AZ-104 Study Guide

Why Azure Administrator Is Essential for Cloud Careers

Microsoft Azure holds approximately 24% of the global cloud market, and the AZ-104 certification is the core credential for Azure infrastructure management. As enterprises migrate to Azure, administrators who can manage these environments are in high demand.

Who This Guide Is For

• System administrators moving to cloud infrastructure
• IT professionals in Microsoft-centric organizations
• Cloud engineers seeking Azure specialization
• Developers expanding into DevOps roles

2026 Market Snapshot

Azure continues to gain enterprise market share in 2026, and the AZ-104 certification sits at the center of that growth. Our live AZ-104 market data shows a consistent upward trend in job postings requiring the Azure Administrator credential, particularly in industries with deep Microsoft ecosystem investments such as financial services, government, and healthcare. Enterprise migration projects that began during the pandemic-era cloud acceleration are now entering their optimization and governance phases, which is exactly where AZ-104 skills in identity management, storage configuration, and monitoring become critical.

The demand picture is further strengthened by Microsoft’s aggressive integration of AI services into Azure. Organizations deploying Azure OpenAI Service, Cognitive Services, and Azure Machine Learning need administrators who can provision the underlying infrastructure, configure networking and security, and manage the governance policies that keep these workloads compliant. This has expanded the AZ-104’s relevance beyond traditional IT administration into hybrid roles that span infrastructure and AI operations. Salary data for AZ-104 holders in 2026 ranges from $95,000 to $135,000, with a premium for candidates who can also demonstrate familiarity with complementary platforms like AWS or Google Cloud.

The AZ-104 Exam Structure

The Azure Administrator exam tests practical management skills.

Domain Weight Distribution

Exam Format

• 40-60 questions
• 150 minutes (including lab time)
• Multiple choice + case studies + labs
• Passing score: 700/1000

Domain 1: Identity and Governance (20-25%)

Azure Active Directory

User and Group Management:

• Create and manage users
• Bulk operations
• Dynamic group membership
• Guest user access (B2B)

Administrative Units:

• Scoped administration
• Delegation scenarios

Role-Based Access Control (RBAC)

Built-in Roles:

• Owner, Contributor, Reader
• Resource-specific roles
• Custom role creation

Scope Hierarchy:

• Management groups
• Subscriptions
• Resource groups
• Resources

Azure Policy and Governance

Azure Policy:

• Policy definitions and assignments
• Initiative bundles
• Compliance reporting
• Remediation tasks

Resource Locks:

• Delete and ReadOnly locks
• Lock inheritance

Blueprints:

• Organizational compliance
• Template deployments

Domain 2: Storage (15-20%)

Storage Account Configuration

Account Types:

• Standard vs. Premium
• Hot, Cool, Archive tiers
• Replication options (LRS, ZRS, GRS, RA-GRS)

Security:

• Access keys and SAS tokens
• Azure AD authentication
• Encryption at rest

Blob Storage

Blob Types:

• Block blobs (most common)
• Append blobs
• Page blobs (VHDs)

Lifecycle Management:

• Tier transitions
• Deletion policies
• Immutable storage

Azure Files

File Shares:

• SMB and NFS protocols
• Azure File Sync
• Mounting from Windows/Linux

Storage Tools

• Azure Storage Explorer
• AzCopy for bulk transfers
• Data Box for large migrations

Domain 3: Compute Resources (20-25%)

Virtual Machines

Configuration:

• VM sizing and series (B, D, E, F)
• Availability sets and zones
• Disk types (Standard HDD, Standard SSD, Premium SSD, Ultra)

Extensions:

• Custom Script Extension
• DSC Extension
• Azure Monitor agent

Maintenance:

• Backup and recovery
• Update management
• Resize operations

Virtual Machine Scale Sets

• Automatic scaling rules
• Instance management
• Load balancing integration

Azure App Service

Web Apps:

• Deployment slots
• Custom domains and SSL
• Scaling options

App Service Plans:

• Tier selection
• Regional deployment

Containers

Azure Container Instances:

• Serverless containers
• Container groups
• YAML deployment

Azure Kubernetes Service (Overview):

• Managed Kubernetes
• Node pools
• Basic concepts for AZ-104

Domain 4: Virtual Networking (15-20%)

Virtual Networks

VNet Configuration:

• Address space planning
• Subnet design
• Service endpoints
• Private endpoints

Network Security:

• Network Security Groups (NSGs)
• Application Security Groups
• NSG flow logs

Connectivity

VNet Peering:

• Regional and global peering
• Transit peering
• Gateway transit

VPN Gateway:

• Site-to-site connectivity
• Point-to-site connectivity
• Gateway SKUs

ExpressRoute:

