Microsoft · AZ-104

AZ-104 Exam: Complete Guide

Current AZ-104 exam guide covering the $165 USD price, 100-minute limit, the April 2026 skills measured update, preparation priorities, renewal rules, and what to expect on exam day.

Last verified September 6, 2026

AZ-104 exam at a glance

Facts last verified September 6, 2026

Domain breakdown

Who should take the AZ-104 exam?

AZ-104 is for people who already run an organization's Azure environment, or are about to. Microsoft's audience profile expects subject matter expertise in implementing, managing, and monitoring Azure across virtual networks, storage, compute, identity, security, and governance — not familiarity with what those services are, but the ability to configure them correctly.

The role is rarely solo. Azure administrators usually sit inside a wider infrastructure team and coordinate with networking, security, database, application development, and DevOps colleagues. That shows up in the exam: many questions describe a requirement from another team and ask which control satisfies it at the narrowest appropriate scope.

Microsoft expects you to be comfortable with operating systems, networking, servers, and virtualization, and to have real experience with PowerShell, the Azure CLI, the Azure portal, ARM templates or Bicep files, and Microsoft Entra ID. There are no formal prerequisites, so you can book AZ-104 first — but if you have never created a resource group, an NSG, or a storage account yourself, start with the AZ-900 fundamentals exam and several months of hands-on work.

The resulting Azure Administrator Associate credential is classified as intermediate. It maps to cloud administrator, systems administrator, infrastructure engineer, and cloud operations roles, and it is the most common on-ramp to Azure specializations such as security, networking, and DevOps engineering.

Skills measured on AZ-104

Microsoft's official AZ-104 study guide lists five skill areas, with the current version of the blueprint effective April 17, 2026. That revision was incremental — Microsoft's own change log marks every functional group as "no change" and flags only minor edits to storage, virtual machines, containers, virtual networking, and monitoring objectives — so older study material is still broadly usable, but check the change log before you book.

Weightings are uneven here, unlike some Microsoft exams. Identity/governance and compute are the two largest domains at 20–25% each; monitoring is the smallest at 10–15%. Plan study time accordingly, but do not skip the small domain — it is large enough to decide a borderline result.

Manage Azure identities and governance (20–25%)

This domain splits into three parts: Microsoft Entra objects, Azure RBAC, and subscription governance. On the identity side you need to create and manage users and groups, manage their properties, assign licenses, handle external (guest) users, and configure self-service password reset.

Access management is about scope more than syntax. Know the built-in Azure roles, how to assign them at management group, subscription, resource group, and resource level, and how to interpret an existing set of assignments — including which one wins when several apply. Practice reading an access blade and answering "can this principal do this action?"

Governance covers Azure Policy, resource locks, tags, resource groups, subscriptions, management groups, and cost management through alerts, budgets, and Azure Advisor recommendations. Learn the practical difference between Policy (what may be created) and RBAC (who may create it), because scenario questions routinely offer one as a distractor for the other.

Implement and manage storage (15–20%)

Access control comes first: storage account firewalls and virtual network rules, shared access signature tokens, stored access policies, access keys, and identity-based access for Azure Files. Understand when a SAS is the right answer versus an RBAC assignment versus a private endpoint, and know that a stored access policy is what lets you revoke a SAS.

Account configuration covers creating storage accounts, choosing redundancy (LRS, ZRS, GRS, GZRS and their read-access variants), object replication, encryption, and moving data with Azure Storage Explorer and AzCopy. Redundancy questions are common and testable: be able to state what each option survives and what it costs.

Data-service configuration covers file shares in Azure Files and containers in Blob Storage, access tiers, soft delete for blobs, containers and file shares, snapshots, lifecycle management rules, and blob versioning. Build one storage account and turn on each of these features once — the settings are far easier to recall after you have seen where they live in the portal.

Deploy and manage Azure compute resources (20–25%)

Infrastructure as code is explicitly in scope. You must be able to interpret an ARM template or Bicep file, modify an existing one, deploy from it, and export a deployment as a template or convert a template to Bicep. You are not asked to author complex templates from scratch, but you should read parameters, variables, resources, and dependencies fluently.

Virtual machines are the core of the domain: creation, sizing and resizing, disk management, encryption at host, moving a VM to another resource group, subscription, or region, and deploying into availability zones, availability sets, and Virtual Machine Scale Sets. Know the availability trade-offs well enough to pick the right one from an SLA or fault-domain requirement.

Containers appear at an administrator's level of depth: creating and managing an Azure Container Registry, provisioning containers with Azure Container Instances and Azure Container Apps, and managing their sizing and scaling. Azure Kubernetes Service is not in the current objective list — do not over-invest there.

App Service closes the domain. Provision an App Service plan, configure its scaling, create an App Service, and configure certificates and TLS, custom DNS names, backup, networking settings, and deployment slots. Deployment slots and plan-level scaling are frequent scenario material.

Implement and manage virtual networking (15–20%)

Start with the fundamentals: virtual networks and subnets, virtual network peering, public IP addresses, user-defined routes, and connectivity troubleshooting. Peering and UDR behavior — especially transitive routing and forced tunneling through an appliance — is a reliable source of exam scenarios.

