Skip to content

Microsoft Azure Administrator (AZ-104) - Fact Sheet

Quick Reference

Exam Code: AZ-104 Duration: 120 minutes (2 hours) Questions: 40-60 questions Passing Score: 700/1000 Cost: $165 USD Validity: 1 year (annual renewal required) Delivery: Pearson VUE Difficulty: ⭐⭐⭐⭐ (Hands-on focus with lab simulations)

Exam Domain Breakdown

Domain Weight Key Focus
Manage Azure identities and governance 20-25% Azure AD, RBAC, subscriptions, governance
Implement and manage storage 15-20% Storage accounts, Azure Files, backup, data transfer
Deploy and manage Azure compute resources 20-25% VMs, containers, App Services, scaling
Implement and manage virtual networking 15-20% VNets, NSGs, load balancers, DNS, VPN
Monitor and maintain Azure resources 10-15% Azure Monitor, Log Analytics, backup, updates

Key Services by Domain

Manage Azure Identities and Governance (20-25%)

Azure Active Directory (Azure AD) - Identity and access management service - Single sign-on (SSO) and multi-factor authentication (MFA) - User and group management - Self-service password reset (SSPR) - Azure AD Connect for hybrid identity - 📖 Azure AD Documentation - Complete Azure AD guide - 📖 Azure AD Users - User management - 📖 Azure AD Groups - Group management - 📖 Azure MFA - Multi-factor authentication - 📖 SSPR Configuration - Self-service password reset - 📖 Azure AD Connect - Hybrid identity

Role-Based Access Control (RBAC) - Fine-grained access management - Built-in roles: Owner, Contributor, Reader, User Access Administrator - Custom roles for specific permissions - Scope: Management group, subscription, resource group, resource - Role assignments with Azure AD principals - 📖 Azure RBAC Overview - RBAC fundamentals - 📖 Built-in Roles - Role reference - 📖 Custom Roles - Create custom roles - 📖 Assign Roles - Role assignments - 📖 RBAC Best Practices - Security guidelines

Azure Policy - Enforce organizational standards and compliance - Policy definitions: Rules for resource properties - Initiatives: Groups of policy definitions - Remediation: Automatic or manual fixes - Compliance reporting - 📖 Azure Policy Overview - Policy fundamentals - 📖 Policy Definitions - Policy structure - 📖 Initiative Definitions - Policy initiatives - 📖 Remediation Tasks - Fix non-compliant resources - 📖 Compliance Evaluation - Compliance reporting

Subscriptions and Management Groups - Management groups: Hierarchical organization of subscriptions - Subscription management: Create, move, cancel - Resource tags: Metadata for organization and billing - Cost management and budgets - 📖 Management Groups - Hierarchy management - 📖 Subscription Management - Subscription operations - 📖 Resource Tags - Tagging strategy - 📖 Cost Management - Cost analysis - 📖 Budgets - Budget creation

Implement and Manage Storage (15-20%)

Storage Accounts - Blob storage: Object storage for unstructured data - File storage: Managed file shares (SMB/NFS) - Queue storage: Message storage - Table storage: NoSQL key-value store - Storage tiers: Hot, Cool, Archive - Replication: LRS, ZRS, GRS, GZRS, RA-GRS, RA-GZRS - 📖 Storage Account Overview - Storage fundamentals - 📖 Blob Storage - Object storage - 📖 Azure Files - File shares - 📖 Storage Tiers - Access tiers - 📖 Storage Replication - Redundancy options - 📖 Storage Security - Security best practices

Azure Blob Storage - Block blobs, append blobs, page blobs - Blob access tiers: Hot, Cool, Archive - Lifecycle management policies - Soft delete for blobs and containers - Versioning and point-in-time restore - 📖 Blob Types - Blob comparison - 📖 Lifecycle Management - Automated tiering - 📖 Blob Soft Delete - Data protection - 📖 Blob Versioning - Version control - 📖 Point-in-Time Restore - Recovery options

Azure Files - SMB and NFS file shares - Azure File Sync for hybrid scenarios - Identity-based authentication (Azure AD DS or AD DS) - Snapshots for backup - Premium and standard performance tiers - 📖 Azure Files Planning - Deployment guide - 📖 File Sync - Hybrid file sync - 📖 File Share Authentication - Identity integration - 📖 File Snapshots - Backup and restore - 📖 File Share Performance - Performance tiers

