Skip to content

Azure Developer Associate (AZ-204) Fact Sheet

Quick Reference

Exam Code: AZ-204 Duration: 120 minutes Questions: 40-60 questions Passing Score: 700/1000 Cost: $165 USD Validity: 1 year (requires annual renewal) Delivery: Pearson VUE (Testing center or online proctored)

Exam Domain Breakdown

Domain Weight Focus
Develop Azure compute solutions 25-30% App Service, Functions, Container Apps, AKS
Develop for Azure storage 15-20% Blob, Cosmos DB, Azure SQL
Implement Azure security 20-25% Managed Identity, Key Vault, App Config
Monitor, troubleshoot, and optimize 15-20% Application Insights, Cache, CDN
Connect to and consume Azure services 15-20% API Management, Event Grid, Service Bus, Queue Storage

Core Services to Master

Azure Compute (25-30%)

Azure App Service

Azure Functions

Azure Container Instances (ACI)

Azure Kubernetes Service (AKS)

Azure Container Registry (ACR)

Azure Storage (15-20%)

Azure Blob Storage

Azure Cosmos DB

Azure SQL Database

Azure Table Storage

Azure Security (20-25%)

Azure Active Directory (Microsoft Entra ID)

Managed Identity

Azure Key Vault

App Configuration

Monitoring and Optimization (15-20%)

Application Insights

Azure Monitor

Azure Cache for Redis

Azure CDN

Azure Integration Services (15-20%)

Azure API Management

Azure Event Grid

Azure Event Hubs

Azure Service Bus

Azure Queue Storage

Service Limits to Know

Azure Functions

  • Consumption Plan timeout: 5 minutes (default), 10 minutes (max)
  • Premium/Dedicated timeout: 30 minutes (default), unlimited (configurable)
  • HTTP trigger timeout: 230 seconds (function apps)
  • Max function instances: 200 (Consumption), 100 (Premium default)
  • Max payload size: 100 MB (HTTP trigger)
  • Max connections: 300 (Consumption per instance)

Azure App Service

  • Always On: Required for continuous apps (not available in Free/Shared tiers)
  • Deployment slots: 5 (Standard), 20 (Premium/Isolated)
  • Custom domains: Unlimited (Basic and above)
  • Request timeout: 240 seconds (default)
  • Max instances: Varies by tier (30 for P3v3)

Cosmos DB

  • Item size: 2 MB max
  • Partition key: 2 KB max value length
  • Container throughput: 1,000,000 RU/s max (provisioned)
  • Consistency levels: 5 options (Strong, Bounded staleness, Session, Consistent prefix, Eventual)
  • Transaction: 100 operations, 4 MB (transactional batch)

Azure Blob Storage

  • Block blob size: 190.7 TiB max (4.77 TiB per block)
  • Block size: 4,000 MiB max
  • Blocks per blob: 50,000 max
  • Page blob size: 8 TiB max
  • SAS token lifetime: 1 hour recommended max for user delegation SAS

API Management

  • Request size: 1 MB (gateway)
  • Response size: 4 MB (gateway)
  • Cache entry TTL: 3600 seconds (default)
  • Rate limits: Configurable per product/API/operation
  • Policy size: 256 KB max

Event Grid

  • Event size: 1 MB max (64 KB increments billed separately)
  • Batch size: 1 MB max (array of events)
  • Retry attempts: Up to 30 attempts
  • Max delivery latency: 24 hours

Service Bus

  • Message size: 256 KB (Standard), 100 MB (Premium - in chunks)
  • Queue/topic size: 1-80 GB
  • Message TTL: 14 days (default max)
  • Lock duration: 5 minutes (default)
  • Max delivery count: 10 (default)

Azure Functions Triggers and Bindings

Common Triggers

Trigger Use Case Key Points
HTTP REST APIs, webhooks Synchronous, return response directly
Timer Scheduled tasks CRON expressions, single instance
Blob File processing Triggered on new/updated blobs
Queue Storage Async message processing Automatic poison queue after 5 failures
Service Bus Enterprise messaging Sessions for FIFO, peek lock
Event Grid Event-driven reactions Push-based, low latency
Event Hubs Stream processing Checkpointing, consumer groups
Cosmos DB Change data capture Change feed processor

Common Bindings

Binding Direction Use Case
Blob Storage In/Out Read/write files
Cosmos DB In/Out Read/write documents
Table Storage In/Out Read/write entities
Queue Storage Out Send messages
Service Bus Out Send messages to queue/topic
Event Grid Out Publish events
SignalR Out Real-time web messaging
SendGrid Out Send emails

