Baseline & tools
Build an Azure map before memorizing services.
Mastery map
Turn the official objectives into your next study move.
Rate each skill from 1 to 5. Anything at 3 or below becomes your short list for a lab, flashcards, and the linked Microsoft Learn path.
SELF-ASSESSMENT0 / 82objectives rated
1 unfamiliar3 needs a guided retry5 can explain and perform
Focus next
Rate your first objective
Use an honest rating—this map is a planner, not a scorecard.
Identity & governance20–25% of the examOpen checklist
Deep-dive topics: Management groups, locks, tags, budgets and Advisor · External users, licenses and SSPR
Microsoft Entra users and groups
Create users and groups
Manage user and group properties
Manage licenses in Microsoft Entra ID
Manage external users
Configure self-service password reset (SSPR)
Access to Azure resources
Manage built-in Azure roles
Assign roles at different scopes
Interpret access assignments
Subscriptions and governance
Implement and manage Azure Policy
Configure resource locks
Apply and manage tags on resources
Manage resource groups
Manage subscriptions
Manage costs with alerts, budgets and Azure Advisor recommendations
Configure management groups
Storage15–20% of the examOpen checklist
Deep-dive topics: Azure Files identity-based access · Object replication, lifecycle, versioning and transfer tools
Access to storage
Configure Storage firewalls and virtual networks
Create and use SAS tokens
Configure stored access policies
Manage access keys
Configure identity-based access for Azure Files
Storage accounts
Create and configure storage accounts
Configure Storage redundancy
Configure object replication
Configure storage account encryption
Manage data with Storage Explorer and AzCopy
Azure Files and Blob Storage
Create and configure an Azure Files share
Create and configure a Blob Storage container
Configure storage tiers
Configure soft delete for blobs and containers
Configure snapshots and soft delete for Azure Files
Configure blob lifecycle management
Configure blob versioning
Compute20–25% of the examOpen checklist
Deep-dive topics: Bicep conversion and deployment export · VM moves, encryption at host, VMSS, ACR and Container Apps
ARM templates and Bicep
Interpret an ARM template or Bicep file
Modify an existing ARM template
Modify an existing Bicep file
Deploy with an ARM template or Bicep file
Export an ARM deployment or convert ARM to Bicep
Virtual machines
Create a virtual machine
Configure encryption at host
Move a VM to another resource group, subscription or region
Manage VM sizes
Manage VM disks
Deploy VMs to availability zones and availability sets
Deploy and configure Virtual Machine Scale Sets
Containers
Create and manage Azure Container Registry
Provision a container with Azure Container Instances
Provision a container with Azure Container Apps
Manage sizing and scaling for ACI and Container Apps
Azure App Service
Provision an App Service plan
Configure scaling for an App Service plan
Create an App Service
Configure certificates and TLS
Map an existing custom DNS name
Configure App Service backup
Configure networking settings
Configure deployment slots
Virtual networking15–20% of the examOpen checklist
Deep-dive topics: Service endpoints versus private endpoints · ASGs, Bastion and Connection Monitor
Virtual networks
Create and configure VNets and subnets
Create and configure VNet peering
Configure public IP addresses
Configure user-defined routes
Troubleshoot network connectivity
Secure access
Create and configure NSGs and application security groups
Evaluate effective security rules in NSGs
Implement Azure Bastion
Configure service endpoints for PaaS
Configure private endpoints for PaaS
Name resolution and load balancing
Configure Azure DNS
Configure an internal or public load balancer
Troubleshoot load balancing
Monitor & maintain10–15% of the examOpen checklist
Deep-dive topics: KQL logs, action groups and processing rules · Recovery Services versus Backup vaults and Site Recovery
Monitor resources
Interpret Azure Monitor metrics
Configure Azure Monitor log settings
Query and analyze Azure Monitor logs
Set up alert rules, action groups and alert processing rules
Configure and interpret Azure Monitor Insights for VMs, storage and networks
Use Network Watcher and Connection Monitor
Backup and recovery
Create a Recovery Services vault
Create an Azure Backup vault
Create and configure a backup policy
Perform backup and restore with Azure Backup
Configure Azure Site Recovery for Azure resources
Perform a Site Recovery failover to a secondary region
Configure and interpret backup reports and alerts
Administrator Associate prep
Learn Azure by running it.
