Azure Administrator Certification Guide (AZ-104)

The Azure Administrator (AZ-104) is the most popular Azure certification for hands-on cloud administrators. It validates your ability to manage Azure identities, storage, compute, networking, and governance.

Exam Overview

Detail	Value
Exam Code	AZ-104
Provider	Microsoft
Questions	40–60 (multiple choice + case studies)
Length	120 minutes
Passing Score	700 (on a scale of 100–1000)
Validity	1 year (Microsoft role-based)
Price	~$165 USD
Prerequisites	Azure Fundamentals (AZ-900) recommended

Domain Breakdown

Domain	Weight
Manage Azure Identities and Governance	20%
Implement and Manage Storage	15%
Deploy and Manage Azure Compute Resources	25%
Configure and Manage Virtual Networking	25%
Monitor and Maintain Azure Resources	15%

Domain Deep Dives

1. Manage Azure Identities and Governance (20%)

Azure AD (Entra ID)

Users, groups (security vs Microsoft 365), administrative units, bulk operations
Licensing — Self-service password reset (SSPR), combined registration
RBAC — Roles (built-in vs custom), scopes (management group, subscription, resource group, resource)
Azure Policy — Built-in vs custom policies, policy initiatives, remediation tasks, compliance
Management Groups — Hierarchy, subscription organization, policy inheritance
Azure Blueprints — Artifacts (policies, RBAC, ARM templates), versioning, publishing
Resource Locks — Read-only, delete, inheritance (CanNotDelete, ReadOnly)

Key CLI/Azure Portal Tasks

Create and configure management groups, subscriptions, resource groups
Assign RBAC roles at different scopes
Create and assign Azure Policy (e.g., enforce tagging, allowed locations)
Configure resource locks

2. Implement and Manage Storage (15%)

Storage Accounts

Types (v2, v1, BlobStorage, FileStorage)
Replication (LRS, ZRS, GRS, RA-GRS, GZRS, RA-GZRS)
Access tiers (Hot, Cool, Archive)
Endpoints (blob, file, queue, table)
Networking (firewalls, service endpoints, private endpoints)

Blob Storage

Blob types (Block, Page, Append)
Lifecycle management rules
Versioning, soft delete, snapshots, immutability policies
Azure Files — SMB and NFS shares, Azure File Sync, on-premises caching

Security

Shared Access Signatures (SAS) — Service SAS, Account SAS, User delegation SAS
Storage Service Encryption (SSE) — Platform-managed vs customer-managed keys
Azure AD authentication for blobs and queues
Defender for Storage — Threat detection

Tools

Azure Storage Explorer, AzCopy, Azure Import/Export

3. Deploy and Manage Azure Compute Resources (25%)

Virtual Machines

Sizing (general purpose, compute optimized, memory optimized, storage optimized, GPU)
Availability Sets (update/fault domains) vs Availability Zones
VM Scale Sets (VMSS) — Autoscaling, instance orchestration
Disks — OS disk, temp disk, data disks; managed disks (HDD, SSD standard, SSD premium, Ultra)
Networking — NICs, IP configurations, accelerated networking
ARM Templates — Infrastructure as Code for VM deployment

Containers

Azure Container Instances (ACI) — Quick container deployment
Azure Container Registry (ACR) — Private container registry, ACR tasks, geo-replication
Azure Kubernetes Service (AKS) — Cluster deployment, node pools, scaling

Serverless

Azure Functions — Consumption vs Premium vs Dedicated plans, triggers, bindings
Azure App Service — Web Apps, API Apps, deployment slots, auto-scaling, custom domains, SSL/TLS

4. Configure and Manage Virtual Networking (25%)

Virtual Networks

Address space, subnets, CIDR planning
VNet peering (same region vs global), gateway transit
DNS — Custom DNS servers, private DNS zones, DNS resolution

Connectivity

VPN Gateway — Site-to-site, point-to-site, VNet-to-VNet
ExpressRoute — Dedicated private connection, circuits, peering (private, Microsoft)
Virtual WAN — Hub-spoke topology, branch connectivity

Private Access

Private Link — Private endpoints for Azure services
Service Endpoints — Secure access to Azure PaaS from VNet
Azure DNS Private Resolver — DNS resolution for hybrid networks

Load Balancing

Azure Load Balancer — Public vs internal, layer 4, HA ports, backend pools, health probes
Application Gateway — Layer 7 (HTTP/HTTPS), Web Application Firewall (WAF), URL-based routing, SSL termination
Traffic Manager — DNS-based traffic routing (performance, geographic, weighted, priority)
Front Door — Global HTTP/HTTPS load balancing, WAF, acceleration, domain fronting

Network Security

Network Security Groups (NSGs) — Inbound/outbound rules, service tags, application security groups
Azure Firewall — Stateful firewall, DNAT, threat intelligence, DNS proxy, forced tunneling
DDoS Protection — Basic (free) vs Standard ($3k/month)
Azure Bastion — Secure RDP/SSH access without public IPs

5. Monitor and Maintain Azure Resources (15%)

Azure Monitor

Metrics (platform vs custom), metric alerts, diagnostic settings
Log Analytics workspaces, KQL (Kusto Query Language), log queries
Application Insights — Telemetry, distributed tracing, availability tests

Monitoring Tools

Azure Advisor — Best practice recommendations (cost, security, reliability, performance, operational excellence)
Azure Service Health — Service issues, planned maintenance, health advisories
Azure Monitor Workbooks — Custom visualizations and dashboards

Backup and Recovery

Azure Backup — VM backup, Azure Files backup, SQL/SAP HANA backup, Recovery Services vault
Azure Site Recovery — Replication for disaster recovery, failover/test failover, recovery plans
Soft delete for blobs, recovery of deleted storage accounts

Cost Management

Azure Cost Management + Billing — Analyze costs, budgets, alerts
Azure Pricing Calculator, TCO Calculator
Tags for cost allocation, cost optimization recommendations

Key CLI / PowerShell Commands

# Azure CLI
az group create --name rg-demo --location westeurope
az vm create --resource-group rg-demo --name vm-web --image UbuntuLTS --admin-username azureuser
az network vnet create --resource-group rg-demo --name vnet-demo --address-prefix 10.0.0.0/16
az storage account create --name mystorageaccount --resource-group rg-demo --sku Standard_GRS
az backup protection enable-for-vm --resource-group rg-demo --vault-name rs-vault --vm vm-web

Study Tips

Hands-on is essential — Create a free Azure account and build everything yourself
Master KQL — Log Analytics queries are heavily tested (let's write queries)
Understand networking deeply — VNet peering vs VPN vs ExpressRoute, NSG vs Firewall vs WAF
Know your storage options — Blob vs File vs Disk vs Queue vs Table, and when to use each
Practice ARM templates — Understand JSON structure, parameters, variables, and outputs
Learn Azure AD vs AD DS — Cloud-only vs hybrid identity, Entra ID Connect

Practice Questions

Test your knowledge with our Azure Administrator practice questions — 50+ questions covering all exam domains.

Start Practice →

Career Impact

AZ-104 validates practical Azure administration:

Azure Administrator — $80k–$120k
Cloud Administrator — $75k–$110k
Systems Administrator (Azure) — $70k–$100k
DevOps Engineer — $100k–$140k

Next: Azure Solutions Architect (AZ-305) or Azure DevOps Engineer (AZ-400)

Azure Administrator Exam Guide (AZ-104)