Free study guide · Azure
How to pass the Microsoft Azure Administrator (AZ-104)
What the exam covers, how to plan your study, and how to read its questions. From the CertLumen course for this exam, kept up to date with the official exam guide.
- Questions
- 50
- Time
- 100 minutes
- Passing score
- 700 on a scale of 1-1000
- Exam fee
- Not published on the exam page (priced by country or region); USD 165 is the commonly cited US price
- Valid for
- 1 year; renew free each year with an online assessment on Microsoft Learn (open within 6 months before expiry)
- Delivery
- Proctored by Pearson VUE, online or at a test center
What the exam covers
A study plan that works
The default path for admins who have used the Azure portal and CLI but have not studied for AZ-104. It covers all 24 lessons and the 10 labs in section order, with a drill after each section and a short flashcard set each day. Section 1 (20-25%) and Section 3 (20-25%) get the most days; Section 5 (10-15%) gets three. Mock Exam 1 on day 20 measures readiness; day 21 fixes the weakest sections and ends with Mock Exam 2. Sit the exam a few days later, and use Mock Exams 3 and 4 as retests in that last week. Plan on about 1.5–2.5 hours a day.
| Day | Focus | Time |
|---|---|---|
| 1 | Kick-off: the exam, then users, groups and licenses in Microsoft Entra ID | 90 min |
| 2 | External users, SSPR and Azure RBAC | 100 min |
| 3 | Azure Policy, locks and tags, then the b1 governance lab | 115 min |
| 4 | Resource groups, subscriptions, costs and management groups, then the b1 drill | 125 min |
| 5 | Secure access to storage, then accounts, redundancy and encryption | 100 min |
| 6 | Azure Files, snapshots and copy tools, then blob tiers, lifecycle and versioning | 100 min |
| 7 | Storage lab and the b2 drill | 100 min |
| 8 | Reading, modifying, deploying and exporting ARM templates and Bicep | 90 min |
| 9 | Virtual machines, then availability zones, sets and scale sets | 110 min |
| 10 | Lab: templates, a VM with encryption and a scale set, then containers | 150 min |
| 11 | App Service plans, scaling and networking, then domains, certificates, backups and slots | 115 min |
| 12 | Lab: containers and App Service, then the b3 drill | 150 min |
| 13 | Virtual networks, subnets, peering and public IP addresses | 70 min |
| 14 | Routes, NSGs and troubleshooting, then Bastion, service endpoints and private endpoints | 105 min |
| 15 | Azure DNS and Load Balancer, then the first networking lab | 100 min |
| 16 | Lab: Standard load balancer and a private endpoint, then the b4 drill | 105 min |
| 17 | Azure Monitor metrics, logs and KQL, then alerts, Insights and Network Watcher | 95 min |
| 18 | Azure Backup, then Site Recovery | 105 min |
| 19 | Monitor and backup labs, then the b5 drill | 150 min |
| 20 | Mock Exam 1 | 150 min |
| 21 | Weak-area remediation and Mock Exam 2 | 180 min |
Exam strategy
How the exam works
Exam AZ-104: Microsoft Azure Administrator leads to the Microsoft Certified: Azure Administrator Associate certification. It tests whether you can implement, manage and monitor an Azure environment: identities and governance, storage, compute, virtual networking, and monitoring and backup. Nearly every item is a short scenario with a constraint (least privilege, lowest cost, no public endpoint, no downtime, no account key) and you pick the setting, command or feature that meets it. You are expected to read Azure CLI, Azure PowerShell, ARM and Bicep snippets and to know where things live in the portal.
