AZ-104 is the Microsoft Azure Administrator exam associated with Microsoft Certified: Azure Administrator Associate. It assesses implementation, management, and monitoring of Azure resources—including identity, governance, storage, compute, networking, and maintenance—not whether a candidate can remember where every portal menu lives.

This exam fact sheet separates the administrator role, measured skill areas, and scheduling rules. The percentages below describe an objective blueprint, not a guaranteed number of questions. Candidates should use Microsoft’s published guidance when deciding which version and requirements apply to their appointment.

The credential and administrator role

According to the Microsoft Azure Administrator Associate certification page, the credential is at an intermediate level and belongs to the administrator role. It calls for subject-matter expertise in running an organization’s Azure environment and collaborating with specialists responsible for networking, application development, databases, security, and DevOps. That is an operational responsibility, rather than a claim of mastery of every Azure architecture or programming discipline.

The current Microsoft audience profile expects a foundation in operating systems, servers, networking, and virtualization. It also names PowerShell, Azure CLI, Azure portal, Azure Resource Manager templates or Bicep, and Microsoft Entra ID as relevant experience. These are readiness expectations, not a made-up mandatory training course. An administrator who already runs virtual machines still needs practice with Azure RBAC scope and cloud networking; a web developer may need more familiarity with backup policy and subscription governance.

AZ-104 is also not interchangeable with AZ-900 fundamentals or AZ-305 solutions architecture. AZ-104 asks for operations and configuration across five domains. An architecture-focused candidate should compare role responsibilities rather than treating all Microsoft certifications as the same knowledge path; the AZ-104 and AZ-305 differences guide owns that deeper career comparison.

Official exam objectives and their weights

Microsoft’s current AZ-104 study guide specifies skills measured as of April 17, 2026. It organizes the role into five areas, shown with weighting ranges. Those ranges describe relative coverage; they do not promise a fixed question count or that every subtopic will appear on a given form.

Notice the distinction between the domains and the actual job. Administrators do not encounter one isolated storage question in production and then put storage away while operating compute. An application may need a managed identity to read data, a private network path to reach it, an alert to catch failure, and a restore path to recover data. The exam divides these competencies for measurement; real work reconnects them.

How to read the subject coverage

The sections below translate the Microsoft domains into operational decisions: assigning access, securing data, deploying workloads, tracing network paths, and proving service health. The Microsoft AZ-104 learning center organizes related exercises by domain; the purpose here is to understand what each domain measures before deciding where more practice is needed. These summaries do not replace the detailed official checklist.

Identity and governance define who can do what, and where

Azure administration begins with scope. Management groups can organize subscriptions, subscriptions contain resource groups and resources, and role assignments can be applied at different points in that hierarchy. Microsoft Entra users, groups, service principals, and managed identities then interact with Azure resources through authorization decisions such as Azure role-based access control.

Candidates need to understand inheritance because an assignment at a higher scope can affect many resources below it. They also need to separate authentication from authorization. A user can successfully sign in and still be unable to modify a resource because the required role is missing. Conversely, broad role assignments can create unnecessary privilege even when authentication is strong.

Azure Policy serves a different purpose from RBAC. RBAC controls allowed actions for identities; Policy evaluates and enforces resource conditions. Locks provide another distinct control by protecting resources from deletion or modification. Tags organize metadata but do not create security boundaries. Keeping these tools conceptually separate prevents many scenario mistakes. The relationship between Microsoft Entra ID and Azure governance is worth practicing through real scopes and role assignments rather than through definition matching.

Storage decisions combine access, durability, lifecycle, and network controls

AZ-104 expects administrators to manage storage accounts, Azure Blob Storage, Azure Files, redundancy, access controls, encryption, lifecycle rules, and data-movement tools. The services are easier to understand when each decision is tied to a workload.

Redundancy determines how copies are maintained and which failure domains the storage design can tolerate. Access can involve keys, shared access signatures, identity-based authorization, and network restrictions. A SAS should be scoped as narrowly as practical in permissions, resource, and time. Identity-based access is often preferable for managed users and applications because it avoids distributing long-lived account keys.

Network configuration matters as much as credentials. Storage firewalls, service endpoints, and private endpoints affect whether a client can reach the service at all. A technically valid token does not help if the network path is blocked. Conversely, a private path does not replace authorization.

Lifecycle management can reduce cost by moving blobs between access tiers or deleting data according to policy, but those rules should follow retention and retrieval requirements. An administrator needs to understand the operational consequences before turning storage optimization into automation.

Compute administration is about lifecycle, scale, and repeatability

Virtual machines remain a core AZ-104 topic, including sizing, disks, availability, moves, extensions, and scale sets. The exam also covers Azure App Service and container services at an administrator level. Rather than treating each service as a separate chapter, compare how much infrastructure responsibility the organization wants to retain.

A VM gives administrators operating-system control but also creates patching, configuration, security, backup, and monitoring responsibility. App Service abstracts more of the underlying platform for web applications. Azure Container Instances and Azure Container Apps support containerized workloads with different operational models. The choice should follow application requirements, not the assumption that one service is universally “more cloud-native.”