Documentation: - 📖 All Triggers and Bindings - Complete reference - 📖 HTTP Trigger - HTTP trigger configuration - 📖 Timer Trigger - CRON expressions and scheduling - 📖 Blob Trigger - Blob storage trigger details - 📖 Queue Trigger - Queue storage trigger configuration - 📖 Service Bus Trigger - Service Bus queue and topic triggers - 📖 Event Grid Trigger - Event Grid event handling - 📖 Cosmos DB Trigger - Change feed processing

Azure Storage Access Methods

Authentication Options

  1. Shared Key (Storage Account Key)
  2. Full access to storage account
  3. Not recommended for client apps

  4. 📖 Shared Key Authorization - Storage account keys

  5. Shared Access Signature (SAS)

  6. Account SAS: Access to multiple storage services
  7. Service SAS: Access to specific service (Blob, Queue, Table, File)
  8. User Delegation SAS: Secured with Entra ID credentials (most secure)
  9. 📖 SAS Overview - Delegated access with SAS tokens

  10. 📖 Create User Delegation SAS - Entra ID-secured SAS

  11. Azure Active Directory (Microsoft Entra ID)

  12. Role-based access control (RBAC)
  13. Managed identity support
  14. Most secure option
  15. 📖 Authorize with Entra ID - RBAC for storage

Cosmos DB Consistency Levels

Level Guarantee Use Case Read Latency Throughput
Strong Linearizability Mission-critical Highest Lowest (2x RU)
Bounded Staleness Lag by K versions or T time Consistent within bounds High Low
Session Read your writes within session Most applications (default) Medium Medium
Consistent Prefix Reads never see out-of-order writes Low consistency needs Low High
Eventual No ordering guarantee Highest availability Lowest Highest

Documentation: - 📖 Consistency Levels Explained - Detailed comparison and guarantees

Managed Identity vs Service Principal

Feature Managed Identity Service Principal
Credential management Automatic (Azure-managed) Manual (secrets/certs)
Rotation Automatic Manual
Use case Azure resources only Any application
Types System-assigned, User-assigned N/A
Cost Free Free
Best for Azure compute resources Non-Azure apps, DevOps

When to use Managed Identity: - App Service, Azure Functions, VM, AKS accessing Azure services - No credential management needed

When to use Service Principal: - GitHub Actions, Azure DevOps pipelines - On-premises applications - Multi-tenant scenarios

Documentation: - 📖 When to Use Managed Identity - Best practices

API Management Policy Execution Order

Inbound Processing

  1. inbound policies (from product, API, operation)
  2. Backend service called

Outbound Processing

  1. backend policies
  2. outbound policies (from operation, API, product)
  3. Response returned to client

Error Handling

  • on-error policies execute on any error

Common Policies

Policy Purpose Section
set-header Add/modify request header inbound/outbound
set-backend-service Change backend URL inbound
rate-limit Throttle calls by key inbound
quota Call volume quota inbound
validate-jwt Verify JWT token inbound
cache-lookup Check response cache inbound
cache-store Store response in cache outbound
retry Retry failed requests inbound/outbound/backend
mock-response Return mock response inbound

Documentation: - 📖 Policy Expressions - C# expressions in policies

Event Grid vs Event Hubs vs Service Bus

Feature Event Grid Event Hubs Service Bus
Pattern Pub/sub (reactive) Streaming (data pipeline) Enterprise messaging (transactional)
Message size 1 MB 1 MB 256 KB (Std), 100 MB (Premium)
Ordering Not guaranteed Per partition With sessions (FIFO)
Retention No retention (push) 1-7 days (90 days Premium) None (message delivered once)
Throughput High (millions/sec) Very high (millions/sec) Medium
Use case React to state changes Big data streaming, telemetry Reliable message delivery, transactions
Filtering Advanced filters Consumer-side Subscriptions (topics)
Protocol HTTP, Azure Functions AMQP, Kafka AMQP, HTTP
Dead letter Built-in Manual implementation Built-in

Documentation: - 📖 Choose Between Messaging Services - Service comparison

Azure SDK Best Practices

Client Lifecycle

// DO: Reuse clients (singleton or static)
private static readonly BlobServiceClient _blobClient = new BlobServiceClient(connectionString);

// DON'T: Create new client per request
// var client = new BlobServiceClient(connectionString); // ❌

Retry Policies

  • Default: Exponential backoff with jitter
  • Transient errors: Automatically retried (429, 500, 503, 504)
  • 📖 Retry Guidance - Service-specific retry patterns

