AZ-104 Azure Administrator Study Guide for 2026

AZ-104 is noticeably harder than the foundational Azure certifications. It expects hands-on experience with core Azure infrastructure services and asks you to solve administrative scenarios. This az-104 study guide for 2026 covers the exam structure, the topics that come up most, and a study plan.

Who Should Take the AZ-104 Exam

AZ-104 is aimed at Azure administrators and infrastructure staff who manage cloud resources at scale. Typical candidates include:

• IT administrators transitioning to cloud infrastructure
• System administrators managing hybrid or cloud-only environments
• Infrastructure engineers deploying Azure resources
• Cloud administrators maintaining Azure deployments
• DevOps engineers focusing on infrastructure automation
• Network engineers implementing Azure networking solutions

AZ-900 checks that you know what the services are. AZ-104 assumes you have deployed and managed them, and its questions are built around production scenarios.

Exam Format and Scoring

Basic Structure

The AZ-104 is a 100-minute associate-level certification exam. It uses interactive question types alongside multiple-choice questions, so prepare for hands-on scenarios.

• Passing Score: 700 on a scaled score of 1-1000 (not a percentage of questions answered correctly)
• Question Types: Multiple choice, multiple answer, drag-and-drop, case studies, and other interactive question types
• Duration: 100 minutes
• Cost: $165 USD (varies by region in local currency)
• Format: Remote or testing centre
• Prerequisite: No official prerequisite, but AZ-900 knowledge is recommended

Scoring is weighted across five domains, and the weights are not equal.

The Five Exam Domains and Weightings

Microsoft splits AZ-104 into five domains. Use the weightings to decide where your study time goes.

Domain 1: Manage Azure Identities and Governance (15-20%)

This domain covers identity management and governance. RBAC is easy to get wrong in practice, and the exam tests it heavily.

Key Topics:

• Role-Based Access Control (RBAC): Built-in roles (Owner, Contributor, Reader), custom roles and scope inheritance. You must know how role assignments propagate through management groups and subscriptions.

• Entra ID (formerly Azure Active Directory): User and group management, synchronisation with on-premises Active Directory via Microsoft Entra Connect, password policies, and Multi-Factor Authentication (MFA) configuration.

• Administrative Units: Segmenting your Entra ID tenant to delegate administrative tasks to specific admins without granting tenant-wide permissions.

• Subscription Management: Moving resources between subscriptions, managing billing accounts, applying policies, and cost allocation.

• Azure Policy: Creating policy definitions to enforce organisational standards. You should understand policy effects (Deny, Audit, Append, Modify) and how to remediate non-compliant resources.

• Management Groups: Organising subscriptions in a hierarchy so governance policies apply at scale.

Study Focus: RBAC is the most tested topic in this domain. Practise assigning roles at different scopes and tracing how permissions inherit.

Domain 2: Implement and Manage Storage (15-20%)

Almost every Azure deployment uses storage, and this domain tests how you set it up.

Key Topics:

• Storage Account Types: Standard General-Purpose v2, Premium Block Blobs, Premium File Shares, and Premium Page Blobs. Know the performance characteristics and use cases for each.

• Blob Storage: Block blobs for unstructured data, append blobs for logging scenarios, page blobs for VHD storage. Learn the blob tiers (Hot, Cool, Archive) and the access pattern each one suits.

• Azure Files: SMB protocol file shares for legacy application compatibility, NFS shares for Linux workloads. Know how to configure authentication (storage account keys, Entra ID, Kerberos) and how to restrict access via service endpoints.

• Storage Lifecycle Policies: Moving blobs between tiers automatically based on age or access patterns. This cuts the cost of data that is read often at first and rarely later.

• Replication Options: Locally-Redundant Storage (LRS), Zone-Redundant Storage (ZRS), Geo-Redundant Storage (GRS), and Read-Access Geo-Redundant Storage (RA-GRS). Understand the trade-off between redundancy and cost.

• Shared Access Signatures (SAS): Creating time-limited, permission-limited tokens for accessing storage without exposing account keys.

• Storage Security: Service endpoints, private endpoints, storage account firewalls, and Entra ID RBAC integration.

Study Focus: Lifecycle policies and replication options come up often. Be able to say which replication option fits a given RTO and RPO requirement.

Domain 3: Deploy and Manage Azure Compute Resources (20-25%)

This domain carries the most weight. It covers virtual machines, scaling, containers and application hosting.

Key Topics:

• Virtual Machines: Creating VMs, configuring sizes, selecting operating systems, managing disks (managed vs. unmanaged), and applying extensions. Know the difference between ephemeral and persistent disks.

• Availability Sets and Zones: Fault domains and update domains in availability sets. Availability zones give better resilience than sets. Know when to use each.

• Virtual Machine Scale Sets (VMSS): Deploying identical VMs that scale based on metrics or schedules. VMSS integrates with load balancers and should be your default choice for web farms.

• App Service: Deploying web apps, APIs and mobile backends. Service plans (Free, Shared, Basic, Standard, Premium, Isolated), scaling options, and deployment slots.