Storage Security - Shared access signatures (SAS): Delegated access - Stored access policies: Revocable SAS - Storage service encryption (SSE): Encryption at rest - Encryption in transit: HTTPS/TLS - Network rules: Firewall and virtual networks - 📖 Shared Access Signatures - SAS fundamentals - 📖 Stored Access Policies - Policy management - 📖 Storage Encryption - Encryption at rest - 📖 Storage Firewalls - Network security - 📖 Private Endpoints - Private connectivity

Data Transfer and Management - AzCopy: Command-line utility for bulk transfer - Azure Storage Explorer: GUI management tool - Azure Data Box: Physical data transfer device - Azure Import/Export service - 📖 AzCopy - Bulk transfer tool - 📖 Storage Explorer - GUI tool - 📖 Azure Data Box - Physical transfer - 📖 Import/Export Service - Disk shipping

Deploy and Manage Azure Compute Resources (20-25%)

Virtual Machines - VM sizes: General purpose, compute, memory, storage, GPU optimized - Availability sets: Fault and update domains - Availability zones: Physical datacenter separation - VM extensions: Post-deployment configuration - Custom script extension for automation - 📖 VM Overview - VM fundamentals - 📖 VM Sizes - Size categories - 📖 Availability Sets - High availability - 📖 Availability Zones - Zone redundancy - 📖 VM Extensions - Extension overview - 📖 Custom Script Extension - Script automation

VM Configuration and Management - Managed disks: OS and data disks - Disk types: Standard HDD, Standard SSD, Premium SSD, Ultra Disk - VM images: Marketplace and custom images - Azure Compute Gallery (Shared Image Gallery) - VM deployment: Portal, CLI, PowerShell, ARM templates - 📖 Managed Disks - Disk management - 📖 Disk Types - Performance comparison - 📖 VM Images - Image management - 📖 Azure Compute Gallery - Shared images - 📖 ARM Templates - Infrastructure as code

Virtual Machine Scale Sets (VMSS) - Auto-scaling: Metric-based or schedule-based - Load balancing: Azure Load Balancer or Application Gateway - Update management: Rolling upgrades - Instance protection - Orchestration modes: Uniform and Flexible - 📖 VMSS Overview - Scale sets fundamentals - 📖 Autoscaling - Auto-scale configuration - 📖 VMSS Upgrades - Upgrade policies - 📖 Orchestration Modes - Mode comparison - 📖 Instance Protection - Protect instances

Azure App Service - Web apps: Host web applications - App Service plans: Shared, Basic, Standard, Premium, Isolated - Deployment slots: Staging environments - Auto-scaling rules - Custom domains and SSL/TLS certificates - 📖 App Service Overview - App Service fundamentals - 📖 App Service Plans - Pricing tiers - 📖 Deployment Slots - Staging environments - 📖 App Service Scaling - Scaling options - 📖 Custom Domains - Domain configuration - 📖 SSL Certificates - Certificate management

Azure Container Instances (ACI) - Serverless containers - Fast startup without VM management - Public IP and DNS name support - Persistent storage with Azure Files - Container groups for multi-container deployments - 📖 ACI Overview - Container instances - 📖 Container Groups - Multi-container pods - 📖 ACI Networking - Network configuration - 📖 ACI Storage - Persistent volumes

Azure Kubernetes Service (AKS) - Managed Kubernetes cluster - Node pools: System and user node pools - Scaling: Cluster autoscaler and horizontal pod autoscaler - Networking: kubenet and Azure CNI - Azure AD integration for RBAC - 📖 AKS Overview - AKS fundamentals - 📖 AKS Node Pools - Node pool management - 📖 AKS Scaling - Auto-scaling - 📖 AKS Networking - Network plugins - 📖 AKS RBAC - Azure AD integration

Implement and Manage Virtual Networking (15-20%)

Virtual Networks (VNet) - Address space: CIDR notation - Subnets: Segmentation within VNet - VNet peering: Connect VNets (same or different regions) - Service endpoints: Secure Azure service access - Private endpoints: Private IP for Azure services - 📖 VNet Overview - VNet fundamentals - 📖 Plan VNets - Network design - 📖 Subnets - Subnet management - 📖 VNet Peering - Network connectivity - 📖 Service Endpoints - Service integration - 📖 Private Endpoints - Private connectivity

Network Security Groups (NSGs) - Inbound and outbound security rules - Priority-based rule evaluation (100-4096) - Default rules: Allow VNet, Azure Load Balancer, deny all - Application Security Groups (ASGs): Logical grouping - Flow logs: NSG traffic logging - 📖 NSG Overview - NSG fundamentals - 📖 NSG Rules - Rule processing - 📖 Application Security Groups - ASG usage - 📖 NSG Flow Logs - Traffic analysis