Secure access covers network security groups and application security groups, evaluating effective security rules, implementing Azure Bastion, and configuring service endpoints and private endpoints for Azure PaaS services. Be precise about the difference between a service endpoint and a private endpoint; they solve overlapping problems in different ways and are frequently paired as answer options.

Name resolution and load balancing finish the domain: Azure DNS zones and records, configuring an internal or public load balancer, and troubleshooting load balancing. Know what a health probe failure looks like and which layer (NSG, probe, backend pool, rule) each symptom points to.

Monitor and maintain Azure resources (10–15%)

Monitoring covers interpreting metrics, configuring log settings, querying and analyzing logs, and setting up alert rules, action groups, and alert processing rules in Azure Monitor. You should also be able to configure and read Azure Monitor Insights for virtual machines, storage accounts, and networks, and use Network Watcher and Connection monitor for connectivity diagnostics.

Backup and recovery is the other half. Create a Recovery Services vault and an Azure Backup vault — they are distinct, and knowing which workloads each supports matters — then create backup policies, perform backup and restore operations, configure Azure Site Recovery for Azure resources, run a failover to a secondary region, and interpret backup reports and alerts.

Because this is the lightest domain, a common mistake is to skip it entirely and lose easily earned points. A single afternoon spent creating a vault, backing up a VM, restoring it, and building one alert rule with an action group covers most of what is asked.

How to prepare for AZ-104

Treat the study guide's bullet list as a checklist and require yourself to have done each item, not read about it. An Azure free account plus a small pay-as-you-go budget is enough for nearly everything in scope, provided you deallocate VMs and delete resources after each session.

Build one connected environment rather than isolated demos: a hub and spoke virtual network with peering and NSGs, VMs in an availability set behind a load balancer, a storage account with a private endpoint and lifecycle rules, Entra groups with RBAC assignments at different scopes, a policy that enforces tagging, and Azure Monitor alerts plus a backup policy over the whole thing. Then deliberately break parts of it and fix them.

Do everything at least once in both the portal and either PowerShell or the CLI. Microsoft lists both as expected experience, and switching tools exposes concepts the portal hides. Add one pass through an ARM template and its Bicep equivalent for the same deployment.

Microsoft's AZ-104T00 instructor-led course and the free learning paths on Microsoft Learn follow the official topic order, and the Exam Readiness Zone videos walk through each skill area with exam-technique commentary. A realistic timeline for someone already working in IT is six to eight weeks at five to eight hours a week.

AZ-104 practice questions

Use Microsoft's free Practice Assessment from the official certification page to calibrate question style and find weak objectives, and run the exam sandbox once so the interface is familiar before exam day. Practice results predict readiness only when you also review why each distractor is wrong.

Use objective-aligned practice material only. Avoid anything advertising "real exam questions" or dumps: those materials violate Microsoft's candidate agreement, risk your credential, and teach recall of specific items rather than the configuration judgment the exam actually tests.

AZ-104 compared with other Azure exams

AZ-900 is a fundamentals exam — it asks what a service is, while AZ-104 asks how to configure it, and the two share almost no question style. AZ-104 is the usual next step after AZ-900 and the usual prerequisite in practice (though not in policy) for role-based Azure certifications: AZ-400 for DevOps, AZ-500 for security, and AZ-700 for networking all assume you can already administer the resources they build on. If you are choosing between AZ-104 and a specialization, take AZ-104 first unless your day job is already narrowly specialized.

Is the AZ-104 certification worth it?

AZ-104 is one of the more portable Microsoft credentials because the skills it validates — identity, storage, compute, networking, monitoring — appear in nearly every Azure job description regardless of industry. It is the credential most often named in postings for cloud administrator, systems administrator, and cloud infrastructure roles, and it is a common internal requirement for teams migrating to Azure.

Its value depends on whether you can back it up. Because the exam is configuration-heavy, holding it signals hands-on capability rather than familiarity — which also means it is worth less if you passed on memorization and cannot repeat the tasks. The credential expires after 12 months and renews free through an online assessment, so ongoing cost is low but staying current is expected.

Exam-day notes

• Microsoft gives you 100 minutes for the assessment. The full appointment is longer to cover check-in, instructions, and administrative steps.
• Microsoft does not publish a fixed question count. Role-based exams typically contain 40–60 questions, and AZ-104 may include interactive components.
• Associate exams allow access to Microsoft Learn during the exam, but the clock keeps running and access is limited to the Learn domain. Use it for one or two targeted lookups, not as a substitute for preparation.
• The exam is offered in English, Chinese (Simplified and Traditional), Korean, Japanese, French, Spanish, German, Portuguese (Brazil), and Italian. If it is not available in your preferred language, you can request an additional 30 minutes.
• Read the constraint in each scenario before the answer options — several options are usually technically valid and only one meets the stated requirement at the correct scope.
• Schedule with a personal Microsoft account. Registering with a work or school account means your exam records are lost, and unrecoverable, if you leave that organization.

Prep resources

← More Microsoft exams