• Azure Kubernetes Service (AKS): Container orchestration basics, node pools and cluster upgrades. The exam expects familiarity with core Kubernetes concepts rather than depth.

• Container Instances: Running containerized applications without managing infrastructure. Know when Container Instances makes sense versus VMSS or AKS.

Study Focus: Spend most of your compute time on VM management and VMSS. Availability sets versus zones comes up often and is often misread.

Domain 4: Implement and Manage Virtual Networking (15-20%)

Many administrators find networking the hardest domain.

Key Topics:

• Virtual Networks (VNets): Creating VNets, designing subnets, address spaces and private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

• Network Security Groups (NSGs): Inbound and outbound rules, stateful filtering, and applying NSGs at subnet or NIC level. Know how Allow, Deny and default rules differ.

• VNet Peering: Connecting two VNets directly. Know how regional and global peering differ, and why peering is not transitive. The exam tests peering heavily.

• VPN Gateway: Site-to-site VPN for connecting on-premises networks, point-to-site VPN for remote users, and ExpressRoute for dedicated connections. Learn the gateway types (VpnGw1, VpnGw2, etc.) and SKUs.

• Azure DNS: Creating DNS zones, adding records (A, AAAA, CNAME, MX, TXT), and using private DNS zones for internal name resolution.

• Load Balancers: Azure Load Balancer for layer-4 load balancing, Application Gateway for layer-7 application-aware routing, and Traffic Manager for global routing.

• Private Endpoints: Connecting to PaaS services over private IP addresses instead of public endpoints, which keeps that traffic off the public internet.

• Service Endpoints: Restricting PaaS service access to specific VNets at the firewall level without using private IP addresses.

• Network Watcher: Diagnosing connectivity issues with connection monitor, packet capture, and flow logs.

Study Focus: VNet peering and NSG rule evaluation are the most tested networking topics. Practise designing multi-tier networks with segmented subnets.

Domain 5: Monitor and Maintain Azure Resources (10-15%)

This domain covers monitoring, backup and disaster recovery.

Key Topics:

• Azure Monitor: Collects metrics and logs from Azure resources. Know the difference between metrics (real-time performance data), logs (KQL queries against detailed event data), and diagnostic settings.

• Log Analytics: The query engine for Monitor logs. You should be comfortable writing basic Kusto Query Language (KQL) queries to investigate issues.

• Alerts: Alert rules based on metrics or log queries, alert states (New, Acknowledged, Closed) and notification actions.

• Application Insights: Monitoring application performance and user behaviour, instrumenting web applications, and correlating requests across components.

• Azure Backup: Backing up VMs, databases and file shares. Recovery points, retention policies, cross-region restore, and soft delete for recovering from accidental deletion.

• Azure Site Recovery: Replicating workloads to a secondary region for disaster recovery. Covers RPO (Recovery Point Objective) and RTO (Recovery Time Objective), failover procedures, and test failovers.

• Azure Update Manager: Automating OS patching across Windows and Linux VMs. Integration with Change Tracking & Inventory.

• Automation Accounts: Runbooks for automating administrative tasks, both graphical and PowerShell-based.

Study Focus: Many candidates mix up Azure Backup and Site Recovery. Backup protects against data loss. Site Recovery protects against a region failing.

The Most Heavily Tested Topics

Community feedback and the official exam materials point to these topics coming up most often:

RBAC and Role Assignments: Scope inheritance, default role permissions and custom roles appear in nearly every version of the exam. Many questions wrap RBAC inside a storage or networking scenario.

VNet Peering: Expect questions on peering connectivity, addressing requirements and the fact that peering is not transitive. Candidates who know peering well still miss the non-transitive edge cases.

Availability Sets vs. Availability Zones: Many candidates confuse the two. Learn fault domains, update domains, and when zones are required for higher availability.

NSG Rules and Evaluation Order: Know how NSGs evaluate inbound and outbound traffic, what the default rules do, and how to troubleshoot a blocked connection.

Storage Account Redundancy and Failover: Know GRS, RA-GRS and how failover works. Weaker candidates tend to lose marks here.

Azure Backup vs. Site Recovery: They do different jobs and are often tested together in scenario questions.

Exam Difficulty and Comparison to AZ-900

AZ-104 is much harder than AZ-900. AZ-900 tests concepts. AZ-104 expects hands-on experience. The difference in practice:

• AZ-900 tests what Azure services do
• AZ-104 tests how to implement and troubleshoot Azure services
• AZ-104 includes scenario-based questions requiring decision-making
• AZ-104 uses interactive question types that test how you would act in a real Azure environment

Plenty of candidates pass AZ-900 easily and then fail AZ-104 because they have not done enough hands-on work. Theory alone will not get you through.

Recommended 8 to 12 Week Study Plan

Weeks 1-2: Foundation and Storage

Get the core concepts down before moving to harder scenarios.

• Study storage account types, blob storage, and file shares
• Create multiple storage accounts in your Azure subscription
• Practise creating and managing blob containers
• Configure lifecycle policies
• Understand replication options through documentation and lab work

Hands-on: Create a storage account, upload blobs, implement lifecycle policies moving blobs from Hot to Cool to Archive tiers.

