Microsoft AZ-104 vs Microsoft AZ-305: Admin vs Architecture

AZ-104 and AZ-305 both cover core Azure infrastructure, but they measure different responsibility levels. The current Microsoft AZ-104 exam validates Azure administration: implementing, managing, securing, and monitoring identity, governance, storage, compute, virtual networks, and resources. The current AZ-305 exam validates solution design across identity/governance/monitoring, data storage, business continuity, and infrastructure. Microsoft refreshed both English exam outlines on April 17, 2026.

The certification structure reinforces the distinction. Azure Administrator Associate is an intermediate administrator credential. Azure Solutions Architect Expert requires the Azure Administrator Associate certification and the AZ-305 exam, so Microsoft explicitly expects its architects to understand operational Azure administration before expert architecture design.

The overlap is therefore intentional. Administrators need to understand why resources are designed a certain way, while architects need enough administration depth to design things that can actually be deployed, governed, monitored, and recovered.

AZ-104 asks whether you can run the environment

Microsoft describes the Azure administrator role as implementing, managing, and monitoring an organization’s Azure environment. The current skills include identity/governance, storage, compute, virtual networking, and monitoring. Review Azure Administrator responsibilities if you are deciding whether the role fits your day-to-day work.

Hands-on administration means creating and changing resources, troubleshooting failures, configuring access, managing networks, and using Azure Portal, CLI, PowerShell, ARM templates or Bicep, and Microsoft Entra ID.

The questions are operational: can you configure the setting, interpret the state, choose the right administrative action, and keep the environment secure and observable?

That makes practice essential. Portal recognition without command, policy, network, and troubleshooting experience is a weak foundation.

Administration questions often provide a broken or incomplete state and ask for the action that makes it correct. Study with deliberately misconfigured resources so you learn diagnosis, not only creation workflows.

AZ-305 asks whether you can design the environment

AZ-305 begins from business and technical requirements and asks for architecture choices. The current exam weights infrastructure design most heavily at 30–35%, followed by identity/governance/monitoring at 25–30%, data storage at 20–25%, and business continuity at 15–20%. Use Azure infrastructure design concepts to practice translating requirements into compute, networking, integration, migration, and service-selection decisions rather than memorizing product definitions.

Architect questions frequently have several technically possible answers. The correct design usually depends on one constraint: recovery objective, governance scope, operational overhead, latency, security boundary, migration requirement, or cost.

Strong preparation includes explaining why rejected alternatives fail the stated requirement.

Architecture study should begin with requirement extraction. Write down users, trust boundaries, data, latency, continuity, governance, and cost constraints before reading the answer choices. This keeps product familiarity from driving the design.

Administration becomes architecture input

An architect who has never configured Azure can underestimate operational details. A design may assume a network path, identity assignment, backup method, or monitoring feature behaves differently from reality. AZ-104 knowledge reduces that gap. The internal bridge from Azure administration to solutions architecture is useful because many AZ-104 skills become prerequisites for AZ-305 reasoning rather than disappearing after the administrator exam.

For example, an administrator configures VNets, NSGs, routes, storage accounts, identities, VMs, and monitoring. An architect decides how those components should be arranged across subscriptions, regions, trust zones, and recovery plans.

The same resource appears in both exams, but the decision question changes.

Hands-on administrators bring valuable reality to architecture: which changes are disruptive, which controls are hard to operate, where monitoring is weak, and which dependencies create support load. Carry those lessons forward instead of treating AZ-305 as a completely new discipline.

Identity and governance shift from configuration to scope design

AZ-104 candidates manage users, groups, subscriptions, Azure RBAC, policy, and governance settings. They need to apply access and understand how resources are organized and controlled.

AZ-305 asks how identity and governance should be designed for the organization: where policy belongs, how subscriptions and management groups should be structured, how monitoring is centralized, and how access supports security and operational responsibility. The provider-neutral ideas in least privilege and scoped access help connect these levels. Administration applies policy; architecture decides the boundary and inheritance model.

Architects also need to account for exception handling and delegated ownership so centralized governance does not block delivery.

Governance design should include subscription and management-group strategy, policy inheritance, delegated ownership, and logging access. A hierarchy that centralizes everything can slow teams, while no hierarchy makes consistency difficult.

Networking shifts from troubleshooting to topology decisions

AZ-104 expects practical virtual-network administration: subnets, routing, security groups, name resolution, load balancing, and connectivity. Administrators should be able to trace why traffic cannot reach a destination.

