This cheat sheet is a fast, exam-focused review of everything on AZ-104 (Microsoft Azure Administrator). AZ-104 is an associate-level exam with hands-on configuration questions, so treat this as a consolidation aid for your final days — pair it with an Azure free-tier subscription and real lab practice, not instead of it.
Exam Snapshot
Passing Score
700 / 1000
Cost
$165 USD
Questions
40–60
Time
~120 minutes
Identity & Governance
20–25%
Storage
15–20%
Compute
20–25%
Networking
15–20%
Monitor & Maintain
10–15%
1. Manage Azure Identities & Governance
| Concept | What it means |
|---|---|
| Management groups → subscriptions → resource groups → resources | The scope hierarchy for RBAC and policy; settings inherit downward. |
| Azure RBAC | Assign built-in or custom roles (Owner, Contributor, Reader) at a scope. |
| Azure Policy | Enforce rules (audit, deny, append) across resources; group into initiatives. |
| Resource locks | CanNotDelete or ReadOnly — prevents accidental changes regardless of RBAC. |
| Tags | Key-value metadata for cost tracking, automation, and organization. |
| Azure AD/Entra users & groups | Assigned vs dynamic groups; guest users for external collaboration. |
| Cost Management + Budgets | Track spend, set budgets and alerts, analyze cost by resource or tag. |
Most-tested distinction: a resource lock blocks an action (delete/modify) regardless of a user's RBAC permissions. RBAC controls whether a user can attempt the action at all. Use both together for critical resources.
2. Implement & Manage Storage
Redundancy options
| LRS | Locally redundant — 3 copies in one datacenter. |
| ZRS | Zone redundant — copies across availability zones in one region. |
| GRS / GZRS | Geo-redundant — async-replicated to a secondary region (GZRS adds zone redundancy in the primary). |
| RA-GRS / RA-GZRS | Adds read access to the secondary region's replica. |
Blob access tiers & lifecycle
| Hot | Frequent access, highest storage cost, lowest access cost. |
| Cool / Cold | Infrequent access (30+ / 90+ days), lower storage cost, higher access cost. |
| Archive | Rarely accessed; lowest cost but requires rehydration (hours) before reading. |
| Lifecycle management policy | Automatically tier or delete blobs based on age rules. |
Access & data movement
| SAS | Shared access signature — scoped, time-limited access without sharing account keys. |
| Azure Files vs Blob | Files = SMB/NFS file shares (mountable as a drive); Blob = object storage for unstructured data. |
| AzCopy / Storage Explorer | Command-line and GUI tools for bulk upload, download, and migration. |
| Soft delete / versioning | Recover accidentally deleted or overwritten blobs within a retention window. |
Most-tested distinction: LRS/ZRS protect against hardware/datacenter failure within a region; GRS/GZRS protect against a full regional outage. Read access (RA-) only matters if the app needs to read from the secondary during an outage.
Test the concepts you just reviewed
Try 40 Free AZ-104 Practice Questions
Scenario-based questions with detailed explanations. No credit card required.
Start Free Practice →3. Deploy & Manage Compute
Virtual machines & resiliency
| Availability Set | Fault domains + update domains within one datacenter — protects against local hardware/maintenance failure. |
| Availability Zone | Physically separate datacenters in one region — protects against a full datacenter outage. |
| VM scale sets | Auto-scale identical VM instances based on load or schedule. |
| VM extensions | Post-deployment configuration (Custom Script Extension, Desired State Configuration). |
| Managed disks | Standard HDD/SSD, Premium SSD, Ultra Disk — pick by IOPS/throughput needs. |
Deployment & containers
| ARM templates / Bicep | Declarative infrastructure-as-code; Bicep compiles down to ARM JSON. |
| Azure Container Instances (ACI) | Run a single container without managing VMs or orchestration. |
| Azure App Service | Managed PaaS hosting for web apps; deployment slots for staged rollouts. |
| Azure Kubernetes Service (AKS) — basics | Managed Kubernetes control plane; node pools scale the workload nodes. |
Most-tested distinction: an Availability Set only protects against failures inside one datacenter; an Availability Zone protects against losing an entire datacenter. Zones are not available in every region — check before designing for them.