Weeks 3-4: Networking Fundamentals

Most other topics depend on networking, so it comes early.

• Study VNets, subnets, and address spaces
• Understand NSG rules and stateful filtering
• Learn VNet peering architecture and limitations
• Study load balancers and application gateways

Hands-on: Create two VNets, peer them, create NSGs with specific rules, and test connectivity between subnets.

Weeks 5-6: Identities and Governance

Access to compute and storage runs through RBAC and Entra ID, so learn these first.

• Study RBAC components: roles, scopes, assignments
• Create custom RBAC roles
• Understand Entra ID user and group management
• Study Azure Policy and policy effects
• Learn about management groups

Hands-on: Assign different roles to team members at different scopes, create custom roles, apply policies to subscriptions.

Weeks 7-8: Compute Resources

Compute carries the most exam weight.

• Study VM sizing, availability sets, and zones
• Understand VMSS configuration and scaling
• Study App Service plans and scaling
• Learn about containers and AKS basics

Hands-on: Create VMs in an availability set and zone, create VMSS with autoscaling policies, deploy App Service applications.

Weeks 9-10: Advanced Networking and VPN

A second, deeper pass on networking.

• Study VPN Gateway configuration
• Understand site-to-site and point-to-site VPNs
• Learn about private endpoints and service endpoints
• Study Azure DNS and private DNS zones
• Study Network Watcher diagnostics

Hands-on: Create a VPN gateway, configure site-to-site VPN, set up private endpoints for storage accounts.

Weeks 11-12: Monitoring, Backup, and Review

Finish with monitoring and disaster recovery.

• Study Azure Monitor and Log Analytics
• Write KQL queries against real log data
• Understand Azure Backup and retention policies
• Study Site Recovery and disaster recovery scenarios
• Review weak areas and practice questions

Hands-on: Configure backups for VMs, set up Site Recovery replication, create Monitor alerts, write KQL queries in Log Analytics.

Essential Hands-On Labs

Do all seven of these labs before booking the exam:

Lab 1: Create and Configure Virtual Machines

Deploy Windows and Linux VMs in different sizes. Configure managed disks, add extensions, and connect over RDP and SSH. Create availability sets and deploy VMs across them.

Lab 2: Configure VNet Peering and Connectivity

Create two VNets with non-overlapping address spaces. Configure peering between them. Create NSGs with specific rules to allow and deny traffic. Test connectivity between VMs in peered networks. Troubleshoot any connection that fails. Networking questions test the same skills.

Lab 3: Implement Azure Backup

Create VM snapshots, configure Azure Backup policies with different retention schedules, run restores, and check what the backup storage costs. Restore individual files from a VM backup.

Lab 4: Configure Storage Account Security

Create storage accounts with different redundancy options. Configure service endpoints and private endpoints. Create Shared Access Signatures with specific permissions and time limits. Restrict access using storage account firewalls and NSGs.

Lab 5: Create Load Balancing Solutions

Deploy VMs behind an Azure Load Balancer. Configure health probes and load balancing rules, then take a backend down and watch the load balancer stop routing to it.

Lab 6: Configure Monitoring and Alerts

Create diagnostic settings on VMs to send logs to Log Analytics. Create metrics-based and log-based alert rules. Write KQL queries to extract specific information. Configure action groups for alert notifications.

Lab 7: Site Recovery Configuration

Enable Site Recovery replication for a VM to a secondary region. Configure replication policies. Run test failovers. Learn how planned and unplanned failovers differ.

Study Resources and Practice Questions

azureprep.com has AZ-104 practice questions across multiple exam simulations (a free preview, with full access through an All-Access subscription), including:

• Full-length practice exams with detailed explanations
• Domain-specific question banks for focused study
• Explanations referencing Microsoft documentation
• Performance tracking to identify weak areas
• Access to the azureprep.com community for discussion

To see how AzurePrep compares against MeasureUp and Whizlabs for AZ-104 specifically, read the best AZ-104 practice exam comparison.

Other resources:

• Microsoft Learn Modules: Official, free, interactive training for each domain
• Azure Documentation: Reference for specific features, commands, and limitations
• Microsoft Learn Sandbox: Free Azure environment for hands-on practice without using your own subscription. Useful for testing configurations without risk to a real environment.
• Azure Architecture Center: Reference architectures and design guidance for Azure solutions
• GitHub Azure Samples: Code examples and templates for common Azure deployment scenarios

Final Exam Tips

Book the exam once you are scoring 85% or higher on practice tests consistently. In the exam, read each question carefully and rule out the clearly wrong answers first. Phrases like "least cost," "most secure" or "minimum administrative effort" tell you which answer the question wants.

Watch the clock and do not sink too long into one question. Flag the hard ones and come back after the easier ones. The Azure portal changes often, so learn what each service does and how it is configured rather than where a button sits.

The AZ-104 Azure Administrator certification covers managing Azure subscriptions, implementing storage, configuring virtual networking and monitoring Azure resources. To pass, pair study with hands-on labs and regular exam-style practice, and learn why each configuration option exists as well as the steps to set it.

AZ-104 practice questions (free preview, full access with an All-Access subscription) are at azureprep.com.