Azure Load Balancer - Layer 4 (TCP/UDP) load balancing - Public and internal load balancers - Health probes: TCP, HTTP, HTTPS - Load balancing rules and NAT rules - Standard SKU: Zone redundancy, diagnostics - 📖 Load Balancer Overview - Load balancer fundamentals - 📖 Load Balancer SKUs - Basic vs Standard - 📖 Health Probes - Health monitoring - 📖 Load Balancing Rules - Distribution algorithms

Application Gateway - Layer 7 (HTTP/HTTPS) load balancing - Web Application Firewall (WAF) - URL path-based routing - SSL/TLS termination - Multi-site hosting - Auto-scaling - 📖 Application Gateway Overview - App Gateway fundamentals - 📖 Web Application Firewall - WAF protection - 📖 URL Routing - Path-based routing - 📖 SSL Termination - Certificate management - 📖 Multi-site Hosting - Host multiple sites

Azure DNS - Public DNS zones: Internet-facing domains - Private DNS zones: VNet name resolution - Alias records: Point to Azure resources - DNS forwarding and conditional forwarding - 📖 Azure DNS Overview - DNS fundamentals - 📖 Public DNS Zones - Zone management - 📖 Private DNS Zones - Private name resolution - 📖 DNS Alias Records - Dynamic DNS

VPN Gateway and ExpressRoute - VPN Gateway: Site-to-site, point-to-site, VNet-to-VNet - Gateway SKUs: Basic, VpnGw1-5, VpnGw1AZ-5AZ - ExpressRoute: Private connection to Azure - ExpressRoute circuits: 50 Mbps to 10 Gbps - 📖 VPN Gateway Overview - VPN fundamentals - 📖 Site-to-Site VPN - S2S configuration - 📖 Point-to-Site VPN - P2S overview - 📖 ExpressRoute Overview - Private connectivity - 📖 ExpressRoute Circuits - Circuit configuration

Azure Firewall - Managed cloud-based network security - Application and network rules - Threat intelligence-based filtering - FQDN filtering for outbound traffic - SNAT and DNAT support - 📖 Azure Firewall Overview - Firewall fundamentals - 📖 Firewall Rules - Rule processing - 📖 Threat Intelligence - Security filtering - 📖 DNAT Rules - Destination NAT

Monitor and Maintain Azure Resources (10-15%)

Azure Monitor - Metrics: Numerical time-series data - Logs: Text-based event data - Application Insights: Application performance monitoring - VM Insights: VM performance and dependencies - Network Watcher: Network diagnostics - 📖 Azure Monitor Overview - Monitoring fundamentals - 📖 Azure Monitor Metrics - Metrics platform - 📖 Azure Monitor Logs - Logs platform - 📖 Application Insights - APM solution - 📖 VM Insights - VM monitoring - 📖 Network Watcher - Network diagnostics

Log Analytics - Centralized log storage and analysis - Kusto Query Language (KQL) for queries - Workspaces: Log data storage - Query results export and visualization - Log Analytics agent for data collection - 📖 Log Analytics Overview - Log Analytics fundamentals - 📖 Log Analytics Workspaces - Workspace design - 📖 KQL Overview - Query language - 📖 Log Queries - Query examples - 📖 Log Analytics Agent - Agent deployment

Alerts and Action Groups - Metric alerts: Threshold-based alerts - Log alerts: KQL query-based alerts - Activity log alerts: Resource changes - Action groups: Notification and automation - Alert rules and processing rules - 📖 Azure Monitor Alerts - Alerts fundamentals - 📖 Metric Alerts - Metric-based alerts - 📖 Log Alerts - Query-based alerts - 📖 Activity Log Alerts - Resource alerts - 📖 Action Groups - Alert actions

Azure Backup - Azure VM backup: Agent-based and agentless - File and folder backup: MARS agent - Azure Files backup: Snapshot-based - SQL Server and SAP HANA backup - Recovery Services vault: Backup storage - Backup policies: Schedule and retention - 📖 Azure Backup Overview - Backup fundamentals - 📖 VM Backup - VM protection - 📖 MARS Agent - File backup agent - 📖 Azure Files Backup - File share protection - 📖 Recovery Services Vault - Vault management - 📖 Backup Policies - Policy configuration

Azure Site Recovery - Disaster recovery orchestration - Azure-to-Azure replication - On-premises-to-Azure replication - Recovery plans: Automated failover - Test failover: DR testing without impact - 📖 Site Recovery Overview - DR fundamentals - 📖 Azure VM Replication - Azure-to-Azure DR - 📖 Recovery Plans - Failover orchestration - 📖 Test Failover - DR testing

