Azure Administrator Associate in 2026: What AZ-104 Tests

AZ-104 remains the current exam for the Azure Administrator Associate certification in 2026. The role is practical and operational: implement, manage, and monitor an Azure environment across identity, governance, storage, compute, networking, backup, and monitoring. Candidates are expected to know the Azure portal, PowerShell, Azure CLI, Azure Resource Manager or Bicep, and Microsoft Entra ID well enough to make configuration decisions rather than simply recognize product names.

Microsoft’s current blueprint organizes AZ-104 into five major areas: identities and governance, storage, compute, virtual networking, and monitoring and maintenance. The exact percentages can change when Microsoft updates the exam, but the operational relationship between those domains is more important than the weighting. A virtual machine needs identity, disks, networking, monitoring, backup, and governance at the same time.

The original version of this article treated certification value, exam format, and individual services as separate topics. A better preparation model is to follow the lifecycle of Azure resources. Decide how resources are organized, who can access them, how they connect, how they are deployed, how they are protected, and how an administrator knows when something is wrong.

Identity and governance define who can do what, and where

Azure administration begins with scope. Management groups can organize subscriptions, subscriptions contain resource groups and resources, and role assignments can be applied at different points in that hierarchy. Microsoft Entra users, groups, service principals, and managed identities then interact with Azure resources through authorization decisions such as Azure role-based access control.

Candidates need to understand inheritance because an assignment at a higher scope can affect many resources below it. They also need to separate authentication from authorization. A user can successfully sign in and still be unable to modify a resource because the required role is missing. Conversely, broad role assignments can create unnecessary privilege even when authentication is strong.

Azure Policy serves a different purpose from RBAC. RBAC controls allowed actions for identities; Policy evaluates and enforces resource conditions. Locks provide another distinct control by protecting resources from deletion or modification. Tags organize metadata but do not create security boundaries. Keeping these tools conceptually separate prevents many scenario mistakes.

The relationship between Microsoft Entra ID and Azure governance is worth practicing through real scopes and role assignments rather than through definition matching.

Storage decisions combine access, durability, lifecycle, and network controls

AZ-104 expects administrators to manage storage accounts, Azure Blob Storage, Azure Files, redundancy, access controls, encryption, lifecycle rules, and data-movement tools. The services are easier to understand when each decision is tied to a workload.

Redundancy determines how copies are maintained and which failure domains the storage design can tolerate. Access can involve keys, shared access signatures, identity-based authorization, and network restrictions. A SAS should be scoped as narrowly as practical in permissions, resource, and time. Identity-based access is often preferable for managed users and applications because it avoids distributing long-lived account keys.

Network configuration matters as much as credentials. Storage firewalls, service endpoints, and private endpoints affect whether a client can reach the service at all. A technically valid token does not help if the network path is blocked. Conversely, a private path does not replace authorization.

Lifecycle management can reduce cost by moving blobs between access tiers or deleting data according to policy, but those rules should follow retention and retrieval requirements. An administrator needs to understand the operational consequences before turning storage optimization into automation.

Compute administration is about lifecycle, scale, and repeatability

Virtual machines remain a core AZ-104 topic, including sizing, disks, availability, moves, extensions, and scale sets. The exam also covers Azure App Service and container services at an administrator level. Rather than treating each service as a separate chapter, compare how much infrastructure responsibility the organization wants to retain.

A VM gives administrators operating-system control but also creates patching, configuration, security, backup, and monitoring responsibility. App Service abstracts more of the underlying platform for web applications. Azure Container Instances and Azure Container Apps support containerized workloads with different operational models. The choice should follow application requirements, not the assumption that one service is universally “more cloud-native.”

Repeatable deployment matters. ARM templates and Bicep allow infrastructure to be described declaratively so that environments can be reproduced and changes reviewed. A candidate should be able to read an existing template, understand parameters and resource dependencies, and reason about what a deployment will create or modify.

The practical side of Azure compute administration becomes clearer when you deploy the same workload more than once and deliberately test scaling, availability, disk, and networking changes.

Virtual networking is often where isolated facts become architecture

AZ-104 candidates need to be comfortable with virtual networks, subnets, public IP addresses, peering, user-defined routes, network security groups, application security groups, private endpoints, service endpoints, Azure Bastion, DNS, load balancing, and troubleshooting. Memorizing the definition of each feature is not enough because scenario questions often combine several of them.