| Fact | Detail (study guide, certification page and Microsoft exam-policy pages, checked November 2026) |
|---|---|
| Skills measured | The list as of October 26, 2023. The study guide shows no later version, and its change log lists only minor wording changes from the earlier list. This course follows it |
| Questions | Microsoft does not publish the number for AZ-104. Most Microsoft certification exams have 40 to 60. This course's mock exams use 50 |
| Time | 100 minutes of exam time, and about 120 minutes of seat time for check-in, instructions and feedback. Exams that include labs get 120 minutes, and Microsoft does not list which exams have them. The certification page says AZ-104 "may have interactive components" |
| Question types | Multiple choice, multiple response, drag and drop, hot area, build list, active screen, case studies and interactive components. Some items are yes/no sets that present a problem and a solution. Try them in the free exam sandbox first |
| Delivery | Pearson VUE, online (proctored at home or in an office) or at a test center. You can mix online and test-center delivery across exams |
| Passing score | 700 on a scale of 1 to 1,000. It is a scaled score, not 70% correct |
| Scoring | Multi-part items give one point for each correct part, with partial credit. No penalty for guessing. Some items are unscored, and you cannot tell which |
| Aids | No notes or personal materials. You may open Microsoft Learn in a side panel during the exam (see below), and online you may take notes only on the on-screen whiteboard |
| Languages | English, Chinese (Simplified), Korean, Japanese, French, Spanish, German, Portuguese (Brazil), Chinese (Traditional), Italian |
| Fee | Priced by country or region; the exam page does not show a figure. USD 165 is the commonly cited US price |
| Prerequisites | None. Microsoft recommends experience with PowerShell, the Azure CLI, the portal, ARM templates or Bicep, and Microsoft Entra ID |
| Validity and renewal | 1 year. You renew for free with an unproctored, open-book online assessment on Microsoft Learn during the six months before expiry; passing extends the certification by a year |
| Retakes | Wait 24 hours after the first attempt and 14 days between later attempts, up to five attempts in 12 months |
Microsoft updates English exams first and publishes two skills lists around each change. Open the study guide, confirm the "skills measured as of" date is still October 26, 2023, and read its change log. If a newer list has appeared, compare it with the objectives on this course's lessons.
Section weights: where the points are
Microsoft publishes percentage ranges, not question counts. The counts below are this course's estimates for a 50-question form (they are also how the mock exams are built); real forms vary, and case studies mix sections.
| Section | Published range | ≈ Questions (of 50) | Highest-yield topics |
|---|---|---|---|
| b1 Manage Azure identities and governance | 20-25% | 12 | RBAC role and scope choice, role assignment interpretation, Policy effects vs locks vs RBAC, tags and inheritance, budgets vs Advisor, management groups, dynamic groups, licensing, guest access, SSPR |
| b2 Implement and manage storage | 15-20% | 10 | Storage firewall and service endpoints, SAS types and stored access policies, redundancy choice, object replication and CMK prerequisites, Azure Files identity, tiers, lifecycle, versioning, soft delete |
| b3 Deploy and manage Azure compute resources | 20-25% | 12 | ARM/Bicep reading and deployment modes, export vs deployment history, VM disks, sizes, moves and encryption, zones vs sets, scale sets and autoscale, ACI vs Container Apps, App Service plans, slots, domains, certificates |
| b4 Implement and manage virtual networking | 15-20% | 9 | Subnet sizing, peering and gateway transit, routes, NSG priority and effective rules, Bastion SKUs, service vs private endpoints and DNS, alias records, load balancer probes and troubleshooting |
| b5 Monitor and maintain Azure resources | 10-15% | 7 | Metrics vs logs, diagnostic settings, KQL, alert types and processing rules, Network Watcher tools, vault types, backup policies, restore options, Site Recovery failover |
Sections 1 and 3 together are 40-50% of the questions, and Section 4 is as large as Section 2. If your time is short, finish b1 and b3 first, then b4 and b2, and keep b5 for the last week: it is the smallest section and its topics (alerts, vaults, failover) are the most compact to revise.
Microsoft Learn during the exam
On associate and expert exams such as AZ-104 you can open Microsoft Learn from the left navigation pane. It opens in a split screen beside the question, and you can expand it to full screen. You can reach everything on learn.microsoft.com except Microsoft Q&A, Practice Assessments and your profile; other domains are blocked. No extra time is added and the timer keeps running. Microsoft states it is meant for questions where you may need to look something up, and that using it for every question means you will not finish.
| Use Learn for | Do not use Learn for |
|---|---|
An exact CLI or PowerShell parameter name you half remember (for example the az network bastion options) | Concepts you have never studied: reading a page takes minutes you do not have |
| A limit or default you are unsure about (for example how many stored access policies fit on a container) | Questions you can answer in 60 seconds by elimination |
| A table you know exists (Bastion SKU features, App Service tier limits) when two options look equal | Looking for the "answer"; case-study scenarios do not appear in the docs |
Press Ctrl+F (Command+F on a Mac) inside the Learn panel to find text on the current page. Open one Learn page in the exam sandbox so you know where the button is. Budget at most two or three lookups of about a minute each in the whole exam.
