AZ-104 Study Guide: Hands-On Prep for the Azure Administrator Exam

AZ-104 is the Azure Administrator exam, and it is hands-on in a way the fundamentals exams are not. You need to know how things are configured, not only what they do. This guide follows Microsoft's published skills outline and shows where to practice each area.

Exam at a glance

Candidates should be comfortable with the portal, PowerShell or Azure CLI, and ARM or Bicep.

Identities and governance (20-25%)

• Entra users, groups, licenses, external users and self-service password reset
• Built-in roles, assigning roles at different scopes, and interpreting access assignments
• Azure Policy, resource locks, tags, resource groups, subscriptions, management groups, and cost control with budgets and Advisor

Know the scope chain: management group, subscription, resource group, resource. Roles and policies inherit downward.

Storage (15-20%)

• Access: storage firewalls and virtual networks, SAS tokens, stored access policies, access keys, identity-based access for Azure Files
• Accounts: redundancy, object replication, encryption, Storage Explorer and AzCopy
• Files and Blob: file shares, containers, tiers, snapshots, soft delete, lifecycle management and versioning

Exam habit: when a question asks for the most secure way to grant temporary access, think SAS with a stored access policy, or identity-based access, before account keys.

Compute (20-25%)

• ARM templates and Bicep: read them, modify them, deploy them, export and convert
• Virtual machines: sizes, disks, Disk Encryption, availability zones and sets, scale sets, moving a VM
• Containers: Container Registry, Container Instances, Container Apps
• App Service: plans, scaling, certificates and TLS, custom DNS, backup, networking, deployment slots

Virtual networking (15-20%)

A short lab that covers VNets, subnets, NSGs and rules:

az group create -n rg-az104-lab -l swedencentral

az network vnet create -g rg-az104-lab -n vnet-lab \
  --address-prefixes 10.0.0.0/16 \
  --subnet-name snet-app --subnet-prefixes 10.0.1.0/24

az network nsg create -g rg-az104-lab -n nsg-app

az network nsg rule create -g rg-az104-lab --nsg-name nsg-app \
  -n allow-https --priority 100 --direction Inbound --access Allow \
  --protocol Tcp --destination-port-ranges 443

az network vnet subnet update -g rg-az104-lab --vnet-name vnet-lab \
  -n snet-app --network-security-group nsg-app

# clean up
az group delete -n rg-az104-lab --yes --no-wait

Also cover peering, user-defined routes, Bastion, service endpoints versus private endpoints, Azure DNS and load balancers. Practice reading effective security rules, since troubleshooting questions lean on them.

Monitoring and backup (10-15%)

• Azure Monitor metrics, logs, KQL queries, alert rules, action groups, VM and network insights, Network Watcher
• Recovery Services and Backup vaults, backup policies, restore operations, Site Recovery and failover

Study plan (4-6 weeks)

1. Read the skills outline and rank your weak areas.
2. Do the Microsoft Learn labs rather than only reading.
3. Build everything above in your own subscription and delete it afterward.
4. Take the practice assessment on AI Skills Navigator, then review each miss in the portal.
5. Try the exam sandbox, because Azure Administrator exams can include interactive task formats.

Confirm the current objectives on the official AZ-104 study guide before booking.

Which area gives you the most trouble: networking or storage access? Tell me below.