Start every network problem with the path. Identify the source, destination, IP addresses, DNS resolution, routing decision, security rules, and any load-balancing or private-access layer in between. If a VM cannot reach a storage account through a private endpoint, for example, the problem may involve private DNS rather than the storage credential itself.

NSGs filter traffic based on rules, but they do not create routes. User-defined routes influence traffic direction but do not grant identity permissions. Peering connects virtual networks, but transitivity should not be assumed. Public and private load balancers serve different exposure requirements. Keeping these responsibilities separate helps administrators troubleshoot instead of changing multiple controls at once.

Hands-on work with AZ-104 virtual networking should include deliberately broken DNS, NSG, route, and peering configurations so you learn their failure signatures.

Monitoring should answer operational questions, not just collect telemetry

Azure Monitor brings together metrics, logs, alerts, action groups, insights, and related monitoring capabilities. The important administrative skill is deciding what signal matters and what action follows it. Collecting every possible log without a purpose can increase cost while still leaving operators unsure how to respond.

Metrics are well suited to numeric time-series signals such as CPU usage or request counts. Logs provide richer records that can be queried and correlated. Diagnostic settings determine where supported resource logs and metrics are sent. Log Analytics workspaces support analysis with Kusto Query Language, while alerts can evaluate conditions and trigger action groups.

Monitoring design should include ownership. Who receives an alert? What severity is it? Is the condition actionable? Does the response require a runbook, manual investigation, scaling action, or escalation? Repeated alerts that no one acts on become noise and train teams to ignore the system.

Network Watcher and Connection Monitor add network-specific visibility. Resource health and platform signals help distinguish an application problem from an Azure service issue. Effective administrators combine these sources before making changes.

Backup and recovery are judged by restorability, not by job success

Azure Backup and Site Recovery address different parts of business continuity. Backup protects recoverable copies of data and workloads. Site Recovery can replicate supported workloads for failover to another location. Neither should be treated as complete until the organization has tested recovery.

A green backup job proves that data was written according to a policy. It does not prove that the correct files, VM, or application state can be restored within the required time. Administrators should understand vaults, policies, retention, restore operations, soft-delete protections where applicable, and the difference between recovery point and recovery time objectives.

Disaster-recovery planning must also account for dependencies such as identity, networking, DNS, applications, and data services. A failed-over VM is not a recovered business service if users cannot authenticate or reach it.

This operational mindset also helps on the exam: identify the failure scope first, then decide whether the requirement is restore, high availability, regional recovery, or simple configuration remediation.

Hands-on troubleshooting is more valuable than memorizing portal sequences

The Azure portal changes regularly, and Microsoft can update service interfaces faster than exam-preparation material. Durable competence comes from understanding the resource model and being able to use more than one management surface. If you create a resource in the portal, inspect it through Azure CLI or PowerShell. If you deploy with Bicep, read the resulting resource properties in the portal. The concepts should survive the interface.

Build failure into practice. Remove a role assignment. Block a subnet. Break DNS. Change a storage firewall. Stop a VM. Expire a SAS. Misconfigure an alert query. Then diagnose the problem from evidence before reversing the change. This turns documentation knowledge into administrative judgment.

Reviewing common AZ-104 preparation mistakes can help identify where passive learning, weak networking fundamentals, or insufficient hands-on work is limiting progress.

AZ-104 is a foundation for broader Azure responsibility

The Azure Administrator Associate role is valuable because it sits close to the operational center of Azure. Identity, governance, compute, storage, networking, monitoring, and recovery are dependencies for security engineering, architecture, DevOps, database services, application platforms, and many other Azure roles.

That does not mean every administrator should immediately chase another credential. The better next step depends on the work. Someone designing larger environments may deepen architecture skills. A networking-heavy role may specialize in connectivity. A security role may go deeper into identity and cloud protection. The skills that follow AZ-104 should build on real operational experience rather than simply continue a sequence of exam codes.

The strongest AZ-104 preparation therefore looks like administration, not trivia review. Organize resources, apply access at correct scopes, deploy repeatably, secure storage, trace network paths, monitor meaningful signals, perform restores, and troubleshoot failures methodically. Those activities align with the current blueprint and remain useful long after individual portal screens or product details change.