AZ-104 Study Guide 2026: Complete Azure Administrator Exam Prep
Everything you need to pass the Microsoft Azure Administrator exam — all 5 domains, a 6-week study plan, hands-on lab strategy, and what actually appears on test day.
Quick Summary
- • AZ-104 is an Associate-level exam with 40–60 questions, 120 minutes, 700/1000 passing score
- • Covers 5 domains: identities/governance, storage, compute, networking, monitoring
- • Most candidates need 6–10 weeks of preparation (hands-on labs required)
- • Exam cost: $165 USD
What is the AZ-104 Exam?
AZ-104 is Microsoft's Associate-level certification for Azure Administrators. It validates that you can manage Azure subscriptions, secure identities, administer infrastructure, configure virtual networking, and monitor resources in a production Azure environment.
Passing AZ-104 earns you the Microsoft Certified: Azure Administrator Associate credential — one of the most respected and widely recognized Azure certifications in the industry. It proves you can operate Azure day-to-day, not just explain what it is.
Unlike AZ-900, AZ-104 tests hands-on implementation skills. You need real portal and CLI experience. Candidates who rely only on documentation without touching Azure consistently underperform on this exam.
| Detail | Information |
|---|---|
| Exam Code | AZ-104 |
| Credential Earned | Azure Administrator Associate |
| Number of Questions | 40–60 questions |
| Time Limit | 120 minutes |
| Passing Score | 700 out of 1000 |
| Exam Price | $165 USD |
| Exam Level | Associate |
| Prerequisites | None (AZ-900 recommended) |
AZ-104 Exam Domains & Weightings
AZ-104 covers five functional domains. Networking and compute together account for nearly half the exam — these deserve the most lab time.
Domain 1: Manage Azure Identities and Governance
20–25%- • Microsoft Entra ID users, groups, and dynamic group membership rules
- • RBAC — built-in roles, custom roles, role assignments at subscription/resource group/resource scope
- • Azure subscriptions — management groups, subscription policies, cost management
- • Azure Policy — policy definitions, initiatives, compliance reporting, remediation tasks
- • Resource locks (read-only, delete) and resource tagging strategies
Study tip: Know the difference between Azure Policy (enforce governance rules) and RBAC (control who can do what). Many candidates confuse these.
Domain 2: Implement and Manage Storage
15–20%- • Storage accounts — SKUs (Standard/Premium), replication options (LRS/ZRS/GRS/GZRS)
- • Blob storage — access tiers (Hot/Cool/Archive), lifecycle management policies, versioning
- • Azure Files — SMB/NFS shares, Azure File Sync, storage tiers
- • Shared access signatures (SAS), stored access policies, storage encryption
- • Azure Import/Export service and Azure Data Box for large data migrations
Domain 3: Deploy and Manage Azure Compute Resources
20–25%- • Virtual Machines — VM sizes, availability sets vs. availability zones, scale sets
- • Azure App Service — App Service plans, deployment slots, auto-scaling
- • Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) basics
- • ARM templates and Bicep for infrastructure as code deployment
- • VM extensions, custom script extensions, desired state configuration (DSC)
- • Azure Backup for VMs and Azure Site Recovery for disaster recovery
Study tip: The exam heavily tests availability — know when to use availability sets (fault/update domains) vs. availability zones (datacenters).
Domain 4: Implement and Manage Virtual Networking
15–20%- • Virtual Networks (VNets) — subnets, IP addressing, VNet peering
- • Network Security Groups (NSGs) — inbound/outbound rules, service tags, application security groups
- • Azure DNS — public and private DNS zones, record types
- • Load balancing — Azure Load Balancer (L4) vs. Application Gateway (L7) vs. Traffic Manager vs. Front Door
- • VPN Gateway — site-to-site, point-to-site, VNet-to-VNet connections
- • Azure Bastion and Just-in-Time VM access
Study tip: The four load balancing options are a frequent exam topic. Map each to its use case: global vs. regional, HTTP vs. any protocol.
Domain 5: Monitor and Maintain Azure Resources
10–15%- • Azure Monitor — metrics, alerts, action groups, diagnostic settings
- • Log Analytics workspaces — KQL queries, data sources, workspace design
- • Application Insights — performance monitoring, availability tests, smart detection
- • Azure Advisor — recommendations for cost, security, reliability, performance
- • Azure Service Health — service issues, planned maintenance, health advisories
Ready to test yourself?
Try 40 Free AZ-104 Practice Questions
Scenario-based questions with detailed explanations. No credit card required.
Start Free Practice →How Hard is AZ-104?
AZ-104 is one of the more demanding Associate-level Azure exams. The breadth of content — spanning five different technical domains — combined with scenario-based questions that require you to reason through real-world problems makes it significantly harder than AZ-900. Most candidates who pass have at least some hands-on Azure experience.
Why candidates fail AZ-104
- • No hands-on lab time: AZ-104 tests applied knowledge. Reading about VNet peering is not the same as configuring it.
- • Weak on networking: Many candidates underestimate the networking domain. NSG rule evaluation order, load balancer selection, and VPN gateway types are heavily tested.
- • Mixing up storage options: Knowing the difference between LRS, ZRS, GRS, and GZRS — and when to use each — trips up many candidates.
- • Not understanding ARM/Bicep: Infrastructure-as-code questions appear more frequently than most candidates expect.
