Getting Started with AZ-104

The Microsoft Azure Administrator (AZ-104) is an intermediate-level Microsoft Associate certification that validates your ability to manage and administer Azure cloud infrastructure. It's designed for IT professionals, systems administrators, and cloud engineers who work with Azure resources daily. Unlike the foundational AZ-900, the AZ-104 expects hands-on experience with the Azure portal, PowerShell, CLI, and infrastructure-as-code tools like ARM templates and Bicep.

If you're planning to move into Azure administration roles or pursue advanced Azure certifications, AZ-104 is the essential stepping stone. It's also one of the most in-demand Azure credentials in the job market.

Exam Overview

The exam uses Microsoft's scaled scoring model, meaning not all questions carry equal weight. Case study scenarios are weighted more heavily than single-choice questions, so time management is critical.

Exam Domains

The first two domains account for 46% of the exam. Identities and Compute deserve the bulk of your study time. Networking and Storage are equally weighted, and Monitoring is the smallest domain but still critical for production workloads.

Core Concepts to Master

Identities and Governance

Microsoft Entra ID (formerly Azure AD) is fundamental to AZ-104. You need to understand:

• Users vs. guest users: Member users are in your tenant; guests are external identities. Know when to use each.
• Groups: Security groups, Microsoft 365 groups, and distribution groups have different purposes.
• RBAC roles: Owner, Contributor, Reader are built-in. Know the difference between role assignments at subscription, resource group, and resource scope.
• Access reviews and conditional access: These enforce governance at scale.
• Managed identities: System-assigned and user-assigned identities allow services to authenticate without credentials.

Compute Resources

Azure Compute includes VMs, App Service, containers, and Azure Functions. Focus on:

• Virtual Machine basics: Image selection, sizing, networking, managed disks. Be comfortable with the sizing conventions (B-series, D-series, E-series).
• VM configuration: Extensions, custom script execution, desired state configuration (DSC).
• Scale sets: Creating auto-scaling groups for load balancing.
• App Service: Plan types (Free, Shared, Basic, Standard, Premium), deployment slots, autoscaling rules.
• Container services: Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) basics.

Storage

Azure Storage covers multiple service types. Know the trade-offs:

• Storage accounts: General-purpose v2 is the default. Understand replication options: LRS, GRS, RAGRS, ZRS.
• Blob storage: Hot, cool, archive tiers and their cost implications.
• File shares: SMB protocol for on-premises integration.
• Storage security: Shared Access Signatures (SAS), stored access policies, encryption at rest with customer-managed keys.
• Data migration: Azure Data Box, AzCopy, and Azure Storage Explorer are common tools.

Virtual Networking

Networking is less conceptual than other domains. You need hands-on familiarity:

• VNets and subnets: Designing address spaces (CIDR notation), delegating subnets.
• Network security groups (NSGs): Inbound and outbound rules, order of evaluation matters.
• Route tables and User Defined Routes (UDRs): Custom routing beyond the default system routes.
• NAT Gateway and Load Balancer: Outbound connectivity and traffic distribution.
• VPN Gateway and ExpressRoute: Site-to-site and point-to-site connections.
• DNS: Azure DNS zones and private DNS.

Monitoring

Azure Monitor ties together observability:

• Metrics vs. logs: Metrics are time-series data; logs are unstructured events.
• Log Analytics: Kusto Query Language (KQL) is required. Practice writing basic queries.
• Alerts: Action groups, notification rules, automation runbooks.
• Application Insights: For application-level monitoring and dependency tracking.

Common Exam Traps

RBAC scope confusion: A role assignment at the subscription level applies to all resource groups and resources below. But removing a resource group doesn't remove the role assignment. Candidates often mix up what scope means.

Storage account types: Premium storage accounts are limited to managed disks and Azure Files. You can't use premium for general blob storage. This trips up many test-takers.

NSG vs. subnet delegation: Network security groups filter traffic. Subnet delegation assigns administrative rights to a service. They're often tested in the same question but serve completely different purposes.

Managed identities vs. Service principals: Managed identities are the simpler choice for Azure services. Service principals are for external applications. The exam tests which to use in which scenario.

Case study time: Don't spend more than 10-12 minutes on a case study. If you get stuck, move on and return if time permits.

Study Plan

Adjust this based on your background. Azure administrators with hands-on experience often compress weeks 1-4 and spend more time on domains where you have gaps.

Recommended Resources

• Microsoft Learn: The free AZ-104 learning path covers all domains with labs.
• Official study guide: Microsoft publishes an official AZ-104 study guide.
• Hands-on labs: Set up a free Azure account ($200 credit) and practice deploying real resources.
• Practice exams: Our AZ-104 practice sets include scenario-based questions and instant explanations.
• Azure documentation: Bookmark learn.microsoft.com/en-us/azure and get comfortable navigating it.

Final Thoughts

The AZ-104 is achievable with 4-8 weeks of dedicated study, depending on your background. The exam rewards both theoretical knowledge and practical troubleshooting. If you already work with Azure, your studying becomes validating what you already know rather than learning from scratch.

Take your time with the case studies. They're where the real learning happens and where most of the exam points live.

Ready to test your skills? Try our AZ-104 practice exams and see where you stand.