AZ-305 uses those same components to design network topology, hybrid connectivity, segmentation, resilience, and integration. Review cloud networking fundamentals and ask how a regional VNet, hub-spoke design, private endpoints, DNS, and hybrid routes fit the organization’s requirements.

An administrator fixes a route; an architect may decide whether the organization should use hub-spoke, Virtual WAN, centralized firewalling, or another pattern.

Operational cost and failure domains become part of the topology decision.

Networking design should include private service connectivity and name resolution, not only VNet peering. Private endpoints, DNS zones, hub routing, firewall paths, and hybrid connectivity form one system and should be designed together.

Storage and data decisions become requirement trade-offs

AZ-104 configures storage accounts, blobs, files, access, redundancy, lifecycle, and related controls. Candidates need to implement secure, usable storage.

AZ-305 asks which data platform and storage architecture meets availability, performance, security, governance, integration, and continuity requirements. The question may involve choosing between relational, nonrelational, object, file, or analytics services.

Architects should know enough administration to understand configuration consequences, but they are assessed on design fit rather than every portal workflow. Use object, block, file, lifecycle, and data protection concepts to keep the storage model clear before provider-specific service selection.

Data architecture should state the access pattern and recovery need before choosing a service. Transactional state, shared files, object data, analytics stores, and caches have different consistency, performance, and governance requirements.

Business continuity is a design domain, not just backup configuration

AZ-104 administrators configure backup, monitor resources, and maintain workloads. They may execute restore procedures and troubleshoot resource health.

AZ-305 dedicates 15–20% to business continuity design. Use RTO, RPO, backups, and multi-region design to reason from impact first. The architect decides what must survive, how quickly it must recover, and which dependency could invalidate the plan.

Multi-region is not automatically correct. Recovery design should match business impact, data consistency, failover complexity, and cost.

Then administrators and operations teams implement and test the chosen recovery controls.

Continuity design should be tested through dependency mapping. A secondary region does not help if identity, DNS, keys, or a third-party integration remains a single point of failure. Architecture must define what happens to the whole service.

Monitoring changes from configuration to observability architecture

AZ-104 candidates configure and interpret Azure Monitor-related capabilities, alerts, logs, and resource health as part of running the environment.

AZ-305 asks how monitoring should be designed across the solution. The general principles in observability—metrics, logs, traces, dashboards, actionable alerts, ownership, and retention—help separate signal design from tool configuration.

Architects need to consider centralization, access, compliance, retention, cross-subscription scope, and how telemetry supports incident response and capacity planning.

An architecture is difficult to operate when its critical dependencies have no measurable health signal.

Monitoring architecture should identify consumers. Operators need actionable alerts; security teams need protected evidence; product teams need service indicators; finance may need usage telemetry. One log workspace or dashboard does not automatically satisfy every audience.

Do not use the architect title as a reason to stop practicing commands and portal workflows. Design reviews are stronger when you can prototype a policy, route, identity assignment, storage configuration, or monitoring path and verify the platform behavior before standardizing it.

A final comparison exercise helps: take one Azure workload, first operate it as an AZ-104 administrator, then redesign it as an AZ-305 architect. Record which questions change from configuration and troubleshooting to requirements, trade-offs, continuity, governance, and topology. The exercise makes the role boundary much clearer than memorizing two lists of objectives.

Use both perspectives deliberately.

Choose AZ-104 or AZ-305 by the decision you own

Choose AZ-104 when your work centers on implementing and operating Azure resources. It is the stronger first target if you need hands-on confidence with identity, compute, storage, networking, governance, and monitoring.

Move toward AZ-305 when you already understand administration and increasingly own requirements, trade-offs, standards, topology, continuity, migration, and solution-level design. Microsoft formalizes this by requiring Azure Administrator Associate for the Solutions Architect Expert credential.

After AZ-104, use the next-step Azure path to decide whether architecture, networking, security, DevOps, or another role fits. After AZ-305, use post-architecture learning to deepen the domain your designs depend on most.

The exams overlap because real architecture depends on operational reality. The cleanest progression is therefore administer first, then design at system scale.

The cleanest readiness signal for AZ-305 is that you can explain an Azure design to an administrator and receive implementation questions you have already considered. That dialogue shows the design is connected to operational reality.