The AZ-104 Microsoft Azure Administrator certification is one of the most valuable cloud credentials on the market right now. Organizations are moving infrastructure to Azure at a rapid pace, and the demand for professionals who can actually manage that infrastructure, not just talk about it, continues to outpace supply. If you’re working in IT and haven’t considered the AZ-104, you’re leaving career opportunity on the table.
That said, the AZ-104 is not a lightweight exam. It’s the kind of test that rewards people who’ve actually worked with Azure, and challenges those who’ve only read about it. Candidates who walk in expecting to pass on study notes alone frequently discover that the exam’s scenario-based questions require a depth of practical understanding that textbook review doesn’t provide.
This guide gives you a complete picture of what the exam tests, what your preparation should look like, and how to allocate your time for the best chance of success on your first attempt.
What the AZ-104 Tests Across Azure Administration Domains
The AZ-104 exam covers five core domain areas. Microsoft publishes a detailed skills outline (sometimes called the “skills measured” document) that breaks these down precisely, and you should download it and treat it as your study blueprint.
Here’s how the domains break down:
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 15-20% |
| Implement and manage storage | 15-20% |
| Deploy and manage Azure compute resources | 20-25% |
| Implement and manage virtual networking | 20-25% |
| Monitor and maintain Azure resources | 10-15% |
Let’s walk through what each domain actually requires.
Manage Azure identities and governance (15-20%)
This domain covers Microsoft Entra ID (formerly Azure Active Directory), including user and group management, role-based access control (RBAC), subscriptions and management groups, and Azure Policy.
The governance concepts are especially important and often underestimated by candidates with a predominantly technical background. You need to understand how Azure management groups create a hierarchy for policy application, how subscription-level governance differs from resource-group-level governance, and how Azure Policy definitions, initiatives, and assignments work.
RBAC is a consistent focus area: understanding built-in roles, creating custom roles, understanding the difference between role assignment scope at different levels (management group, subscription, resource group, resource), and the deny assignment concept.
Managed identities, both system-assigned and user-assigned, come up frequently in scenarios involving automation and application access. Know when to use each type and how they’re configured.
Implement and manage storage (15-20%)
The storage domain tests your understanding of Azure Storage accounts: configuration options (performance tiers, replication options, access tiers), blob storage lifecycle management, shared access signatures (SAS), and storage account security including firewall rules and private endpoints.
Azure Files and Azure File Sync deserve dedicated study time. File Sync scenarios, where you’re connecting on-premises Windows file servers to Azure Files shares while keeping local caching, appear regularly. Know the concepts of server endpoints, cloud endpoints, and sync groups.
Access control for storage, including storage access keys, SAS tokens, and Azure AD-based access (storage blob data contributor vs. storage account contributor, and why they’re different), is a frequent source of exam questions that distinguish candidates with deep understanding from those with surface knowledge.
Deploy and manage Azure compute resources (20-25%)
This is the largest domain and covers virtual machines, VM scale sets, containers, and Azure App Service.
For virtual machines, expect questions on VM sizing, availability zones vs. availability sets (and why each matters for fault tolerance), VM image management, disk types and their performance characteristics, and backup configuration with Azure Backup.
Azure Kubernetes Service (AKS) features more prominently in recent exam versions than it did historically. You don’t need deep Kubernetes expertise, but you do need to understand AKS cluster creation, node pools, integration with Azure Container Registry, and basic workload deployment concepts.
Azure App Service scenarios test your understanding of App Service plans, deployment slots and swap operations, autoscaling configuration, and integration with Azure networking (VNet integration, private endpoints).
Implement and manage virtual networking (20-25%)
Virtual networking is tied with compute as the exam’s most heavily weighted domain, and it’s where many candidates struggle most. The concepts are interconnected and scenario-based questions often require you to reason through multi-service networking configurations.
Core areas include: Virtual Network (VNet) design including address spaces and subnetting, VNet peering (local and global), Network Security Groups (NSGs) and Application Security Groups, and Azure DNS including private DNS zones and custom DNS configuration.
