AZ-104 Certification Guide: Microsoft Azure Administrator Exam

The AZ-104 — Microsoft Azure Administrator — is one of the most career-defining certifications in cloud computing right now. Not because Microsoft says so, but because Azure is the second-largest cloud platform on Earth and organizations are scrambling to find people who can actually run it. If you're thinking about going for the AZ-104, you've picked a good time. Azure Administrators in the US earn between $95k and $130k on average, and demand isn't slowing down.

So what exactly is the AZ-104? It's Microsoft's associate-level certification for professionals who manage Azure environments — not architects who design them, not developers who build on top of them, but the administrators who keep everything running. That means virtual machines, virtual networks, storage accounts, identity and access management, monitoring, and backup. The day-to-day operational work of Azure.

Who should take it? The short answer: anyone whose job involves managing Azure resources or who wants it to. That includes sysadmins transitioning from on-premises infrastructure, DevOps engineers who want to formalize their cloud skills, IT generalists at companies moving to Azure, and cloud engineers looking to add an Azure credential to complement an aws certified cloud practitioner exam or similar cloud cert. You don't need years of Azure experience — six months of hands-on work is enough for most people — but you do need genuine familiarity with the platform. This isn't a memorization exam.

If you're just getting started with Azure, the az 900 (Azure Fundamentals) is the right first step. It's not a prerequisite for the AZ-104, but Microsoft recommends it, and for good reason: the AZ-104 assumes you understand what Azure is and how it's organized. Going in cold without that foundation makes the content much harder to absorb.

The az 104 practice test experience is noticeably different from exams that reward memorization. Microsoft writes questions designed to test judgment — you'll see case studies, drag-and-drop scenarios, and questions that require you to pick the right tool for a specific situation rather than just recall a definition. That's good news if you've been doing real Azure work. Bad news if you've only been reading textbooks.

Here's the thing about the AZ-104 that trips people up: the breadth. Five domains, each with real depth. You can't just get really good at networking and coast through the rest. Microsoft distributes the exam weight so that weak spots in any domain will hurt your score. A thorough permit test resources process needs to cover all five areas — not just your comfort zones.

Career-wise, the AZ-104 opens doors in a way that few associate certifications do. It signals to employers that you can independently manage an Azure environment — the core competency most Azure-hiring companies actually need. The jump from Azure Admin to Azure Architect (the AZ-305) is a natural progression, and the AZ-104 is the foundation for that path. If security is your focus, the az 500 (Azure Security Engineer) pairs naturally with the AZ-104 and commands a meaningful salary premium. Many professionals treat the two together as a powerful combination credential.

One more thing before we get into the specifics: the AZ-104 exam objectives update periodically. Microsoft revises the content blueprint — sometimes significantly — to reflect changes in the platform. The version described in this guide reflects the current blueprint, but you should always verify the latest objectives on Microsoft Learn before you start studying. The differences between versions can affect which topics you need to cover.

AZ-104 Exam Domains

The AZ-104 covers five domains. Microsoft publishes the percentage weight of each — that's the clearest signal you'll get about where to focus your study time. Here's what each domain actually covers and why it matters. Pay attention to the domains weighted 20–25% — compute and networking together represent nearly half the exam, so weak spots there will cost you points fast.

Manage Azure Identities and Governance (15–20%)

This domain is about Azure Active Directory (now called Microsoft Entra ID), role-based access control (RBAC), and governance tools. You need to know how to create and manage users and groups, configure Azure AD roles, set up multi-factor authentication, and manage subscriptions and resource groups. Azure Policy and management locks fall here too — understanding how to enforce compliance at scale across an organization is a core admin skill.

RBAC is the kind of topic that sounds simple until you hit the exam. The distinction between built-in roles (Owner, Contributor, Reader), custom roles, and the scope at which permissions apply (management group → subscription → resource group → resource) trips up a lot of candidates. Don't just memorize role names — understand the permission inheritance model.