Pacing
| Checkpoint | Target |
|---|---|
| Overall | About 2 minutes per question on a 50-question form; the 100 minutes already include the five minutes Microsoft built in for breaks |
| First pass | Answer everything you can in 60-90 seconds, flag the rest, and finish the first pass with at least 20 minutes left |
| Case studies | Read the requirements and the existing environment once, then go straight to the questions. Do not memorise the exhibit; look back at it for each question |
| Second pass | Return to flagged items. If you still cannot decide, pick the option that follows least privilege and least administrative effort and move on. There is no penalty for a wrong answer |
| Last 5 minutes | Make sure no item is blank, including multiple-response items where you may need two or three selections |
You can take an unscheduled break at any time except in the middle of a lab or inside a problem-solution question set. Five minutes are built into the exam time, but the clock keeps running while you are away, and after a break you cannot return to any question you saw before it, even if it was unanswered or marked for review. Answer and review first, then break.
How to read a question
- Read the last sentence first. It states the task: "Which command...", "What should you configure...", "Choose two". Count how many answers are required.
- Underline the constraints. Words such as *minimum administrative effort*, *least privilege*, *without downtime*, *no public IP*, *without using account keys*, *at no additional cost* decide between two correct-looking options.
- Find the scope and the plane. Management plane or data plane? Subscription, resource group or resource? Control plane (ARM) or data plane (blob requests)? Many wrong options are right features at the wrong scope.
- Check the product state. Is the option a retired or deprecated feature (Basic SKU, NSG flow logs, the Log Analytics agent, Azure Disk Encryption for new VMs)? The newest recommended option usually wins.
- Eliminate by one fact. Each distractor is usually wrong for one reason you can state: wrong tier, wrong region, wrong direction, wrong plane. Name that reason before you choose.
When the stem ends with "(Choose two.)" or "(Choose three.)", judge each option as true or false for the stated scenario before you compare options. Microsoft gives one point for each correct part of a multi-part item, so a half-right answer still scores, and a blank scores nothing.
Traps that recur on AZ-104
| Trap | What the exam wants you to remember |
|---|---|
| Policy vs RBAC vs lock | Policy controls what resources may look like (even for Owners). RBAC controls who can act. A lock blocks delete or change for everyone, including Owners, but only on the control plane |
| Management plane vs data plane | Owner or Contributor on a storage account does not read blobs with Entra ID. You need a data role such as Storage Blob Data Reader, or a key or SAS |
| Moving is not relocating | Moving a resource to another resource group or subscription changes its resource ID, not its region. Another region means Azure Resource Mover or a redeploy |
| Rules that do nothing | Storage firewall rules are ignored while the default action is Allow; a service endpoint without a VNet rule on the PaaS firewall changes only the source address; a private endpoint without the private DNS zone still resolves to the public IP |
| Deny does not clean up | A Deny policy does not change existing resources. Only Modify or DeployIfNotExists plus a remediation task fixes them |
| Budgets only notify | A budget never stops spending. To act, attach an action group that runs automation |
| Stored access policies | Only a service SAS can use one. Revoking an account SAS means regenerating the key that signed it |
| Durability vs availability | GRS has more nines than ZRS but a plain GRS secondary is not readable and does not protect against a zone outage better. Zone plus region needs GZRS; reads during an outage need an RA- option |
| Archive tier | Works only with LRS, GRS and RA-GRS accounts, cannot be the default tier, and lifecycle rules cannot rehydrate it |
| Zone or set, not both | A VM is in an availability zone or an availability set. Scale set orchestration mode and a VM's zone cannot be edited in place |
| Complete mode deletes | Complete mode removes resources that are not in the template. Run what-if first; deployment stacks are the newer way to manage deletions |
| Peering is not transitive | A peered to B and B peered to C does not connect A to C. Gateway transit goes on the hub link and Use remote gateways on the spoke link |
| NSG evaluation | Lowest priority number wins and evaluation stops at the first match. Inbound: subnet NSG then NIC NSG. Outbound: NIC NSG then subnet NSG. Both must allow |
| Standard is closed by default | Standard public IPs and Standard load balancers refuse inbound traffic until an NSG allows it. A custom deny can also block the AzureLoadBalancer probe |
| Retired features | Basic public IP and Basic Load Balancer (30 September 2025), the Log Analytics agent (August 2024), NSG flow logs (retire 30 September 2027), Azure Disk Encryption (retires 15 September 2028), VM insights Map (30 June 2028), default outbound access for new VNets |
| Which vault | Recovery Services vault for VMs, SQL/SAP HANA in VMs, Azure Files, MARS, MABS and Site Recovery. Backup vault for disks, blobs and PostgreSQL. The vault must be in the same region as the source (except a Site Recovery vault, which must be outside the source region) |
Retired and recommended features to know in November 2026
The exam outline still uses some older names, and Microsoft retires features faster than it rewrites outlines. Questions are checked against current documentation, so learn both what the outline says and what Microsoft now recommends.