Azure load balancing services get significant coverage, and the distinctions between them matter:
| Service | Layer | Use case |
|---|---|---|
| Azure Load Balancer | Layer 4 | VM-level load balancing, non-HTTP/S |
| Application Gateway | Layer 7 | HTTP/S, path-based routing, WAF |
| Azure Front Door | Layer 7 | Global, CDN, multi-region failover |
| Traffic Manager | DNS-level | Multi-region routing, non-HTTP/S |
Knowing when to use which service in a scenario description is exactly the kind of judgment the exam tests. The services overlap in function but differ in layer, scope, and features in ways that determine which one is appropriate for a given requirement.
VPN Gateway and ExpressRoute connectivity, Azure Bastion for secure VM access, and Network Watcher for monitoring and diagnostics round out this domain.
Monitor and maintain Azure resources (10-15%)
The monitoring domain covers Azure Monitor, including metrics, alerts, action groups, and diagnostic settings. Log Analytics workspaces and KQL (Kusto Query Language) queries appear at a basic level: you won’t need to write complex queries from scratch, but you should understand the workspace structure and the basic syntax for common log queries.
Azure Backup and Azure Site Recovery complete this domain. Know the difference between backup (operational recovery of individual resources) and site recovery (disaster recovery with replication to a secondary region). Understand backup policies, retention periods, and the restore process for VMs.
Hands-On Lab Practice Requirements for Azure Administrator Readiness
The single most important thing to know about AZ-104 preparation is this: the exam tests operational judgment, not just factual recall. Questions are scenario-based. They describe a business requirement and ask which configuration, service, or sequence of steps best meets it. That kind of judgment develops through hands-on experience, not reading.
Set up your Azure free account immediately
Microsoft Azure offers a 12-month free account for new users, with a $200 credit for the first 30 days. This is where your hands-on practice happens. Don’t wait until you’ve “finished studying” to start using the portal. Start building things from day one of your preparation.
The services most worth hands-on time, because they’re highest-weight and most scenario-rich in the exam:
- Creating and configuring VMs (including availability sets, managed disks, and backup)
- Building VNets with multiple subnets, peering two VNets, and testing NSG rules
- Configuring Azure Storage accounts with different access tiers and SAS tokens
- Setting up RBAC: assigning roles at different scopes and verifying the access effect
- Creating an App Service and deploying a basic application using deployment slots
- Configuring Azure Backup for a VM and performing a test restore
For each of these, don’t just create the resources and call it done. Try to break them, reconfigure them, and explore what happens when you change settings. The exam will ask about error conditions and what specific configurations produce. You learn those patterns by actually encountering them.
Microsoft Learn sandbox labs
Microsoft Learn (learn.microsoft.com) offers a structured learning path for the AZ-104 that includes sandbox labs, free interactive Azure environments that don’t require your own subscription. These are particularly valuable for expensive resources (like ExpressRoute or large VM sizes) where you want the learning experience without the cost.
Complete the full AZ-104 learning path on Microsoft Learn. It’s the closest thing to an official study guide that exists, and the sandbox labs are genuinely useful for building procedural familiarity with configuration tasks you might not do in your day job.
Practice scenario walkthroughs
Beyond creating individual resources, practice scenario-based configurations: multi-step tasks that mirror what the exam describes. For example:
Scenario: A company needs to allow application servers in subnet A to access a database in subnet B, while blocking all other internet traffic. The connection must be monitored for unusual patterns.
Solving this requires you to think through NSG rules on both subnets, potentially Service Endpoints or Private Endpoints for the database, and Network Watcher configuration. That kind of multi-component reasoning is what the exam tests, and it only develops through practice with multi-step scenarios.
Practice Exam Strategy and Study Resources for AZ-104
Beyond the hands-on work, you need structured content review and practice testing.
Primary study resources
Microsoft Learn AZ-104 learning path: Start here. It’s free, it’s official, and it covers the exact scope of the exam. The modules are organized by domain and include knowledge checks.
John Savill’s AZ-104 Study Cram (YouTube): John Savill is a Microsoft Technical Fellow who produces extraordinarily high-quality, free Azure content on YouTube. His AZ-104 study cram video is several hours long and covers the exam domains comprehensively. This is widely considered the single best free resource for AZ-104 preparation.
Udemy courses (Scott Duffy or Alan Rodrigues): Both of these instructors have well-regarded AZ-104 courses that include hands-on labs and practice exams. They’re regularly updated to reflect exam changes.