Update Management - Azure Update Manager: Centralized patch management - Update assessment: View available updates - Update deployment: Schedule patching - Windows Update and WSUS integration - Linux package manager integration - 📖 Azure Update Manager - Update management - 📖 Update Assessment - Compliance reporting - 📖 Update Deployment - Patch scheduling - 📖 Maintenance Configurations - Maintenance windows

PowerShell and Azure CLI Commands

Azure PowerShell

Connect and Manage Context 

Connect-AzAccount                              # Sign in to Azure
Get-AzContext                                  # Get current context
Set-AzContext -Subscription "subscription-id"  # Switch subscription

Resource Group Management 

New-AzResourceGroup -Name "rg-name" -Location "eastus"
Get-AzResourceGroup
Remove-AzResourceGroup -Name "rg-name"

Virtual Machine Management 

New-AzVM -ResourceGroupName "rg-name" -Name "vm-name" -Location "eastus"
Start-AzVM -ResourceGroupName "rg-name" -Name "vm-name"
Stop-AzVM -ResourceGroupName "rg-name" -Name "vm-name"
Restart-AzVM -ResourceGroupName "rg-name" -Name "vm-name"
Remove-AzVM -ResourceGroupName "rg-name" -Name "vm-name"

Storage Account Management 

New-AzStorageAccount -ResourceGroupName "rg-name" -Name "storageacct" -Location "eastus" -SkuName "Standard_LRS"
Get-AzStorageAccount -ResourceGroupName "rg-name"
Set-AzStorageAccount -ResourceGroupName "rg-name" -Name "storageacct" -SkuName "Standard_GRS"

Virtual Network Management 

New-AzVirtualNetwork -ResourceGroupName "rg-name" -Name "vnet-name" -AddressPrefix "10.0.0.0/16" -Location "eastus"
New-AzVirtualNetworkSubnetConfig -Name "subnet-name" -AddressPrefix "10.0.1.0/24"
Get-AzVirtualNetwork -ResourceGroupName "rg-name"

Azure CLI

Connect and Manage Account 

az login                                    # Sign in to Azure
az account list                             # List subscriptions
az account set --subscription "subscription-id"  # Switch subscription
az account show                             # Show current subscription

Resource Group Management 

az group create --name rg-name --location eastus
az group list
az group delete --name rg-name

Virtual Machine Management 

az vm create --resource-group rg-name --name vm-name --image UbuntuLTS
az vm start --resource-group rg-name --name vm-name
az vm stop --resource-group rg-name --name vm-name
az vm restart --resource-group rg-name --name vm-name
az vm list --resource-group rg-name
az vm delete --resource-group rg-name --name vm-name

Storage Account Management 

az storage account create --name storageacct --resource-group rg-name --location eastus --sku Standard_LRS
az storage account list --resource-group rg-name
az storage account show --name storageacct --resource-group rg-name
az storage account delete --name storageacct --resource-group rg-name

Virtual Network Management 

az network vnet create --resource-group rg-name --name vnet-name --address-prefix 10.0.0.0/16
az network vnet subnet create --resource-group rg-name --vnet-name vnet-name --name subnet-name --address-prefix 10.0.1.0/24
az network vnet list --resource-group rg-name

NSG Management 

az network nsg create --resource-group rg-name --name nsg-name
az network nsg rule create --resource-group rg-name --nsg-name nsg-name --name rule-name --priority 100 --source-address-prefixes '*' --destination-port-ranges 80
az network nsg list --resource-group rg-name

Common Administrator Scenarios

Scenario 1: Implement High Availability for Web Application

Requirements: Deploy web app across multiple regions with automatic failover Solution: 1. Deploy App Service in primary region 2. Configure deployment slot for staging 3. Set up Azure Front Door or Traffic Manager for global load balancing 4. Configure health probes for automatic failover 5. Implement Azure SQL Database with geo-replication 6. Configure backup and disaster recovery

Scenario 2: Secure Virtual Network for Multi-Tier Application

Requirements: Deploy web, app, and database tiers with proper isolation Solution: 1. Create VNet with three subnets (web, app, database) 2. Configure NSGs with least privilege rules 3. Place VMs in availability zones 4. Deploy Azure Bastion for secure remote access 5. Configure service endpoints for Azure SQL 6. Implement Application Gateway with WAF for web tier