| Area | Outline or older answer | Current recommendation |
|---|---|---|
| VM disk encryption | Azure Disk Encryption (BitLocker, DM-Crypt, Key Vault) | Encryption at host for new VMs; ADE retires 15 September 2028. Learn ADE for the exam and know the migration |
| Public IP and load balancer SKUs | Basic SKU | Standard SKU only; Basic was retired on 30 September 2025 |
| Internet access for VMs | Implicit default outbound access | A NAT gateway (recommended), Standard public IP or load balancer outbound rules; new VNets from API versions after 31 March 2026 use private subnets |
| Flow logs | NSG flow logs | Virtual network flow logs with traffic analytics; NSG flow logs retire 30 September 2027 |
| Guest VM monitoring | Log Analytics agent (MMA/OMS), diagnostics extension | Azure Monitor Agent with data collection rules |
| Scale set mode | Uniform orchestration, availability sets | Flexible orchestration is the recommended mode for new designs |
| Blob tiers | Hot, Cool, Archive | Cold tier exists; smart tier (zone-redundant accounts) can manage Hot, Cool and Cold automatically |
| Template deletion management | Complete deployment mode | Deployment stacks |
The study loop
Words that point to the answer
Phrases in a question that usually point to one answer. The course has the full list.
| When the question says | Think of |
|---|---|
| Partner staff with their own corporate accounts need access to one resource group; you do not want to manage passwords | Invite them as B2B guest users, put them in a security group and assign an Azure role to the group on that resource group |
| Group membership must follow the user's department attribute automatically | A dynamic user security group (needs Microsoft Entra ID P1) |
| New user cannot be assigned a license; the portal says the user has no location | Set the user's usage location, then assign or Reprocess |
| Users reset forgotten passwords without the help desk; pilot with 50 users | Self-service password reset set to Selected with a pilot group |
| Start, restart and monitor VMs in one resource group, nothing else | Virtual Machine Contributor assigned to a group on that resource group |
| Let team leads assign only Reader and Storage Blob Data Reader | Role Based Access Control Administrator with a role assignment condition (ABAC) |
| Nobody, including Owners, may create resources outside West Europe and North Europe | Azure Policy with the Allowed locations definition and the Deny effect |
| Protect a resource group from deletion but let admins add and change resources | A CanNotDelete lock (Delete in the portal) |
| Hundreds of existing resources lack a required tag and must be fixed automatically | A Modify policy (such as Inherit a tag from the resource group) with a remediation task |
| Email finance at 80% of the monthly spend; VMs must stop at 100% | A budget with thresholds, and an action group that runs a runbook or Logic App for the shutdown |
Revise from the cheat sheet
The course's cheat sheet has a page for each of these:
- Identities and governance: roles, scopes, Policy, locks, tags and cost
- Storage: access, redundancy, Azure Files and blob features
- Compute: templates, VMs, containers and App Service
- Networking: VNets, routing, NSGs, endpoints, DNS and load balancing
- Monitoring and backup: Azure Monitor, alerts, vaults and Site Recovery
Practise with the real exam's mix
337 exam-style questions, 4 timed practice exams, flashcards and an AI tutor.