• Private connectivity concepts
• Use cases

Load Balancing

Azure Load Balancer:

• Public vs. internal
• Health probes
• Load balancing rules

Application Gateway:

• Layer 7 load balancing
• WAF integration
• URL-based routing

DNS

Azure DNS:

• Public DNS zones
• Private DNS zones
• Record set management

Domain 5: Monitoring (10-15%)

Azure Monitor

Metrics and Logs:

• Metric types and dimensions
• Log Analytics workspace
• KQL queries basics

Alerts:

• Metric alerts
• Activity log alerts
• Action groups

Diagnostic Settings

• Resource diagnostic logs
• Archive to storage
• Stream to Log Analytics

Azure Backup

VM Backup:

• Recovery Services vault
• Backup policies
• Restore options

Azure Site Recovery:

• Disaster recovery concepts
• Failover and failback

Network Monitoring

• Network Watcher
• Connection troubleshoot
• NSG flow logs analysis

The 10-Week Study Plan

Weeks 1-2: Identity and Governance

• Azure AD user and group management
• RBAC configuration
• Azure Policy implementation
• 50 domain-specific practice questions

Begin with John Savill’s free AZ-104 study cram on YouTube to build a mental map of the entire exam, then dive into identity management. Create users, groups, and dynamic membership rules in a test tenant. Practice assigning RBAC roles at every scope level (management group, subscription, resource group, resource) and verify the effective permissions using the portal’s access check feature. Write at least two custom Azure Policy definitions and assign them to a resource group to see compliance evaluation in action. Identity and governance is 20-25% of the exam and a frequent weak spot for candidates coming from non-Microsoft backgrounds.

Weeks 3-4: Storage Deep Dive

• Storage account configuration
• Blob lifecycle management
• Azure Files setup
• AzCopy practice

Create storage accounts with different replication options (LRS, ZRS, GRS) and compare their availability characteristics. Build a blob lifecycle management rule that transitions blobs from Hot to Cool after 30 days and to Archive after 90 days, then verify the rule using the portal. Practice AzCopy commands for bulk uploads and cross-account transfers, as CLI-based operations appear in both the multiple-choice and lab portions of the exam. Spend at least 3 hours configuring Azure Files with SMB mounts on both a Windows VM and a Linux VM to understand the practical differences.

Weeks 5-6: Compute Resources

• VM deployment and management
• Scale sets configuration
• App Service deployment
• Container instances

Deploy VMs from both the portal and Azure CLI, then practice resizing, adding data disks, and configuring extensions. Build a Virtual Machine Scale Set with autoscaling rules based on CPU percentage and test the scaling behavior by generating synthetic load. For App Service, deploy a web app with deployment slots and practice the swap operation, paying attention to how app settings behave during swaps. Allocate 2-3 hours to Azure Container Instances, focusing on YAML-based multi-container group deployments. Candidates who have studied AWS compute services will find conceptual parallels but must learn Azure-specific CLI syntax and portal workflows.

Weeks 7-8: Virtual Networking

• VNet design and peering
• NSG configuration
• Load balancer setup
• VPN Gateway basics

Networking is the domain that causes the most exam failures. Design a hub-and-spoke VNet topology on paper, then build it in Azure with peering connections and verify connectivity between VMs in different VNets. Practice NSG rule creation and ordering, paying close attention to the default rules and how priority numbers affect traffic flow. Configure both a public Azure Load Balancer and an Application Gateway with URL-based routing. Use Network Watcher’s connection troubleshoot and IP flow verify tools, as these appear in troubleshooting scenarios on the exam.

Weeks 9-10: Monitoring & Review

• Azure Monitor configuration
• Backup implementation
• 3 full-length practice exams
• Weak area review

Take your first full-length practice exam at the beginning of Week 9 to identify gaps. Set up a Log Analytics workspace, connect a VM as a data source, and write at least five KQL queries to extract meaningful data from the logs. Configure a Recovery Services vault and back up a VM, then practice both file-level and full VM restore operations. After each practice exam, categorize missed questions by domain and redistribute your remaining study hours accordingly. Target a consistent score of 80% or higher before booking your exam date. The AZ-104 includes performance-based lab tasks, so make sure you can complete common operations in the portal and CLI without referencing documentation.

Hands-On Labs Are Non-Negotiable

AZ-104 includes performance-based labs. You must practice in Azure.

