Prepare for the Microsoft Azure Administrator (AZ-104) certification with an exam overview, official skills domains, study strategy, practice questions, and a structured preparation plan.
Microsoft Azure is widely used by organizations to host applications, manage infrastructure, store data, and deliver cloud services. As businesses continue to adopt cloud technologies, skilled Azure administrators play an important role in maintaining secure, reliable, and efficient cloud environments.
The Microsoft AZ-104: Azure Administrator certification validates the skills required to implement, manage, and monitor an organization’s Azure environment. It is a valuable credential for IT professionals who want to demonstrate practical knowledge of Azure identities, governance, storage, compute, networking, monitoring, and backup.
This guide covers the AZ-104 exam, its current skills measured, preparation strategies, a four-week study plan, five original practice questions, and SEO details for Clearcatnet.com.
What Is the Microsoft AZ-104 Certification?
The Microsoft Certified: Azure Administrator Associate certification demonstrates your ability to manage key Azure services and resources.
Azure administrators commonly work with:
- Microsoft Entra ID and identity management
- Azure subscriptions and resource groups
- Role-based access control
- Azure Policy and governance
- Storage accounts and data services
- Virtual machines and compute resources
- Virtual networks and connectivity
- Azure Monitor and alerts
- Backup and disaster recovery
The certification is designed for professionals who administer Azure environments and collaborate with networking, security, database, application development, and DevOps teams.
AZ-104 Exam Overview
| Exam Feature | Details |
|---|
| Certification | Microsoft Certified: Azure Administrator Associate |
| Exam Code | AZ-104 |
| Certification Level | Associate / Intermediate |
| Exam Duration | 100 minutes |
| Exam Format | Proctored exam; question types may vary |
| Passing Score | 700 out of 1,000 |
| Exam Fee | Depends on the country or region |
| Exam Delivery | Pearson VUE |
| Certification Renewal | Annual renewal through Microsoft Learn |
| Recommended Experience | Practical experience administering Azure resources |
Microsoft may update exam objectives and delivery details. Review the official AZ-104 exam page before scheduling your exam.
AZ-104 Exam Domains and Weightings
According to Microsoft’s study guide, the skills measured as of April 17, 2026, are divided into five domains.
| Exam Domain | Weight |
|---|
| Manage Azure identities and governance | 20–25% |
| Implement and manage storage | 15–20% |
| Deploy and manage Azure compute resources | 20–25% |
| Implement and manage virtual networking | 15–20% |
| Monitor and maintain Azure resources | 10–15% |
Preparation tip: Identity and governance, along with compute, are among the highest-weighted domains. However, practical questions may combine several topics—for example, deploying a virtual machine while configuring network security, monitoring, and backup.
Detailed AZ-104 Syllabus
Domain 1: Manage Azure Identities and Governance — 20–25%
This domain focuses on managing identities, access, subscriptions, and governance controls.
Key topics include:
- Create and manage Microsoft Entra users and groups
- Configure user and group properties
- Manage licenses
- Manage external users
- Configure self-service password reset
- Assign and interpret Azure roles
- Manage role assignments at different scopes
- Configure Azure Policy
- Configure resource locks and tags
- Manage resource groups and subscriptions
- Configure management groups
- Monitor costs using budgets, alerts, and Azure Advisor
Important services: Microsoft Entra ID, Azure Role-Based Access Control (RBAC), Azure Policy, Azure Resource Manager, Azure Advisor, and Microsoft Cost Management.
Domain 2: Implement and Manage Storage — 15–20%
This domain validates your ability to configure Azure Storage and control access to stored data.
Key topics include:
- Create and configure storage accounts
- Configure storage redundancy
- Configure storage account encryption
- Configure storage firewalls and virtual networks
- Manage access keys and Shared Access Signatures (SAS)
- Configure stored access policies
- Configure identity-based access for Azure Files
- Use Azure Storage Explorer and AzCopy
- Create Azure Files shares and Blob containers
- Configure storage tiers
- Configure soft delete and snapshots
- Configure blob versioning and lifecycle management
- Configure object replication
Important services: Azure Storage, Azure Blob Storage, Azure Files, Azure Storage Explorer, and AzCopy.
Domain 3: Deploy and Manage Azure Compute Resources — 20–25%
This domain covers deploying, configuring, and maintaining Azure compute services.
Key topics include:
- Deploy and configure virtual machines
- Configure VM size, disks, and networking
- Configure VM availability and scaling
- Manage VM extensions
- Deploy resources using ARM templates or Bicep
- Interpret and modify deployment templates
- Create and configure App Service plans
- Configure App Services and scaling
- Configure certificates and TLS
- Map custom DNS names to App Services
- Configure App Service backups
- Configure deployment slots and networking settings
Important services: Azure Virtual Machines, Virtual Machine Scale Sets, Azure App Service, Azure Resource Manager, and Bicep.