6-Week AZ-104 Study Plan
This plan assumes 1.5–2 hours per day including hands-on lab time. You need an active Azure subscription (free account works for most labs).
Week 1: Identities & Governance
- Days 1–2: Entra ID — users, groups, dynamic membership, bulk operations
- Days 3–4: RBAC — assign built-in roles, create custom roles, understand scope hierarchy
- Days 5–6: Azure Policy — assign built-in policies, create custom policy, initiatives, compliance dashboard
- Day 7: Management groups, subscriptions, resource locks, tagging strategies + practice questions
Week 2: Storage
- Days 1–2: Create storage accounts, configure replication, explore access tiers
- Days 3–4: Blob lifecycle policies, versioning, SAS tokens, stored access policies
- Days 5–6: Azure Files — create SMB share, configure Azure File Sync
- Day 7: Storage security — encryption, private endpoints, firewall + practice questions
Week 3: Compute Resources
- Days 1–2: Deploy VMs — availability sets, availability zones, VM scale sets
- Days 3–4: App Service — create web app, configure deployment slots, auto-scaling rules
- Days 5–6: ARM templates and Bicep — deploy resources from template, understand parameters/variables
- Day 7: Azure Backup for VMs, Site Recovery concepts + practice questions
Week 4: Virtual Networking
- Days 1–2: Create VNets, subnets, configure VNet peering, understand address space planning
- Days 3–4: NSGs — create and apply rules, service tags, application security groups
- Days 5–6: Load balancers — Azure Load Balancer, Application Gateway basics, Traffic Manager, Front Door
- Day 7: VPN Gateway — site-to-site concepts, Azure Bastion, private DNS zones
Week 5: Monitoring & Maintenance
- Days 1–2: Azure Monitor — configure metrics, create alerts and action groups
- Days 3–4: Log Analytics — create workspace, configure data collection, write basic KQL queries
- Days 5–6: Application Insights setup, Azure Advisor review, Service Health alerts
- Day 7: Full domain review + first full practice exam
Week 6: Mock Exams & Targeted Review
- Days 1–2: Review weak areas identified in week 5 practice exam
- Day 3: Second full timed practice exam (120 min)
- Days 4–5: Focus on any domain still below 70%
- Day 6: Third mock exam — aim for 80%+
- Day 7: Light review only. Book exam if consistently 80%+.
Best AZ-104 Study Resources
1. Microsoft Learn AZ-104 Learning Path (Free)
The official learning path covers all five domains with hands-on sandbox labs. The sandboxed labs are free and require no Azure subscription. This is the most important free resource — complete every lab exercise, not just the reading modules.
2. Free Azure Account (Hands-On)
Create a free Azure account for $200 credit (30 days) plus always-free services. Use this to practice configurations that go beyond what the Microsoft Learn sandbox allows — especially VPN gateways, load balancers, and complex networking scenarios.
3. MSCertQuiz Practice Tests
500 AZ-104 practice questions across all five domains with detailed explanations. Strong emphasis on scenario-based questions that mirror real exam format. Use practice mode to understand explanations, then timed mode to simulate exam pressure.
Start free AZ-104 practice →4. John Savill's AZ-104 Study Playlist (YouTube)
The best free video content for AZ-104. Savill covers deep technical nuance — especially networking and storage — that many study guides miss. His "AZ-104 Study Cram" is particularly useful for final-week review.
AZ-104 Exam Day Tips
Do
- • Read every scenario constraint — "minimal cost," "minimal downtime," "without changing existing permissions" each point to different answers
- • For networking questions, mentally draw the topology before selecting an answer
- • Flag complex scenario questions and return to them — don't spend 5+ minutes on one early question
- • Know that availability zones > availability sets for high availability in new deployments
Don't
- • Don't confuse NSG rules with Azure Firewall — NSGs are for subnets/NICs, Azure Firewall is centralized
- • Don't mix up LRS (single datacenter) and ZRS (multiple zones) — know which survives a zone failure
- • Don't ignore the KQL/Log Analytics questions — basic query syntax does appear
- • Don't forget Azure Policy evaluates at assignment time AND on an ongoing schedule
Ready to Practice AZ-104?
500 scenario-based questions across all 5 domains. Practice mode with explanations + timed exam simulation.
Start Free Practice →Frequently Asked Questions
Do I need AZ-900 before AZ-104?
No, AZ-900 is not a prerequisite. However, if you have no Azure background, completing AZ-900 first (or studying equivalent fundamentals content) will make AZ-104 significantly easier. Candidates who jump straight to AZ-104 without foundational knowledge often struggle with the governance and identity domains.
How long does it take to study for AZ-104?
Most candidates need 6–10 weeks with 1.5–2 hours of study per day. Azure administrators with 1–2 years of hands-on Azure experience can often compress this to 3–4 weeks. Candidates with no prior Azure experience should plan for 10–12 weeks.
Is AZ-104 harder than AZ-900?
Significantly harder. AZ-900 tests conceptual cloud knowledge. AZ-104 tests applied administration skills across five technical domains. The questions are scenario-based, requiring you to reason through real-world problems — not just recall definitions.
What comes after AZ-104?
AZ-104 is a strong foundation for Azure expert-level exams like AZ-305 (Azure Solutions Architect Expert). For security, add SC-300 or AZ-500. For networking depth, AZ-700 is the next step. Many candidates also pursue AZ-204 (Developer) as a complement to AZ-104.