Scenario 3: Hybrid Connectivity for On-Premises Integration

Requirements: Connect on-premises datacenter to Azure securely Solution: 1. Create VPN Gateway in Azure VNet 2. Configure site-to-site VPN connection 3. Set up local network gateway for on-premises 4. Configure BGP for dynamic routing (optional) 5. Implement ExpressRoute for dedicated connection (production) 6. Set up DNS forwarding between environments

Scenario 4: Centralized Monitoring and Alerting

Requirements: Monitor all Azure resources with automated alerting Solution: 1. Create Log Analytics workspace 2. Deploy diagnostic settings on all resources 3. Install Log Analytics agent on VMs 4. Configure metric and log alerts 5. Create action groups for notifications 6. Build custom dashboards in Azure Monitor 7. Set up workbooks for reporting

Scenario 5: Automated Backup and Recovery

Requirements: Protect VMs and databases with automated backup Solution: 1. Create Recovery Services vault 2. Configure VM backup policies (daily, weekly, monthly retention) 3. Enable Azure Files backup with snapshots 4. Set up Azure SQL Database automated backups 5. Implement Azure Site Recovery for DR 6. Test recovery procedures regularly 7. Configure backup alerts and monitoring

Exam Tips

Hands-On Focus

  • AZ-104 includes performance-based testing (lab simulations)
  • Must demonstrate actual Azure portal, PowerShell, and CLI skills
  • Practice in real Azure environment is essential (use free tier)
  • Know how to navigate Azure portal efficiently

Common Exam Scenarios

  • Configure RBAC for least privilege access
  • Implement VM backup and restore
  • Create and configure virtual networks with NSGs
  • Deploy and scale VMs and App Services
  • Configure Azure AD users and groups
  • Implement storage account security
  • Set up monitoring and alerts
  • Configure site-to-site VPN connectivity
  • Manage resource tags and cost optimization

Question Keywords

  • "Most secure" → Private endpoints, managed identities, least privilege RBAC
  • "High availability" → Availability zones, scale sets, load balancers, geo-replication
  • "Cost-effective" → Reserved instances, spot VMs, storage tiers, right-sizing
  • "Monitor" → Azure Monitor, Log Analytics, Application Insights, alerts
  • "Automate" → PowerShell, Azure CLI, ARM templates, Azure Automation
  • "Hybrid" → VPN Gateway, ExpressRoute, Azure Arc, File Sync

Azure RBAC Key Roles

  • Owner: Full access including access management
  • Contributor: Full access except access management
  • Reader: View-only access
  • User Access Administrator: Manage user access only
  • Know when to use built-in vs. custom roles

Storage Replication Options

  • LRS: Locally redundant (3 copies, one datacenter) - cheapest
  • ZRS: Zone redundant (3 availability zones)
  • GRS: Geo-redundant (6 copies, 2 regions)
  • GZRS: Geo-zone redundant (best protection)
  • RA-GRS/RA-GZRS: Read access to secondary region

VM Availability Options

  • Availability Set: 99.95% SLA (fault/update domains)
  • Availability Zone: 99.99% SLA (physical separation)
  • Single VM: 99.9% SLA (Premium SSD required)

Essential Documentation

Core Resources

Hands-On Resources

Final Checklist

Knowledge Requirements

  • Configure and manage Azure AD users, groups, and RBAC
  • Implement and manage storage accounts with appropriate security
  • Deploy and manage VMs, scale sets, and App Services
  • Configure virtual networks, NSGs, and load balancers
  • Set up Azure Monitor, Log Analytics, and alerts
  • Implement backup and disaster recovery solutions
  • Use Azure PowerShell and Azure CLI proficiently
  • Understand Azure Policy and governance
  • Configure hybrid connectivity (VPN, ExpressRoute)
  • Manage costs and optimize resources

Skills Requirements

  • Azure portal navigation and management
  • PowerShell scripting for Azure
  • Azure CLI command-line operations
  • ARM template deployment
  • Troubleshooting Azure resources
  • Network configuration and troubleshooting
  • Security implementation and management

Preparation Milestones

  • 6+ months Azure administration experience (recommended)
  • Completed Microsoft Learn training modules
  • Hands-on practice with all core services
  • Lab simulations and practice tests (75%+ score)
  • Understand all exam objectives
  • Reviewed Microsoft documentation
  • Practiced PowerShell and CLI commands

Pro Tip: AZ-104 is a hands-on administrator exam with lab simulations. You MUST have practical experience deploying and managing Azure resources. Focus on the Azure portal, PowerShell, and CLI - you'll need to perform actual tasks during the exam. Set up a free Azure account and practice every day!

Good luck! 🚀