Authentication

// Preferred: Managed Identity with DefaultAzureCredential
var credential = new DefaultAzureCredential();
var client = new BlobServiceClient(serviceUri, credential);

Documentation: - 📖 Azure SDK for .NET - Complete .NET SDK guide - 📖 Azure SDK for JavaScript - Node.js SDK overview - 📖 Azure SDK for Python - Python SDK overview - 📖 Azure SDK for Java - Java SDK overview - 📖 DefaultAzureCredential - Simplified authentication - 📖 Azure Identity Library - Authentication library for .NET

Deployment Strategies

App Service Deployment Slots

  • Blue-Green deployment: Deploy to slot, test, then swap
  • A/B testing: Route percentage of traffic to slot
  • Staged rollout: Gradual traffic shifting
  • Auto-swap: Automatic swap after deployment (CI/CD)
  • Swap with preview: Test in production environment before completing swap

Key points: - Settings can be "slot-specific" or "swap with slot" - Connection strings should be slot-specific - Swap is near-instantaneous (warm-up instances)

Documentation: - 📖 Deployment Best Practices - Slot strategies

Container Deployment Options

Service Use Case Complexity Orchestration
Web App for Containers Single container web apps Low None
Azure Container Instances Quick container deployment, burst workloads Low None (container groups)
Azure Container Apps Microservices, event-driven apps Medium Managed (KEDA)
Azure Kubernetes Service Full container orchestration High Kubernetes

Documentation: - 📖 Web App for Containers - Deploy custom containers to App Service - 📖 Azure Container Apps Overview - Serverless containers with KEDA - 📖 Container Apps Revisions - Versioning and traffic splitting

CI/CD with Azure DevOps and GitHub Actions

Azure Pipelines YAML

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: DotNetCoreCLI@2
  inputs:
    command: 'build'
    projects: '**/*.csproj'

Documentation: - 📖 Azure Pipelines Overview - CI/CD with Azure DevOps - 📖 Azure Pipelines YAML Schema - Complete YAML reference - 📖 Deploy to App Service - Azure Pipelines deployment - 📖 Azure Pipeline Tasks - Built-in task reference - 📖 Service Connections - Connect to Azure resources

GitHub Actions

name: Deploy to Azure

on:
  push:
    branches: [main]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: azure/webapps-deploy@v2

Documentation: - 📖 GitHub Actions for Azure - Deploy from GitHub to Azure - 📖 Azure Login Action - Authenticate with Azure - 📖 Deploy to App Service with GitHub Actions - CI/CD workflow - 📖 Deploy to Functions with GitHub Actions - Function app deployment - 📖 GitHub Actions Marketplace - Azure-specific actions

Infrastructure as Code

Azure CLI

ARM Templates and Bicep

Common Development Patterns

Circuit Breaker

Retry Pattern

  • Handle transient failures
  • Exponential backoff with jitter
  • 📖 Retry Pattern - Retry strategies

Cache-Aside

Strangler Fig

Queue-Based Load Leveling

Additional Patterns

Exam Tips - Key Concepts

Azure Functions Best Practices

  • ✅ Use environment variables for configuration (App Settings)
  • ✅ Use dependency injection for services
  • ✅ Store secrets in Key Vault, reference via App Config or Key Vault references
  • ✅ Use Durable Functions for stateful workflows
  • ✅ Use Premium plan for VNet integration and no cold starts
  • ❌ Don't store state in function code
  • ❌ Don't make functions dependent on each other

Cosmos DB Best Practices

  • ✅ Choose partition key based on access patterns (high cardinality)
  • ✅ Use Session consistency for most applications
  • ✅ Query within partition when possible
  • ✅ Use change feed for event-driven processing
  • ✅ Monitor RU consumption
  • ❌ Don't use small partition keys (creates hot partitions)
  • ❌ Don't query across partitions frequently

Security Best Practices

  • ✅ Use Managed Identity for Azure resource authentication
  • ✅ Store secrets in Key Vault
  • ✅ Use User Delegation SAS for temporary blob access
  • ✅ Enable HTTPS-only for App Service and API Management
  • ✅ Use Azure AD for user authentication
  • ❌ Never store connection strings in code
  • ❌ Don't use Storage Account Keys in client apps

API Management Best Practices

  • ✅ Use policies to transform requests/responses
  • ✅ Implement rate limiting and quotas
  • ✅ Use caching for GET operations
  • ✅ Use Products to bundle APIs
  • ✅ Validate JWT tokens in policies
  • ❌ Don't expose backend URLs directly
  • ❌ Don't skip authentication/authorization

