. Candidates should be able to describe what happens when a VM attempts to reach a storage account, which controls are evaluated, and where they would look first if the request fails.
A third mistake is ignoring cleanup and cost control during labs. Azure administration includes operational discipline. Tagging resources, setting budgets, enabling auto-shutdown, and removing unused resources are not merely good housekeeping; they reinforce the governance habits that the exam expects candidates to understand.
Frequently Asked Questions
Is AZ-104 suitable for someone new to Azure?
AZ-104 is possible for a newcomer, but it is not an entry-level overview exam. Candidates should first be comfortable with basic Azure concepts, resource groups, subscriptions, networking fundamentals, identity, and cloud service models. Those without hands-on Azure exposure should expect to spend more time in labs before relying on practice questions.
Does AZ-104 include labs?
Microsoft exam formats can vary, so candidates should not base preparation on a fixed assumption about labs. The safer approach is to prepare for performance-oriented scenarios by practising real configuration tasks in Azure, then using practice questions to test judgement and timing.
How often should the AZ-104 blueprint be checked?
The blueprint should be checked at the start of preparation, again before buying or using study materials, and once more before booking the exam. Microsoft Learn is the authoritative source for current objectives, regional pricing, scheduling details, and any changes to the measured skills.
Should candidates learn Azure CLI and PowerShell for AZ-104?
Yes, at least to the level of understanding common administrative operations and verification commands. The portal is useful, but CLI and PowerShell help candidates understand resource properties, automation patterns, and repeatable administration. Practising the same task across interfaces also makes scenario-based questions easier to reason through.
Turning AZ-104 Preparation Into Working Azure Skills
AZ-104 preparation works best when it is treated as job rehearsal rather than exam memorisation. The candidate should be able to govern resources, secure access, deploy compute, configure networking, protect data, and monitor the environment with enough confidence to troubleshoot when something fails.
A structured plan, a cost-controlled sandbox, and repeated practice across the portal, Azure CLI, and PowerShell give the certification practical value beyond the exam. Readynez can support that journey through focused AZ-104 preparation, but the decisive factor remains the candidate’s ability to connect each objective to a real administrative task and practise until the reasoning becomes reliable.
