Microsoft Azure · AZ-104 · Updated 2026-07-13
Azure Administrator (AZ-104) Study Guide
By Falakhe Sivela · Updated 2026-07-13
Exam domains and weights
Each domain has its own guide covering what it tests, its full topic list, and the traps it is built around.
The Microsoft Certified: Azure Administrator Associate (AZ-104) is the workhorse certification of the Azure track — and it has a deserved reputation for being harder than its "associate" label suggests. It tests whether you can actually administer an Azure environment: identities, governance, storage, compute, networking, and monitoring, often down to portal-blade and CLI-flag level of detail.
The difficulty is not conceptual. It is that AZ-104 asks about the specific behaviour of specific features, and that kind of knowledge does not survive theoretical study.
Who should take it
AZ-104 is aimed at administrators with at least six months of hands-on Azure experience. It is the standard credential for cloud ops, infrastructure, and platform roles in Microsoft shops. Coming straight from AZ-900 without portal time is possible but painful — the exam assumes you have done these things, not read about them.
How the exam is scored
Expect roughly 40–60 questions in about 100 minutes, scored on a 1,000-point scale with a 700 pass mark (a scaled score, not a raw percentage).
Microsoft's formats are the most varied of any vendor: multiple choice, drag-and-drop, hotspot dropdowns, and case studies — a long scenario with several questions attached. Read the questions before the scenario. The case study text is deliberately long and most of it is irrelevant to what is actually being asked; knowing what you are looking for turns ten minutes of reading into three.
The five domains, one by one
Deploy and Manage Azure Compute Resources (25%)
VMs and the things around them. Sizing and disk types (Standard HDD, Standard SSD, Premium SSD, Ultra), and — importantly — availability sets versus availability zones: a set spreads VMs across fault and update domains inside one datacentre; zones spread them across physically separate datacentres in the region. Zones give the higher SLA.
Virtual Machine Scale Sets and autoscaling rules. App Service plans and deployment slots, including the swap operation, which is the standard answer to "deploy with zero downtime and the ability to roll back instantly."
Implement and Manage Virtual Networking (20%)
This is the domain that fails people. If you over-study one area, make it this one.
VNet peering is not transitive. If A peers with B and B peers with C, A cannot reach C. This single fact is tested constantly, and the fix — a hub-and-spoke topology with a network virtual appliance or Azure Firewall in the hub, plus user-defined routes — is the answer to a whole family of questions.
NSG evaluation is by priority number, lowest first, and the first match wins. There are default rules at the bottom that allow VNet-inbound and deny everything else inbound. NSGs are stateful. If a question shows you a rule table and asks whether traffic is allowed, work down by priority and stop at the first match.
Know Load Balancer versus Application Gateway: Layer 4 (TCP, fast, no idea what HTTP is) versus Layer 7 (understands URLs, can route by path, has a WAF). If the question mentions path-based routing or SSL termination, it is Application Gateway.
Know VPN Gateway versus ExpressRoute: encrypted tunnel over the public internet versus a private dedicated circuit that never touches it.
Manage Azure Identities and Governance (20%)
Entra ID users and groups, including dynamic groups (membership from a rule over user attributes, which needs a P1 licence). RBAC role assignments and the scope levels they can be made at — management group, subscription, resource group, resource — and the fact that assignments inherit downward.
Know the difference between Azure roles (access to resources) and Entra roles (access to identity administration). And know the four fundamental built-in roles: Owner (everything including granting access), Contributor (everything except granting access), Reader, and User Access Administrator (only granting access). "Contributor cannot grant permissions" is a reliable exam fact.
Then Azure Policy, resource locks, and management groups.
Implement and Manage Storage (20%)
Storage accounts and — the heavily-tested part — redundancy options:
| Option | Protects against |
|---|---|
| LRS | Disk/rack failure within one datacentre |
| ZRS | A whole datacentre (zone) failing, within one region |
| GRS | A whole region failing (secondary copy in the paired region, not readable) |
| RA-GRS | Same as GRS, but you can read the secondary |
| GZRS / RA-GZRS | Zone redundancy in the primary region and geo-replication |
The exam asks it as a requirement — "must survive a regional outage" (needs G-something) or "must survive a regional outage and be readable during it" (needs RA-). Learn to map requirement to acronym.
