Microsoft Azure Administrator (AZ-104)
Implement, manage and monitor Azure identity, storage, compute, networking and governance as an Azure administrator. Lessons, exam-style practice, timed mocks and an AI tutor, mapped to every objective of the official exam guide.
Free Included · 7-day free trial
The exam
- Questions
- 50
- Time
- 100 minutes
- Passing score
- 700 on a scale of 1-1000
- Exam fee
- Not published on the exam page (priced by country or region); USD 165 is the commonly cited US price
- Valid for
- 1 year; renew free each year with an online assessment on Microsoft Learn (open within 6 months before expiry)
- Delivery
- Proctored by Pearson VUE, online or at a test center
Official exam page · booked with Microsoft
Every section of the exam guide
5 sections and 81 objectives, in the official weights. Each lesson is mapped to the objectives it covers.
Section 1 · Manage Azure identities and governance23%
What the exam asks
- Create users and groups
- Manage user and group properties
- Manage licenses in Microsoft Entra ID
- Manage external users
- Configure self-service password reset (SSPR)
- Manage built-in Azure roles
- Assign roles at different scopes
- Interpret access assignments
- Implement and manage Azure Policy
- Configure resource locks
- Apply and manage tags on resources
- Manage resource groups
- Manage subscriptions
- Manage costs by using alerts, budgets, and Azure Advisor recommendations
- Configure management groups
Lessons
- Users, groups and licenses in Microsoft Entra ID
- External users and self-service password reset
- Azure RBAC: roles, scopes and reading assignments
- Azure Policy, resource locks and tags
- Resource groups, subscriptions, costs and management groups
Section 2 · Implement and manage storage18%
What the exam asks
- Configure Azure Storage firewalls and virtual networks
- Create and use shared access signature (SAS) tokens
- Configure stored access policies
- Manage access keys
- Configure identity-based access for Azure Files
- Create and configure storage accounts
- Configure Azure Storage redundancy
- Configure object replication
- Configure storage account encryption
- Manage data by using Azure Storage Explorer and AzCopy
- Create and configure a file share in Azure Storage
- Create and configure a container in Blob Storage
- Configure storage tiers
- Configure snapshots and soft delete for Azure Files
- Configure blob lifecycle management
- Configure blob versioning
Lessons
- Secure access to storage: firewalls, keys and SAS
- Storage accounts, redundancy, replication and encryption
- Azure Files: identity, shares, snapshots and copy tools
- Blob containers, tiers, lifecycle and versioning
Section 3 · Deploy and manage Azure compute resources23%
What the exam asks
- Interpret an Azure Resource Manager template or a Bicep file
- Modify an existing Azure Resource Manager template
- Modify an existing Bicep file
- Deploy resources by using an Azure Resource Manager template or a Bicep file
- Export a deployment as an Azure Resource Manager template or convert an Azure Resource Manager template to a Bicep file
- Create a virtual machine
- Configure Azure Disk Encryption
- Move a virtual machine to another resource group, subscription, or region
- Manage virtual machine sizes
- Manage virtual machine disks
- Deploy virtual machines to availability zones and availability sets
- Deploy and configure an Azure Virtual Machine Scale Sets
- Create and manage an Azure container registry
- Provision a container by using Azure Container Instances
- Provision a container by using Azure Container Apps
- Manage sizing and scaling for containers, including Azure Container Instances and Azure Container Apps
- Provision an App Service plan
- Configure scaling for an App Service plan
- Create an App Service
- Configure certificates and Transport Layer Security (TLS) for an App Service
- Map an existing custom DNS name to an App Service
- Configure backup for an App Service
- Configure networking settings for an App Service
- Configure deployment slots for an App Service
Lessons
- Reading and modifying ARM templates and Bicep files
- Deploying, exporting and converting templates
- Virtual machines: create, encrypt, resize, move and manage disks
- Availability zones, availability sets and Virtual Machine Scale Sets
- Containers: Azure Container Registry, Container Instances and Container Apps
- App Service plans, scaling, creating apps and networking
- App Service custom domains, certificates, backups and deployment slots
Section 4 · Implement and manage virtual networking18%
What the exam asks
- Create and configure virtual networks and subnets
- Create and configure virtual network peering
- Configure public IP addresses
- Configure user-defined network routes
- Troubleshoot network connectivity
- Create and configure network security groups (NSGs) and application security groups
- Evaluate effective security rules in NSGs
- Implement Azure Bastion
- Configure service endpoints for Azure platform as a service (PaaS)
- Configure private endpoints for Azure PaaS
- Configure Azure DNS
- Configure an internal or public load balancer
- Troubleshoot load balancing
Lessons
- Virtual networks, subnets, peering and public IP addresses
- Routes, network security groups and connectivity troubleshooting
- Azure Bastion, service endpoints and private endpoints
- Azure DNS and Azure Load Balancer
Section 5 · Monitor and maintain Azure resources13%
What the exam asks
- Interpret metrics in Azure Monitor
- Configure log settings in Azure Monitor
- Query and analyze logs in Azure Monitor
- Set up alert rules, action groups, and alert processing rules in Azure Monitor
- Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights
- Use Azure Network Watcher and Connection Monitor
- Create a Recovery Services vault
- Create an Azure Backup vault
- Create and configure a backup policy
- Perform backup and restore operations by using Azure Backup
- Configure Azure Site Recovery for Azure resources
- Perform a failover to a secondary region by using Site Recovery
- Configure and interpret reports and alerts for backups
Lessons
- Azure Monitor metrics, logs and KQL
- Alerts, Insights and Network Watcher
- Azure Backup: vaults, policies, restore and reports
- Azure Site Recovery for Azure VMs
21-Day Standard Plan
The default path for admins who have used the Azure portal and CLI but have not studied for AZ-104. It covers all 24 lessons and the 10 labs in section order, with a drill after each section and a short flashcard set each day. Section 1 (20-25%) and Section 3 (20-25%) get the most days; Section 5 (10-15%) gets three. Mock Exam 1 on day 20 measures readiness; day 21 fixes the weakest sections and ends with Mock Exam 2. Sit the exam a few days later, and use Mock Exams 3 and 4 as retests in that last week. About 1.5–2.5 hours a day.