A practical AZ-104 field guide with current weighted objectives, original scenario practice, tenant-ready labs, and rapid comparison notes.
Your runway
A 9-session sprint that matches the blueprint
Spend time where the exam spends time: identity/governance and compute. Each session ends with a decision, an Azure action and a short recall loop.
Identity & governance
Learn the controls people most often blend together.
Storage
Choose access, durability and protection independently.
Compute
Select the platform by workload shape, not familiarity.
Networking
Trace traffic instead of guessing at services.
Monitor & recovery
Choose a data or recovery mechanism that answers one question.
Integrated tenant day
Connect objectives into one small operating environment.
Timed practice + repair
Convert misses into targeted improvement, not random question volume.
Light recall
Arrive rested with key distinctions ready at speed.
Quick notes
High-yield Azure decisions
Use these facts and scenario cues to identify the right scope, control, or service before opening a lab or answering a question.
Key facts
- Azure is scoped tenant → management group → subscription → resource group → resource. Parent settings can affect children.
- Control plane creates or configures resources through Azure Resource Manager. Data plane uses a resource, such as reading a blob.
- Portal, Cloud Shell, Azure CLI and PowerShell are interfaces to the management plane. Bicep describes infrastructure declaratively.
Scenario cueIf the action creates, changes, assigns, or deploys an Azure resource, start with the control plane and the target scope.
Do not confuseA resource group is a lifecycle container, not a regional container. Its resources can live in different regions.
Try it in AzureExplain why a developer can be Contributor in one resource group but unable to list another.
Recall lineScope → plane → control → evidence.
Open the related Microsoft Learn pathStudy rule: when you miss a question, state why each tempting answer fails. That turns names into operational judgment.
The blueprint
Five domains; one connected operating model
These weights match Microsoft’s skills-measured guide as of April 17, 2026. Use them to choose your next study hour, then confirm changes against the official outline.
Identity & governance
20–25%Entra users/groups, RBAC scopes, Policy, locks, tags, subscriptions, budgets and management groups.
- Choose the narrowest effective RBAC scope
- Separate RBAC, Policy, tags and locks
- Explain inheritance from management group to resource
Storage
15–20%Storage access, SAS and policies, redundancy, Azure Files, Blob protection, lifecycle and transfer tools.
- Match redundancy to a stated failure requirement
- Delegate bounded access without exposing account keys
- Protect blobs and file shares with the right recovery feature
Compute
20–25%Bicep/ARM, VM operations, disks, availability, scale sets, containers and App Service.
- Read then modify a Bicep deployment
- Pick the platform that fits the workload shape
- Design availability and scaling deliberately
Networking
15–20%VNets, peering, NSGs, ASGs, UDRs, Bastion, private access, DNS, load balancing and troubleshooting.
- Trace a packet through DNS, route and NSG decisions
- Distinguish service endpoints from private endpoints
- Use Network Watcher evidence before changing a rule
Monitor & maintain
10–15%Metrics, logs, alerts, Insights, Network Watcher, Backup, Site Recovery and recovery testing.
- Choose metrics, logs or activity-log evidence
- Build alerts with an actionable response
- Prove a restore or failover plan rather than assuming it works
Decision lens
Ask these four questions on every scenario
- Scope: tenant, management group, subscription, resource group or resource?
- Plane: management action, data access or network traffic?
- Control: access, governance, resiliency, performance or cost?
- Evidence: metric, log, effective rule, Activity Log or restore test?
Use your tenant
Ten labs that build administrator instinct
The exercises use small, reversible resources. Check pricing, quotas and regional availability before creating anything; delete temporary resources at the end.
Entra access at the right scope
Practice a least-privileged assignment and interpret where it takes effect.
- Create a temporary group or use a test group
- Create rg-az104-identity and assign Reader to that group at resource-group scope
- Compare access assignments at the resource group and subscription
- Remove the role assignment, membership and resource group
Identity proves who is calling; Azure RBAC decides what that identity can do at a scope. Inheritance goes downward, not sideways.