Monitoring Best Practices

  • ✅ Enable Application Insights for all applications
  • ✅ Use custom events and metrics for business KPIs
  • ✅ Set up availability tests for critical endpoints
  • ✅ Use Log Analytics for querying across resources
  • ✅ Create alerts for key metrics and failures
  • ❌ Don't ignore telemetry correlation (operation IDs)
  • ❌ Don't over-sample telemetry in production

Common Exam Scenarios

  1. "Authenticate users in web app" → Azure AD (Microsoft Entra ID) with MSAL
  2. "Securely access Azure SQL from App Service" → Managed Identity
  3. "Store application secrets" → Key Vault with Key Vault references
  4. "Process files uploaded to Blob" → Blob trigger in Azure Functions
  5. "Implement FIFO message processing" → Service Bus queue with sessions
  6. "React to resource changes in Azure" → Event Grid subscription
  7. "Implement centralized API gateway" → API Management
  8. "Zero-downtime deployment" → App Service deployment slots (swap)
  9. "Stream telemetry from IoT devices" → Event Hubs with capture
  10. "Cache frequently accessed data" → Azure Cache for Redis with cache-aside pattern
  11. "Monitor application performance" → Application Insights with custom telemetry
  12. "Globally distributed database" → Cosmos DB with multi-region writes
  13. "Temporary access to blob without exposing keys" → User Delegation SAS
  14. "Run periodic background jobs" → Azure Functions with Timer trigger
  15. "Implement feature flags" → App Configuration with feature management

Study Priorities

High Priority (Must Know)

  • Azure Functions development (triggers, bindings, Durable Functions)
  • App Service deployment and configuration (slots, scaling)
  • Managed Identity for authentication
  • Key Vault secrets management
  • Blob Storage operations and SAS tokens
  • Cosmos DB partition keys and consistency levels
  • API Management policies (especially authentication and caching)
  • Application Insights telemetry and monitoring
  • Event Grid, Event Hubs, Service Bus differences
  • Azure AD authentication with MSAL

Medium Priority (Important)

  • Container deployment (ACI, AKS, Container Apps)
  • Azure Cache for Redis patterns
  • App Configuration and feature flags
  • Service Bus sessions and dead letter queues
  • Cosmos DB change feed
  • Azure SDK best practices
  • CI/CD with Azure Pipelines and GitHub Actions
  • Queue Storage vs Service Bus Queue
  • CDN and caching strategies

Lower Priority (Good to Know)

  • Table Storage design patterns
  • Azure SQL connectivity options
  • ARM templates and Bicep
  • Azure Monitor Log Analytics (KQL)
  • Durable Functions patterns (fan-out/fan-in, chaining)
  • API Management developer portal
  • Azure SignalR Service
  • Logic Apps integration
  • Event Grid domain topics

Last-Minute Review

Remember these: - Azure Functions Consumption timeout: 5 min default, 10 min max - Cosmos DB item max size: 2 MB - API Management gateway timeout: No hard limit (backend dependent) - Managed Identity: No credential management needed - User Delegation SAS: Most secure (uses Azure AD) - Cosmos DB: Session consistency is default - App Service slots: Test in prod environment before swap - Event Grid: Push-based, no retention - Service Bus: Pull-based, FIFO with sessions - Key Vault: Soft-delete enabled by default

Common gotchas: - App Service Free/Shared tier doesn't support Always On - Azure Functions HTTP trigger timeout is 230 seconds for function apps (not configurable) - Cosmos DB: Cross-partition queries consume more RUs - Managed Identity doesn't work outside Azure (use Service Principal) - SAS tokens should have minimum permissions and short lifetime - App Service slot settings: connection strings are slot-specific by default - Blob triggers have latency (use Event Grid trigger for faster response) - Consumption plan functions can have cold starts (use Premium to avoid) - DefaultAzureCredential tries multiple credential types in order - Event Grid requires endpoint validation for webhook subscriptions

SDK patterns: - Reuse client instances (singleton pattern) - Use DefaultAzureCredential for authentication - Implement exponential backoff for retries - Handle transient failures gracefully - Use async/await for all Azure SDK operations

Security checklist: - Use Managed Identity wherever possible - Store secrets in Key Vault, never in code - Use User Delegation SAS for temporary access - Enable HTTPS-only for all web services - Validate JWT tokens in API Management - Use RBAC for fine-grained access control - Enable Application Insights for security monitoring

Good luck on your exam! Focus on hands-on practice - deploy applications to Azure using the portal, CLI, and SDKs. Understand the "why" behind each service choice, not just the "what". The exam tests practical development scenarios, so build real applications with these services.