Repeatable deployment matters. ARM templates and Bicep allow infrastructure to be described declaratively so that environments can be reproduced and changes reviewed. A candidate should be able to read an existing template, understand parameters and resource dependencies, and reason about what a deployment will create or modify.

Rehearse a compute deployment twice, then deliberately test a change in VM size, disk configuration, networking, or availability. Azure compute administration is easier to assess when a candidate can explain which part of the workload should change and how to verify the result.

Virtual networking is often where isolated facts become architecture

AZ-104 candidates need to be comfortable with virtual networks, subnets, public IP addresses, peering, user-defined routes, network security groups, application security groups, private endpoints, service endpoints, Azure Bastion, DNS, load balancing, and troubleshooting. Memorizing the definition of each feature is not enough because scenario questions often combine several of them.

Start every network problem with the path. Identify the source, destination, IP addresses, DNS resolution, routing decision, security rules, and any load-balancing or private-access layer in between. If a VM cannot reach a storage account through a private endpoint, for example, the problem may involve private DNS rather than the storage credential itself.

NSGs filter traffic based on rules, but they do not create routes. User-defined routes influence traffic direction but do not grant identity permissions. Peering connects virtual networks, but transitivity should not be assumed. Public and private load balancers serve different exposure requirements. Keeping these responsibilities separate helps administrators troubleshoot instead of changing multiple controls at once. Hands-on work with AZ-104 virtual networking should include deliberately broken DNS, NSG, route, and peering configurations so you learn their failure signatures.

Monitoring should answer operational questions, not just collect telemetry

Azure Monitor brings together metrics, logs, alerts, action groups, insights, and related monitoring capabilities. The important administrative skill is deciding what signal matters and what action follows it. Collecting every possible log without a purpose can increase cost while still leaving operators unsure how to respond.

Metrics are well suited to numeric time-series signals such as CPU usage or request counts. Logs provide richer records that can be queried and correlated. Diagnostic settings determine where supported resource logs and metrics are sent. Log Analytics workspaces support analysis with Kusto Query Language, while alerts can evaluate conditions and trigger action groups.

Monitoring design should include ownership. Who receives an alert? What severity is it? Is the condition actionable? Does the response require a runbook, manual investigation, scaling action, or escalation? Repeated alerts that no one acts on become noise and train teams to ignore the system.

Network Watcher and Connection Monitor add network-specific visibility. Resource health and platform signals help distinguish an application problem from an Azure service issue. Effective administrators combine these sources before making changes.

Backup and recovery are judged by restorability, not by job success

Azure Backup and Site Recovery address different parts of business continuity. Backup protects recoverable copies of data and workloads. Site Recovery can replicate supported workloads for failover to another location. Neither should be treated as complete until the organization has tested recovery.

A green backup job proves that data was written according to a policy. It does not prove that the correct files, VM, or application state can be restored within the required time. Administrators should understand vaults, policies, retention, restore operations, soft-delete protections where applicable, and the difference between recovery point and recovery time objectives.

Disaster-recovery planning must also account for dependencies such as identity, networking, DNS, applications, and data services. A failed-over VM is not a recovered business service if users cannot authenticate or reach it.

This operational mindset also helps on the exam: identify the failure scope first, then decide whether the requirement is restore, high availability, regional recovery, or simple configuration remediation.

Exam format and scheduling: verify the live rules

Before you book, use Microsoft’s current certification page and scheduling workflow to confirm available languages, fee in the country or region of delivery, identification and testing rules, accessibility arrangements, and appointment requirements. Do not rely on a universally fixed price, duration, or number of questions published by an unofficial article. Microsoft provides official training paths, a practice assessment, and an exam sandbox so candidates can examine the interaction style.

Use exam-style questions to diagnose misunderstandings, not as evidence that a particular live exam form will contain those questions. Additional Microsoft AZ-104 preparation resources can supplement domain labs, but the published Microsoft objectives remain the source for current coverage. After a wrong response, identify which layer of the Azure scenario you misread and reproduce that condition safely.

What certification renewal means

Microsoft associate, expert, and specialty certifications expire after a year, and Microsoft offers qualifying holders free online renewal assessments during the eligible period. The renewal assessment is a separate step from earning the initial AZ-104 credential. Check the current Microsoft renewal guidance for its six-month eligibility window and the profile-based workflow. Because cloud services evolve, retaining the credential means keeping the underlying operating skills current as well.

The certification is best treated as a signal that you can run and troubleshoot Azure infrastructure, not a promise of a particular salary or promotion. Its practical value depends on the quality of your evidence: correct access at the right scope, dependable deployment, safe network behavior, useful monitoring, and restorable data. When you know what the exam officially expects, move to the domain you cannot yet demonstrate rather than reading another generic Azure overview. The AZ-104 readiness matrix provides a distinct, self-assessed skills diagnostic.