Govern a small platform
Use guardrails without confusing what each one controls.
- Create a tagged temporary resource group with CostCenter and Environment
- Assign a tag requirement policy and inspect compliance state
- Add a CanNotDelete lock and observe the blocked management-plane deletion
- Create a budget alert and clean up after recording observations
Policy evaluates standards, locks protect management operations, tags describe resources, and budgets notify about spend.
Blob storage with a recovery story
Make a private container recoverable and grant a short limited handoff.
- Create a storage account and compare available redundancy choices
- Create a private container; upload then overwrite a sample file
- Enable versioning and soft delete, then recover the earlier version
- Generate a short-lived HTTPS-only SAS with only needed permission; remove the account
Versioning handles overwrites; soft delete handles deletion. A SAS is narrow delegation, not a replacement for identity-based access.
Azure Files and access choices
Compare a shared file system with object storage and map its recovery tools.
- Create a file share and inspect protocol and quota settings
- Review identity-based access options for Azure Files
- Create a file-share snapshot or walk through the supported restore path
- Write one sentence explaining why a blob container is not a file share
Azure Files provides a managed file-share interface; Blob Storage is object storage. Choose from the workload access pattern.
Bicep deployment reading drill
Move from clicking resources to understanding a declarative deployment.
- Create a minimal Bicep file for a storage account
- Identify parameters, resources, outputs and a dependency
- Deploy to a temporary resource group, change one parameter and redeploy
- Inspect deployment history, then delete the resource group
Bicep states intended end state. Expect to interpret or modify an existing definition rather than author a large template from memory.
VM availability and operations
Separate VM configuration, capacity and availability design.
- Compare zone, availability-set and scale-set choices in the create flow
- Inspect VM sizes, managed disk options and stop/deallocate behavior
- Review a VM move: resource group, subscription and region are different moves
- Document which option fits a two-tier stateful app and why
Availability zones, availability sets and VM Scale Sets solve related but distinct resilience or scale problems.
VNet traffic path
Build a small network and prove why a flow is allowed or denied.
- Create a VNet with web and data subnets, leaving room for growth
- Attach an NSG with one narrow rule and deliberate priority
- Create a route table and inspect effective routes and security rules
- Use Network Watcher evidence before changing a rule; remove resources
DNS names the destination, routing picks a next hop and an NSG filters traffic. Treat each as separate evidence.
Private PaaS endpoint and DNS
Connect a PaaS resource through a private address and validate resolution.
- Create a supported PaaS resource and a private endpoint in the data subnet
- Link the suggested private DNS zone to the VNet
- Verify the service name resolves to the private address
- Compare the design with a service endpoint and clean up
A service endpoint keeps a public service endpoint. A private endpoint places a private NIC in your VNet, and DNS must support it.
Load balancing and secure admin access
Choose Layer 4 distribution and avoid exposing VM management ports.
- Sketch two backend VMs, a health probe, backend pool and rule
- Decide whether the frontend should be internal or public
- Review Azure Bastion as an admin path without public SSH/RDP on each VM
- Use health evidence to explain a failed probe
Load Balancer distributes TCP/UDP flows. Bastion reaches VMs without assigning public IPs to every workload VM.
Observe, alert and recover
Make a small workload observable with a believable recovery plan.
- Create a Log Analytics workspace and inspect metrics versus logs
- Create a metric alert with an action group and review alert processing
- Compare Recovery Services and Backup vaults in the portal
- Choose a backup policy, identify a restore point and document validation
A metric answers “how much, now?” A log explains context. Backup restores; Site Recovery prepares replicated workloads for failover.
Decision maps
See the terms working together
Follow each visual as a scenario. The arrows show a responsibility or traffic path, so you can identify what a question is actually asking you to configure or troubleshoot.
Scenario: secure a production project
Governance works in layers
A new finance workload needs access, standards, protection, and cost ownership. Each control answers a different question.
Entra groupWho is calling?→RBAC at resource groupWhat may they do?→Production resourcesThe protected workload
PolicyWhat configuration is allowed?LockCan it be changed or deleted?Tags + budgetWho owns spend and when are we alerted?