Then SAS tokens (delegated, time-limited, scope-limited access to storage without sharing the account key), access tiers with lifecycle management, and Azure Files with identity-based access.
Also nail Azure Backup versus Azure Site Recovery: Backup protects data so you can restore it; Site Recovery replicates whole machines so you can fail over to another region. One is backup, one is disaster recovery, and the exam checks you know which requirement each solves.
Monitor and Maintain Azure Resources (15%)
Azure Monitor metrics and logs, Log Analytics workspaces and KQL at a basic reading level (you should be able to look at a simple query and say what it returns), alerts and action groups, and Network Watcher — particularly IP flow verify and effective security rules, which are the tools the exam reaches for when something is being blocked and you need to find out why.
How to prepare
Get a free Azure account and actually build. This is not optional advice for AZ-104 the way it is for a fundamentals exam. Create a VNet with peered spokes and discover for yourself that spoke-to-spoke doesn't work. Deploy a scale set behind a load balancer. Configure an NSG, watch it block your own traffic, and use IP flow verify to find out which rule did it. Set up a storage account with lifecycle rules and a SAS token.
A weekend of this covers more of the exam than a fortnight of video.
Learn both portal and CLI. Questions freely mix the portal, Azure CLI, and PowerShell. You do not need to memorise every flag, but you should recognise a correct command shape and spot a wrong one.
Drill the governance hierarchy — management groups → subscriptions → resource groups → resources — and how policy, RBAC, and locks inherit down it.
Practise the structured formats. Hotspot and drag-and-drop reward format familiarity as much as knowledge.
Common pitfalls
Time management on case studies is the first — read the questions before the scenario. Forgetting that VNet peering is not transitive is the second, and it is remarkably persistent even in people who know they know it.
Beyond that: mixing up which replication option survives a regional outage, confusing Azure Backup with Site Recovery, and assuming Contributor can assign roles (it cannot).
After you pass
Check the official AZ-104 page for current pricing and the skills-measured document.
The certificate is valid for one year and renews free online with a much easier unproctored assessment. From here, administrators typically go deeper into networking (AZ-700) or security (AZ-500), or broaden into AWS with the Solutions Architect Associate if they work multi-cloud.
AZ-104 frequently asked questions
- How many questions are on the AZ-104 exam?
- The Microsoft Certified: Azure Administrator Associate has 50 questions and a 100-minute time limit — about 2 minutes per question. Prepa's mock exams mirror that exact count and clock so pacing on the day feels familiar.
- What score do you need to pass AZ-104?
- You need roughly 70% to pass the Microsoft Certified: Azure Administrator Associate. Prepa scores every practice session on the same scale and tracks a readiness score, so you know whether you are clearing the bar before you book.
- What topics does the AZ-104 exam cover?
- The Microsoft Certified: Azure Administrator Associate is split across 5 official domains: Manage Azure Identities and Governance (20%), Implement and Manage Storage (20%), Deploy and Manage Azure Compute Resources (25%), Implement and Manage Virtual Networking (20%), Monitor and Maintain Azure Resources (15%). Prepa weights your practice to match, so you spend the most time where the exam does.
- Which AZ-104 domain matters most?
- Deploy and Manage Azure Compute Resources carries the largest weight at 25% of the exam, so it decides more of your score than any other domain. Prepa detects the domains you keep missing and rebalances your study plan toward them automatically.
- Can I practise for the AZ-104 for free?
- Yes. Prepa's free tier gives you 10 fresh AI-generated AZ-104 questions every day, with a full explanation on every answer. No card required to start.
- Why is AZ-104 considered harder than other associate exams?
- Because it tests configuration detail, not concepts. Questions come down to NSG rule evaluation order, which storage replication option survives a regional outage, and whether VNet peering is transitive. You cannot reason your way to those from first principles — you either know them or you don't, and the fastest way to know them is to have configured them.
- Can I pass AZ-104 straight after AZ-900?
- It is possible but it is the hard road. AZ-900 teaches vocabulary; AZ-104 assumes you have clicked through the workflows. Budget at least a month of genuine portal time on a free account first — build a VNet, peer it, break connectivity with an NSG, and fix it. That month is worth more than any course.
- How long is AZ-104 valid for?
- One year, and Microsoft lets you renew it free with an online, unproctored assessment you can take from home. The renewal is considerably easier than the exam itself.