- Day 1Kick-off: the exam, then users, groups and licenses in Microsoft Entra ID
- Day 2External users, SSPR and Azure RBAC
- Day 3Azure Policy, locks and tags, then the b1 governance lab
- Day 4Resource groups, subscriptions, costs and management groups, then the b1 drill
- Day 5Secure access to storage, then accounts, redundancy and encryption
- Day 6Azure Files, snapshots and copy tools, then blob tiers, lifecycle and versioning
- Day 7Storage lab and the b2 drill
- … and 14 more days, with mock exams at the end
Sample questions
Written for practice in the style of the real exam: never questions from the real exam.
Sample question 1
An LRS account contains blobs in the archive tier. The team wants to change the account to ZRS. What must be done first?
- ADelete the soft-deleted blobs
- BEnable blob versioning
- CChange the default access tier to Cool
- DRehydrate the archived blobs to an online tier
Show the answer
D. To change an account that holds archived blobs to a redundancy option that does not support the archive tier, you must rehydrate the blobs first. This can be slow and costly, so avoid changing redundancy for such accounts.
Sample question 2
An internal Standard load balancer fronts three domain controllers that serve LDAPS on TCP 636. An HTTP health probe on port 636 marks every backend unhealthy. What should be changed?
- AChange the probe path to /health and keep the HTTP protocol on port 636
- BChange the probe interval to 120 seconds and the threshold to 5
- CChange the load-balancing rule to Floating IP and keep the HTTP probe
- DChange the health probe protocol to TCP and keep port 636
Show the answer
D. HTTP and HTTPS probes succeed only when the endpoint answers HTTP 200. For non-HTTP services such as LDAP, use a TCP probe on a port that reflects the service's health, which succeeds when the TCP handshake completes.
About this exam
What score do I need, and is it a percentage?
700 on a scale of 1 to 1,000. It is a scaled score, so it does not equal 70% correct, and the number of correct answers needed varies by exam form. This course's readiness target is 80% or higher on both of the first two mock exams on the first attempt.
How many questions are there, and how long do I have?
Microsoft does not publish the number for AZ-104. Most Microsoft certification exams have between 40 and 60 questions. You have 100 minutes of exam time (about 120 minutes of seat time). The mock exams here use 50 questions in 100 minutes.
Can I use Microsoft Learn during the exam?
Yes. AZ-104 is an associate role-based exam, and Microsoft lets you open Microsoft Learn in a side panel. The timer keeps running, no extra time is added, and Q&A, practice assessments and your profile are blocked. Plan to use it for one or two exact lookups, not as a strategy.
Is the skills outline still the October 26, 2023 version?
As of November 2026 the study guide still shows skills measured as of October 26, 2023, and the certification page was last updated on April 17, 2026. Microsoft can update the outline with a published change log, so check the study guide two weeks before your exam.
Online proctored or test center?
Both use Pearson VUE and Microsoft says the exams are equally difficult. Online needs a private, walled room, a clean desk, an ID that matches your profile exactly, a system test, and recording with possible facial comparison. A test center avoids those requirements. You can mix delivery methods across exams.
Are there labs or case studies on AZ-104?
The exam page says you may have interactive components. Microsoft does not list which exams contain labs, and says labs can be removed at any time, so the introduction screens on exam day are the authority. Case studies, drag and drop, hot area, build list and multiple response items can appear; try them in the free exam sandbox.
Do I need to know both the portal and the command line?
Yes. The outline expects the Azure portal, Azure CLI, Azure PowerShell, ARM templates or Bicep and Microsoft Entra ID. Questions show either CLI or PowerShell, so learn to read both. The lessons give both for the common tasks.
Which Azure features are retired, and will the exam test that?
Basic public IPs and Basic Load Balancer (retired 30 September 2025), the Log Analytics agent (August 2024), NSG flow logs (retire 30 September 2027), Azure Disk Encryption (retires 15 September 2028), VM insights Map (30 June 2028) and default outbound access for new VNets. The outline still lists some of them, so the exam may test the old feature or its replacement; know both and prefer the current recommendation.
Do preview features appear?
Microsoft says most questions cover generally available features and that the exam may include preview features if they are commonly used. This course says when a feature is in preview, and teaches GA behaviour first.
How should I split my time between the sections?
By weight: Sections 1 and 3 are 20-25% each, Sections 2 and 4 are 15-20% each, and Section 5 is 10-15%. The 21-day plan gives Sections 1 and 3 the most days. Case studies mix topics, so do not skip a small section entirely.
See where you stand in 8 minutes
Ten questions from this course, weighted like the real exam, with your score by section and a rough chance of passing.