Domain 4: Implement and Manage Virtual Networking — 15–20%
This domain focuses on Azure network configuration, secure connectivity, and troubleshooting.
Key topics include:
- Create and configure virtual networks and subnets
- Configure virtual network peering
- Configure public IP addresses
- Configure user-defined routes
- Troubleshoot network connectivity
- Configure Network Security Groups (NSGs)
- Configure Application Security Groups
- Evaluate effective security rules
- Implement Azure Bastion
- Configure service endpoints and private endpoints
- Configure Azure DNS
- Configure internal and public load balancers
- Troubleshoot load balancing
Important services: Azure Virtual Network, NSG, Azure Bastion, Azure DNS, Azure Load Balancer, Private Link, and Network Watcher.
Domain 5: Monitor and Maintain Azure Resources — 10–15%
This domain validates your ability to monitor Azure resources, respond to alerts, and protect workloads through backup and recovery.
Key topics include:
- Interpret Azure Monitor metrics
- Configure diagnostic and log settings
- Query and analyze logs
- Configure alert rules and action groups
- Configure alert processing rules
- Monitor virtual machines, storage, and networks
- Use Azure Monitor Insights
- Use Network Watcher and Connection Monitor
- Create Recovery Services vaults and Backup vaults
- Configure backup policies
- Perform backup and restore operations
- Configure Azure Site Recovery
- Perform failover to a secondary region
- Review backup reports and alerts
Important services: Azure Monitor, Log Analytics, Network Watcher, Azure Backup, Recovery Services vaults, and Azure Site Recovery.
How to Prepare for the AZ-104 Exam
1. Review the Official Skills Measured
Start with Microsoft’s official AZ-104 study guide. Create a checklist of every objective and mark each topic as:
- Not started
- Studying
- Practiced
- Ready for revision
This helps you track progress and avoid skipping smaller objectives.
2. Build Practical Azure Experience
AZ-104 is a practical administrator exam. Use an Azure learning environment to practice:
- Creating users and groups
- Assigning Azure roles
- Creating resource groups and policies
- Deploying virtual machines
- Configuring storage accounts
- Creating virtual networks and subnets
- Configuring NSGs and private endpoints
- Creating monitoring alerts
- Performing backup and restore operations
Use a training subscription or authorized lab environment, and monitor costs while practicing.
3. Learn Azure RBAC and Governance
Understand the relationship between users, groups, roles, and scopes. Practice assigning roles at the management group, subscription, resource group, and resource levels.
Also learn how Azure Policy differs from RBAC:
- RBAC controls who can perform actions.
- Azure Policy controls whether resources comply with organizational requirements.
4. Practice Storage Access and Redundancy
Know the differences between storage redundancy options, including locally redundant, zone-redundant, and geo-redundant storage.
Practice selecting the right access method for each scenario, including access keys, SAS, and Microsoft Entra identity-based access.
5. Strengthen Networking Fundamentals
Review IP addressing, subnetting, DNS, routing, network security, and connectivity troubleshooting.
Practice identifying when to use:
- VNet peering
- NSGs
- User-defined routes
- Service endpoints
- Private endpoints
- Azure Bastion
- Azure Load Balancer
6. Review Monitoring and Recovery
Create Azure Monitor alerts and action groups. Practice interpreting metrics and logs, configuring backup policies, and understanding Azure Site Recovery failover.
Pay attention to recovery requirements such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
7. Take Practice Assessments
Microsoft offers a practice assessment to help candidates understand the style and difficulty of exam questions.
After each practice test, review every incorrect answer and revisit the corresponding Microsoft Learn topic.
Four-Week AZ-104 Study Plan
| Week | Focus Areas | Recommended Activities |
|---|
| Week 1 | Identity and governance | Practice Entra users, groups, RBAC, Azure Policy, resource locks, tags, and budgets |
| Week 2 | Storage and compute | Create storage accounts, configure access, deploy VMs, and practice App Service |
| Week 3 | Virtual networking | Configure VNets, subnets, peering, NSGs, private endpoints, DNS, and load balancing |
| Week 4 | Monitoring, backup, and revision | Configure alerts, Log Analytics, backup, Site Recovery, and complete timed practice tests |
If you are new to Azure administration, consider extending this plan to six or eight weeks so you have more time for hands-on practice.
Five AZ-104 Practice Questions
These original practice questions are designed to reinforce AZ-104 concepts. They are not actual Microsoft exam questions.