Implement and Manage Storage (15–20%)

Storage accounts are one of Azure's most fundamental services, and this domain goes deep. You'll need to configure storage account types (general-purpose v2, Blob storage, Azure Data Lake Storage Gen2), understand redundancy options (LRS, ZRS, GRS, GZRS), and manage access using shared access signatures (SAS), storage account keys, and Azure AD authentication. Blob storage tiers — hot, cool, archive — and lifecycle management policies are common exam topics.

File shares (Azure Files) and Azure File Sync for hybrid environments also show up here. If you've never actually created a SAS token or configured a storage lifecycle policy in a real Azure environment, do it now — the exam questions assume you have.

Deploy and Manage Azure Compute Resources (20–25%)

The heaviest domain, and for good reason — compute is the core of what most Azure Administrators manage day to day. Virtual machines, VM scale sets, Azure App Service, Azure Container Instances, and Azure Kubernetes Service basics all appear here. You'll need to know how to deploy VMs from templates (ARM templates and Bicep), configure VM networking (NICs, public IPs, NSGs), manage VM storage (managed disks, disk types, snapshots), and set up availability sets and availability zones for high availability.

Azure Resource Manager templates come up repeatedly. You don't need to write complex templates from scratch, but you do need to read them, modify parameters, and understand what a deployment will do. The exam expects you to deploy and modify resources using both the Azure portal and the CLI/PowerShell — know both.

Implement and Manage Virtual Networking (20–25%)

The other heavy domain. Virtual networks (VNets), subnets, network security groups (NSGs), application security groups (ASGs), Azure Firewall, VNet peering, and VPN Gateway are all on the table. You'll need to configure DNS in Azure, set up load balancers (both Azure Load Balancer and Azure Application Gateway), and understand private endpoints and service endpoints for securing connectivity to Azure services.

Network troubleshooting tools — Network Watcher, IP flow verify, connection troubleshoot — appear on the exam. Know what each tool diagnoses and when to use it. VNet peering versus VPN Gateway is a classic comparison question: peering is lower latency and simpler for Azure-to-Azure, while VPN Gateway handles Azure-to-on-premises encrypted tunnels.

Monitor and Maintain Azure Resources (10–15%)

The smallest domain by weight, but don't skip it. Azure Monitor, Log Analytics workspaces, diagnostic settings, and Azure Alerts are core components. You'll need to know how to configure diagnostic logs for Azure resources, set up metric alerts and log alerts, and create dashboards. Azure Backup and Azure Site Recovery (ASR) also fall here — backup policies, recovery vaults, and the difference between backup (data protection) and disaster recovery (workload failover) are testable concepts.

Azure Advisor shows up occasionally — it generates recommendations for cost, security, reliability, performance, and operational excellence. Know what it does and what types of recommendations it produces.

How to Prepare for the AZ-104

Six to eight weeks is a realistic prep window if you're working full time and studying 1–2 hours on weekdays plus longer sessions on weekends. If you have more time or prior Azure experience, you might be ready sooner. Here's what actually works — in order of impact.

Microsoft Learn — Free and Authoritative

Start here. Microsoft Learn (learn.microsoft.com) has a dedicated AZ-104 learning path that covers all five exam domains with modules, hands-on exercises, and knowledge checks. It's free, it's written by Microsoft, and it maps directly to the exam objectives. The sandbox environments embedded in many modules let you practice Azure tasks without needing your own subscription — genuinely useful for core concepts.

Don't just read through the modules. Do the exercises. Click the buttons. Create the resources. The muscle memory of actually navigating the Azure portal and running CLI commands translates directly to exam performance, especially on the lab-style questions.

John Savill's AZ-104 YouTube Series

John Savill is the best free Azure instructor available, full stop. His AZ-104 study cram video is a few hours long and covers the entire exam blueprint with clear explanations and whiteboard diagrams. His channel (youtube.com/@NTFAQGuy) also has deep-dive videos on specific topics like VNet peering, RBAC, and Azure AD that go beyond the basics. Watch at 1.25x if you're comfortable with the material — it's dense but well-organized.