Microsoft’s official practice assessment: Microsoft now provides an official free practice assessment for the AZ-104 at learn.microsoft.com. These questions are written by the same team that writes exam questions and are the most accurate representation of actual exam difficulty and format. Use this as a diagnostic and final readiness check.
Practice exam strategy
Practice exams serve two purposes: diagnosing content gaps and building test-taking stamina for the exam format.
For diagnosis: after each practice test, don’t just note your score. Review every question you got wrong and, critically, every question you got right by guessing. Use the explanations to understand why the correct answer is correct, and go back to the relevant Microsoft documentation to verify.
For stamina: the AZ-104 allows up to 150 minutes for approximately 40-60 questions. That’s longer and fewer questions than some certification exams, but the scenario-based questions are cognitively demanding. Running full-length practice exams under realistic conditions, no breaks, no references, timed builds the endurance you need.
Do not use brain dumps. Beyond the ethical issues, brain dump questions for Azure exams become outdated within months as the service and exam evolve. Candidates who prepare with brain dumps often find that significant portions of their memorized content doesn’t reflect the current exam. Prepare with current, legitimate resources.
A six-week preparation timeline
This assumes a moderate Azure background (some familiarity but not deep operational experience). Adjust based on your starting point.
Weeks 1-2: Domains foundation Work through the Microsoft Learn modules for identities/governance and storage. Build the corresponding resources in your Azure sandbox. Create users, groups, and RBAC assignments. Build storage accounts with different configurations and test SAS token access.
Weeks 3-4: Compute and networking These are the heaviest domains. Build VMs, scale sets, and a basic App Service. Create VNets with peering, configure NSGs, and test load balancer configurations. Spend extra time on the load balancing service comparison, it appears frequently.
Week 5: Monitoring and review Complete the monitoring domain. Take your first full practice exam to diagnose gaps. Spend the rest of the week filling the specific gaps the practice test identifies.
Week 6: Consolidation and readiness check Run two or three full practice exams. Use the Microsoft official practice assessment. Focus your final hands-on sessions on the scenarios that appeared in practice tests where you weren’t confident. Review the skills measured document one more time to verify there are no domains you haven’t touched.
Exam Logistics
The AZ-104 costs $165 and can be taken at a Pearson VUE test center or online through remote proctoring. The passing score is 700 out of 1000.
Online proctoring is convenient but has specific requirements: a cleared desk, no secondary monitors, a stable internet connection, and a camera and microphone. If your home environment has noise or disruption risks, a test center may be the more reliable option.
If you don’t pass, you can retake after 24 hours. If you fail a second time, there’s a 14-day waiting period before each subsequent attempt. Most well-prepared candidates won’t need a retake, but having that context is useful.
Using Spaced Repetition for Azure Concept Retention
AZ-104 preparation covers a large number of specific service configurations, thresholds, and scenario-based rules. Keeping all of this organized and actively retrievable over a 6-8 week preparation period benefits from systematic review.
LongTermMemory is useful here for converting your study notes, specifically the service comparisons, configuration options, and RBAC/governance concepts, into flashcard decks that are reviewed on a spaced repetition schedule. The load balancing service comparison table, the storage replication options, the VNet peering limitations, the NSG rule priority logic: these are exactly the types of structured factual content that spaced repetition handles efficiently.
The goal is to have these concepts immediately accessible during scenario-based questions, without burning mental bandwidth on retrieval that should be automatic. That retrieval fluency comes from systematic spaced practice, not from reading the same table five times the day before the exam.
For broader strategy on managing professional certification preparation alongside a full-time job, the challenges of AZ-104 preparation fit squarely into the patterns discussed in studying while working: efficient learning techniques for busy professionals.
The Bigger Picture
The AZ-104 is not just a certification. It’s a signal to employers that you understand how Azure actually works at an operational level, not just conceptually. The scenario-based format of the exam is specifically designed to test that operational understanding.
Candidates who pass it reliably are the ones who have actually built things in Azure, debugged configurations that didn’t work, and developed the kind of pattern recognition that comes from real interaction with the services. The study resources point you toward the right content. The hands-on practice is what translates content into judgment.
Start building. Start early. And treat the practice exams as diagnostic tools rather than scorecards.
That’s how you walk into the exam room ready.