Question 1: Azure Role-Based Access Control
A company wants a developer to manage virtual machines in one resource group but prevent the developer from assigning permissions to other users. Which approach is most appropriate?
A. Assign the Owner role at the subscription scope
B. Assign the Virtual Machine Contributor role at the required resource group scope
C. Assign the Global Administrator role in Microsoft Entra ID
D. Assign the Contributor role at the management group scope
Correct Answer: B. Assign the Virtual Machine Contributor role at the required resource group scope
Explanation: The Virtual Machine Contributor role allows management of virtual machines without granting general permission-management capabilities. Assigning it at the resource group scope limits access to the required resources.
Question 2: Azure Storage Redundancy
An organization needs storage data to remain available if an entire Azure availability zone becomes unavailable. Which redundancy option should it select in a supported region?
A. Locally redundant storage (LRS)
B. Zone-redundant storage (ZRS)
C. A single storage account with no redundancy
D. A local disk attached to one virtual machine
Correct Answer: B. Zone-redundant storage (ZRS)
Explanation: ZRS synchronously replicates data across multiple availability zones in a region, helping protect against a zone-level outage.
Question 3: Private Access to Azure PaaS
A company wants virtual machines in a virtual network to access an Azure Storage account privately without using its public endpoint. Which solution best meets the requirement?
A. Configure a public IP address on each virtual machine
B. Create a private endpoint for the storage account
C. Configure an Azure DNS public zone only
D. Disable all virtual network subnets
Correct Answer: B. Create a private endpoint for the storage account
Explanation: A private endpoint provides a private IP address from the virtual network for accessing a supported Azure service. DNS must also be configured appropriately so clients resolve the service name to the private endpoint.
Question 4: Azure Policy
An organization wants to ensure that newly deployed resources include a required tag. It also wants to identify existing resources that do not comply.
Which Azure service should it use?
A. Azure Policy
B. Azure Bastion
C. Azure Load Balancer
D. Azure Site Recovery
Correct Answer: A. Azure Policy
Explanation: Azure Policy can enforce or audit organizational requirements, including required tags. It can evaluate resources for compliance and, when configured appropriately, support remediation.
Question 5: Azure Backup
A company wants to protect Azure virtual machines and restore them after accidental deletion or data loss. Which service should it use?
A. Azure DNS
B. Azure Backup with a Recovery Services vault
C. Azure Virtual Network peering
D. Azure Application Gateway
Correct Answer: B. Azure Backup with a Recovery Services vault
Explanation: Azure Backup supports VM protection through backup policies and recovery points stored in a Recovery Services vault. The organization can use these recovery points to restore protected workloads.
Frequently Asked Questions
What is AZ-104?
AZ-104 is the Microsoft Azure Administrator exam. Passing it earns the Microsoft Certified: Azure Administrator Associate certification.
How difficult is the AZ-104 exam?
AZ-104 is an intermediate-level certification exam. It can be challenging for candidates without practical Azure experience because it tests configuration, troubleshooting, and service-selection skills.
What is the passing score for AZ-104?
Microsoft requires a score of 700 out of 1,000 to pass.
How long is the AZ-104 exam?
The exam assessment duration is 100 minutes. Review the current exam page for the latest exam-day details.
Is hands-on practice necessary?
Hands-on practice is strongly recommended. Candidates should be comfortable working with the Azure portal, Azure CLI, PowerShell, and ARM templates or Bicep.
How long should I prepare for AZ-104?
Candidates with Azure administration experience may prepare in four weeks. Beginners may need six to eight weeks or longer, depending on their background and study time.
Does AZ-104 certification expire?
The Azure Administrator Associate certification requires annual renewal. Microsoft provides a renewal assessment through Microsoft Learn.
Where can I find official AZ-104 study resources?
Use the official Microsoft Learn study guide, learning paths, practice assessment, and exam sandbox.
Conclusion
The Microsoft AZ-104: Azure Administrator certification is an important credential for professionals who want to demonstrate practical Azure administration skills.
To prepare effectively, combine official Microsoft Learn resources with hands-on practice. Focus on identity and governance, storage, compute, networking, monitoring, and recovery. Review the exam objectives regularly, practice scenario-based questions, and strengthen the areas where you need improvement.
Start your AZ-104 preparation with Clearcatnet.com. Build your Azure skills, practice with confidence, and take the next step in your cloud career.
Whether you are preparing for your first certification or expanding your existing expertise, Clearcatnet.com can support your learning goals.
Written By:Tannu Singh
Published on: 31/10/2026
Checkout more latest blogs here -blogs