Hands-On Azure Labs — Non-Negotiable

The AZ-104 is not a paper cert. You can't pass it by watching videos alone — the exam expects you to know how things actually work, not just what they're called. Get an Azure free account (12 months free, $200 credit) and build things. Deploy VMs, configure VNet peering, create storage accounts with different redundancy options, set up NSGs, configure Azure Backup.

Work through the Microsoft Learn exercises first, then try to recreate them from memory. If you get stuck, that's information — it tells you where to go back and study. Hands-on practice is the fastest way to solidify the networking and compute domains, which together make up 40–50% of the exam.

Practice Exams — The Final 2 Weeks

In the last two weeks before your exam, shift your focus to practice tests. MeasureUp is the official Microsoft-endorsed practice test vendor — expensive but the closest to the real exam format. Udemy courses from providers like A-Cloud Guru and CloudSkills include solid practice question banks at a much lower price point, especially when Udemy runs sales (which is almost always).

Don't just take practice tests to see your score. Review every question you got wrong — and the ones you got right by guessing. Understand why the correct answer is correct and why the distractors are wrong. That's where the learning actually happens.

When you're consistently scoring 75–80% on full-length practice exams, you're ready. Don't delay — schedule the exam for when your confidence is high. The knowledge fades faster than you think.

AZ-104 vs Other Azure Certifications

The Azure certification path has a logic to it — and understanding where the AZ-104 fits helps you decide if it's the right cert for you now, or if a different Azure credential makes more sense first. Microsoft has roughly 20 Azure certifications across three levels: Fundamentals, Associate, and Expert. The AZ-104 sits at the Associate level and is the starting point for most Azure infrastructure career paths. Each certification targets a distinct role, so picking the right one matters more than collecting as many as possible.

AZ-104 vs AZ-900

The AZ-900 (Azure Fundamentals) is an entry-level certification that covers Azure concepts, services, and pricing at a high level. It's a fundamentals exam — you don't configure anything, you just need to understand what Azure is and how it's structured. The AZ-104 is an associate-level certification that requires you to actually manage Azure resources. If you already work in Azure and understand VNets, storage accounts, and Azure AD at a practical level, you don't need the AZ-900 — go straight to the AZ-104. If Azure is genuinely new to you, spend 2–3 weeks on AZ-900 first.

AZ-104 vs AZ-500

The AZ-500 (Azure Security Engineer Associate) is a peer-level certification — same associate tier as the AZ-104. It focuses on security: identity protection, network security, data security, and security monitoring. The AZ-104 and AZ-500 have significant topic overlap (Azure AD, NSGs, Key Vault, Azure Monitor), which is why many security-focused administrators pursue both. The AZ-500 is generally considered harder than the AZ-104 because the security-specific topics require deeper knowledge and the questions are more scenario-heavy. Getting the AZ-104 first builds a solid foundation for the AZ-500.

AZ-104 vs AZ-305

The AZ-305 (Azure Solutions Architect Expert) is an expert-level certification that sits above the AZ-104 on Microsoft's certification hierarchy. Architects design solutions — they decide which Azure services to use, how to structure the architecture, and how to meet requirements for scalability, reliability, cost, and security. The AZ-104 is a prerequisite mindset (not a formal one) for the AZ-305 because you can't design Azure architectures effectively if you don't understand how the services actually work operationally. Many experienced Azure Admins pursue the AZ-305 after a year or two of working in Azure post-AZ-104.

Which one should you go for?

If you're managing or planning to manage Azure infrastructure — the AZ-104. If you're brand new to Azure — the AZ-900 first, then AZ-104. If your role is security-focused — AZ-104 then AZ-500. If you want to move into architecture — AZ-104 then AZ-305. The AZ-104 is the right foundation for almost every Azure career path. Check out arizona permit test tips, then apply the same methodical approach to AZ-104 prep. Don't overthink the sequencing — start with the AZ-104 and let your career direction guide what comes next.