Scenario prompt: A finance reader needs visibility, a developer needs narrow write access, and public IPs are not allowed. Which controls solve each requirement?
Scenario: private app reaches storage
Trace the request, not the product names
An internal app must reach a storage account without using the public endpoint. Diagnose the path in this order.
App workloadStarts request→Private DNSResolves service name→Route + NSGSteers then filters→Private endpointPrivate IP in VNet→StorageData-plane access
Scenario prompt: The service name resolves publicly after the private endpoint is created. Which component is missing, and why would an NSG rule not fix the name resolution?
Scenario: slow VM and recovery requirement
Observe, notify, then prove recovery
Monitoring tells you what is happening. Recovery mechanisms determine what you can restore or fail over.
VM workloadProduces signals→Metrics + logsEvidence and context→Alert ruleEvaluates condition→Action groupNotifies or automates
Azure BackupRestore from recovery pointSite RecoveryReplicate and fail overRestore testEvidence the plan works
Scenario prompt: CPU is high, the app is still available, and regional DR is required. Which services collect evidence, alert operations, restore data, and prepare the workload to fail over?
Decision tables
Fast distinctions for scenario questions
Read from the requirement column first. The best answer usually matches the stated boundary without adding unrelated capability.
Access and governance
What question are you actually answering?
| Option | Choose it when | Administrator cue |
|---|---|---|
| RBAC | Who can perform an Azure action? | Role assignment at the narrowest useful scope |
| Azure Policy | Which configurations are allowed or required? | Assign a definition or initiative and review compliance |
| Resource lock | How do I prevent accidental management change? | CanNotDelete or ReadOnly at the protected scope |
| Tags / budgets | Who owns this cost and when should we notice spend? | Resource metadata and cost notifications |
Storage choices
Separate access, durability and recovery.
| Option | Choose it when | Administrator cue |
|---|---|---|
| Blob Storage | Object data, media or unstructured content | Containers, tiers, lifecycle, versioning and soft delete |
| Azure Files | Managed SMB/NFS file-system workload | File shares, identity access, snapshots and soft delete |
| SAS / stored policy | Time-bounded delegated Storage access | Limit permissions; use policy-backed service SAS when central revocation matters |
| LRS / ZRS / GRS | A local, zonal or regional resilience requirement | Choose the failure boundary first |
Compute and availability
Pick the operating model before the product name.
| Option | Choose it when | Administrator cue |
|---|---|---|
| Virtual machine | You need operating-system control | Size, disks, extensions, availability and lifecycle operations |
| VM Scale Set | A scalable fleet of similar VMs | Instance model, autoscale and load distribution |
| Availability set / zones | Protection from hardware/update or zone failure | Availability placement; not capacity scaling |
| ACI / Container Apps / App Service | A single container, managed container app or managed web app | Operational abstraction, scaling and networking requirements |
Network path controls
Name → route → filter → endpoint.
| Option | Choose it when | Administrator cue |
|---|---|---|
| Private DNS | What address should a service name resolve to? | Link the correct private zone to the VNet |
| User-defined route | Where should the packet go next? | Route table and next-hop type |
| NSG / ASG | Which flows are permitted or denied? | Rule priority, direction and effective rules |
| Private / service endpoint | How does a VNet reach PaaS? | Private IP versus public endpoint with VNet identity |
Traffic distribution
Which layer and reach determine the answer?
| Option | Choose it when | Administrator cue |
|---|---|---|
| Load Balancer | TCP/UDP Layer 4 distribution | Public or internal frontend, health probe, rule and backend pool |
| Application Gateway | HTTP/S Layer 7 routing and web-aware features | Listener, routing rule, backend and optional WAF |
| Front Door | Global HTTP/S entry and acceleration | Global routing, edge presence and web delivery needs |
| Traffic Manager | DNS-based endpoint selection | Priority, weighted, performance or geographic DNS routing |
Observe and recover
Is this evidence, notification, restore or failover?
| Option | Choose it when | Administrator cue |
|---|---|---|
| Metrics | Numeric condition over time | Charts and near-real-time threshold alerts |
| Logs / Activity Log | Detailed events or management history | KQL analysis versus subscription-level change evidence |
| Azure Backup | Return data or workload to a recovery point | Vault, policy, restore point and restore test |
| Azure Site Recovery | Continue workload in another region after disaster | Replication, failover and failback planning |
Original question set
Practice choosing the best answer, not just a true answer
Each round draws 18 original scenarios from a broader, validated study bank. Do them closed-book first, then use every explanation to repair the underlying concept. This is preparation material—not an exam brain dump.