4. Implement & Manage Virtual Networking
| Component | Purpose |
|---|---|
| VNet & subnets | Private network address space; subnets segment it and host resources. |
| NSG | Free, stateful 5-tuple packet filter applied to a subnet or NIC. |
| VNet peering | Connect two VNets privately over the Azure backbone; non-transitive by default. |
| Azure Load Balancer | Layer 4 (TCP/UDP) traffic distribution — public or internal. |
| Application Gateway | Layer 7 web traffic load balancer with URL-based routing and optional WAF. |
| VPN Gateway | Encrypted site-to-site or point-to-site connectivity to on-prem. |
| Azure Bastion | RDP/SSH to VMs over TLS via the portal — no public IP needed on the VM. |
| Azure DNS / Private DNS | Host public zones or private zones resolved only within linked VNets. |
Load Balancer vs Application Gateway: Load Balancer works at the transport layer (any TCP/UDP traffic); Application Gateway understands HTTP(S) and can route by URL path or host header, and add a Web Application Firewall.
5. Monitor & Maintain Resources
| Tool | Purpose |
|---|---|
| Azure Monitor | Central platform for metrics, logs, and alerts across resources. |
| Log Analytics workspace | Query collected log data with Kusto Query Language (KQL). |
| Alerts & action groups | Trigger notifications or automated actions when a metric/log condition is met. |
| Network Watcher | Diagnose connectivity (IP flow verify, connection troubleshoot, packet capture). |
| Azure Backup | Scheduled, policy-based backup for VMs, files, and databases via a Recovery Services vault. |
| Azure Site Recovery | Disaster recovery — replicate VMs to another region for failover. |
| Update Manager | Schedule and track OS patching across VMs. |
Most-tested distinction: Azure Backup restores data after loss or corruption; Azure Site Recovery fails over an entire workload to another region during an outage. They are complementary, not interchangeable.
6. Acronym Quick List
RBAC — Role-Based Access Control
NSG — Network Security Group
VNet — Virtual Network
LRS / ZRS / GRS / GZRS — Storage redundancy options
SAS — Shared Access Signature
ARM — Azure Resource Manager
ACI / AKS — Azure Container Instances / Kubernetes Service
VPN — Virtual Private Network
WAF — Web Application Firewall
KQL — Kusto Query Language
ASR — Azure Site Recovery
IOPS — Input/Output Operations Per Second
PaaS / IaaS — Platform / Infrastructure as a Service
DR — Disaster Recovery
Reviewed the cheat sheet? Now prove you're ready.
Take the free 5-minute AZ-104 readiness quiz — no signup required — or jump into 40 free practice questions calibrated harder than the real exam.
Common Questions
Is a cheat sheet enough to pass AZ-104?
No. AZ-104 is an associate-level exam with scenario, configuration, and drag-and-drop questions that assume real hands-on Azure administration experience. A cheat sheet is a fast final-review aid to consolidate service names and when-to-use decisions — use it alongside labs, Microsoft Learn, and practice questions, not instead of them.
What is the difference between a Network Security Group and Azure Firewall?
A Network Security Group (NSG) is a free, stateful packet filter applied to subnets or NICs using 5-tuple allow/deny rules. Azure Firewall is a managed, stateful network firewall service with FQDN filtering and centralized policy for an entire virtual network or hub, not just a single subnet.
What is the difference between an Availability Set and an Availability Zone?
An Availability Set groups VMs across fault domains and update domains within a single datacenter to protect against local hardware failure and planned maintenance. An Availability Zone spans physically separate datacenters within an Azure region, protecting against an entire datacenter outage — a stronger guarantee, but not available in every region.
What is the passing score and cost for AZ-104?
700 out of 1000 (roughly 70%). The exam costs $165 USD, has around 40–60 questions, and a time limit of about 120 minutes.
About MSCertQuiz
MSCertQuiz provides 500 practice questions per certification, calibrated harder than the real exam so test day feels easier. Questions are built by certified professionals and updated for 2026 exam objectives. Start with 40 free questions — no credit card required.