Essential Lab Exercises

1. Configure Azure AD with RBAC

   • Create users and groups
   • Assign roles at different scopes
   • Implement conditional access

2. Build a multi-tier application

   • VNet with subnets
   • NSGs for traffic control
   • VMs with availability

3. Implement storage solution

   • Blob containers with lifecycle
   • Azure Files with sync
   • Access control with SAS

4. Configure monitoring

   • Log Analytics workspace
   • VM diagnostics
   • Alert rules and action groups

Lab Resources

• Microsoft Learn free sandbox
• Azure free account ($200 credits)
• Azure pass (if available)
• Personal subscription (budget carefully)

Study Resources

Official Materials

• Microsoft Learn AZ-104 path (free)
• Microsoft Certification exam page
• Azure documentation

Third-Party Resources

• John Savill’s AZ-104 course (YouTube, free)
• Scott Duffy’s course (Udemy)
• Whizlabs practice tests

Practice Exams

• Microsoft Practice Assessment (free)
• MeasureUp official practice tests
• Whizlabs AZ-104 tests

Career Impact

Immediate Benefits

• Role Access: Azure Administrator, Cloud Engineer
• Salary Range: $90,000-$130,000
• Enterprise Demand: Microsoft shops prioritize Azure certs

Certification Pathway

From AZ-104:

• AZ-305 (Solutions Architect)
• AZ-500 (Security Engineer)
• AZ-400 (DevOps Engineer)

Common Roles

• Azure Administrator
• Cloud Infrastructure Engineer
• Systems Engineer (Cloud)
• DevOps Engineer

Common Mistakes to Avoid

1. Studying without hands-on practice. Labs are part of the exam
2. Ignoring identity and governance. It’s 20-25% of your score
3. Memorizing portal steps only. Know CLI and PowerShell too
4. Skipping network fundamentals. VNet design is critical

Frequently Asked Questions

Is the AZ-104 harder than the AWS Solutions Architect Associate?

The two exams are comparable in overall difficulty but differ in format and emphasis. The AZ-104 includes performance-based lab tasks where you must complete operations in a live Azure environment, which adds a practical dimension that the AWS SAA does not have. The SAA, in contrast, is entirely scenario-based multiple choice and tests broader architectural reasoning. Candidates who prefer hands-on demonstration over theoretical questions often find the AZ-104 format more intuitive. If you have a Microsoft background, the AZ-104 will likely feel more accessible; if you are platform-agnostic, the difficulty is roughly equivalent.

Do I need programming experience to pass the AZ-104?

No. The AZ-104 is an administration-focused exam, not a developer exam. You need to be comfortable with Azure CLI commands and basic PowerShell or Bash scripting for automation tasks, but you will not be asked to write application code. Familiarity with JSON is helpful for understanding ARM templates and policy definitions, and basic KQL (Kusto Query Language) knowledge is needed for the monitoring domain. If you are a developer looking for a more code-oriented Azure credential, consider the AZ-204 (Developer Associate) instead.

How long is the AZ-104 certification valid?

Microsoft certifications are valid for one year from the date you pass. Before expiration, you can renew for free by passing a renewal assessment on Microsoft Learn. The renewal assessment is shorter than the full exam and can be taken online without proctoring. Microsoft sends email reminders starting six months before expiration, and you can attempt the renewal assessment multiple times. This annual renewal model replaced the previous two-year cycle in 2021, so plan to stay current with Azure changes each year. Check our live AZ-104 market data to see how demand trends may influence your renewal decision.

Should I get the AZ-104 or AZ-900 first?

If you have any prior cloud or IT administration experience, skip the AZ-900 and go directly to the AZ-104. The AZ-900 is a fundamentals-level exam designed for non-technical audiences and business stakeholders. It will not differentiate you in the job market and the topics it covers are fully subsumed by the AZ-104. The only exception is if your employer offers a free AZ-900 voucher or if you have zero technical background and need a confidence-building milestone before committing to the more rigorous AZ-104 preparation.

Can I use the AZ-104 to transition from AWS to Azure?

Yes, and it is one of the most effective ways to do so. If you already hold the AWS Solutions Architect Associate or AWS Developer Associate, you will find that many concepts translate directly: VPCs map to VNets, Security Groups map to NSGs, S3 maps to Blob Storage, and IAM concepts are broadly similar. The main areas requiring fresh learning are Azure-specific services (Azure AD, Azure Policy, Azure Backup) and the CLI/PowerShell tooling. Most AWS-experienced candidates can prepare for the AZ-104 in 6-8 weeks rather than the full 10-week plan.

The Bottom Line

The Azure Administrator certification is achievable in 10-12 weeks with focused study. At $165, it provides strong ROI for a credential that unlocks cloud administration roles in Microsoft environments.

Focus on hands-on labs, master the Azure Portal and CLI, and practice with real scenarios. Your Azure career accelerates here.