Question 1
Finance needs read-only visibility of every resource in one production resource group. What is the least-privileged assignment?
Question 2
A vendor’s service SAS must be invalidated before scheduled expiration if a contract ends. What supports that most directly?
Question 3
A Windows workload requires a managed cloud file share mounted like a network share. Which service fits?
Question 4
A storage account must remain available through a zonal failure in its primary region. Which option is the direct match?
Question 5
A team needs a repeatable deployment definition that can be reviewed and redeployed with changed inputs. What should it use?
Question 6
A stateless API must scale a homogeneous group of virtual machines as demand rises. Which option is natural?
Question 7
A container image must be stored privately in Azure before it is run. Which service should host the image?
Question 8
A web team wants to validate a new build separately, then switch it into production with minimal release disruption. What App Service feature fits?
Question 9
A subnet must send traffic for an on-premises prefix through a virtual appliance. Which control changes the next hop?
Question 10
A VM cannot be reached after a security change. Before editing an NSG, what best shows the combined rules that apply?
Question 11
Admins need browser-based RDP/SSH to VMs while avoiding public IPs on workload VMs. What is best?
Question 12
A PaaS storage service must be accessed from a VNet through a private address. Which feature is required?
Question 13
An application distributes TCP traffic across healthy VMs and does not need HTTP path routing. What is best?
Question 14
An alert should fire when average CPU remains above a threshold for five minutes. Which signal should it evaluate?
Question 15
You need to identify who changed a network security group rule yesterday. Which data source starts the investigation?
Question 16
A company wants replicated VM workloads in a second region for planned or unplanned DR failover. What is best?
Question 17
A subscription-level policy denies public IP resources. Where does it apply by inheritance?
Question 18
A user deleted a blob yesterday and overwrote a different blob last week. Which pair addresses both events?
Validated active recall
A curated 47-card AZ-104 deck
Built from your imported cards, then reduced to stable concepts checked against Microsoft’s current learning paths. Say the answer before revealing it; use the linked path only when you need a deeper rebuild.
Final review
Exam-day review: narrow, calm, deliberate
Use this as a final pass, not an extra study session. Verify appointment and identification requirements in your own booking confirmation.
The night before
- Stop broad new study; review your six hardest contrasts only.
- Run five flashcards aloud and one two-minute scenario explanation.
- Confirm appointment time, location or check-in window, and required ID.
- Set out what you need; protect sleep.
When a question feels dense
- Read requirement and constraint before product names.
- Mark the scope, plane and failure boundary.
- Eliminate choices that solve a different problem or grant too much.
- Choose what meets every stated requirement with least added administration.
Last five minutes
- Review only flagged questions with a specific unresolved requirement.
- Do not replace a well-reasoned answer because a name feels unfamiliar.
- Slow down for negatives, scope words and availability boundaries.
- Submit when reasoning is complete; avoid random last-minute changes.
Final recall loop: RBAC / Policy / lock · Blob / Files · LRS / ZRS / GRS · VM / VMSS / zones · DNS / route / NSG / endpoint · metrics / logs / Activity Log · Backup / Site Recovery.
Sources & attribution
Official objectives first; external inspiration credited
Microsoft updates certification objectives periodically. Before final practice, verify the skills outline and take the official practice assessment through Microsoft Learn.
Study guide for Exam AZ-104Current domain weights, objectives, practice assessment and exam sandbox links.Microsoft Azure Administrator course (AZ-104T00-A)Course scope across subscriptions, identity, infrastructure, networking, storage, compute, backup and monitoring.Study-guide inspiration: Arnav MohanOriginal Field Guide labs and notes were informed by the public study guide’s topic coverage. Source license: CC BY-NC-SA 4.0.CC BY-NC-SA 4.0 licenseAttribution and noncommercial share-alike terms for the referenced public study guide.