AZ-104 Exam Guide 2026: Labs, Plan & Scenarios

AZ-104 Azure Administrator exam guide 2026 — skills measured, study plan, Azure CLI labs, Cloud Soft Solutions

AZ-104 (Microsoft Azure Administrator) is the Azure certification that Indian recruiters ask about most for cloud administrator, cloud support, cloud operations and junior DevOps roles. Unlike AZ-900, it checks whether you can actually *do* things. Expect scenario questions on Entra ID, RBAC, storage, VMs, networking and backup, and possibly interactive components. This guide follows Microsoft's current study guide. It covers every skill area with what to practise, gives you a 6-week plan, 15 labs with Azure CLI commands and 20 scenario questions written for this guide.

Quick facts (from Microsoft Learn, November 2026)

Item	Detail
Exam	AZ-104: Microsoft Azure Administrator
Certification	Microsoft Certified: Azure Administrator Associate
Exam time	100 minutes
Passing score	700 (scale 1–1000)
Format	Proctored; may include interactive components
Retake	24 hours after the first attempt; longer waits after that
Renewal	Every 12 months, by a free online assessment on Microsoft Learn
Price	Set by the country where you take it; check before booking

Microsoft recommends booking with a personal Microsoft account, not a college or work account. If you book with a work or college account, your certification records can be lost when you leave that organisation. Always check the official AZ-104 study guide before booking.

Who should take AZ-104?

Freshers who have finished AZ-900 or have equivalent basics and want an Azure job.
System administrators moving from Windows Server, VMware or Citrix to Azure.
Support engineers who want to move into cloud operations.
DevOps learners. AZ-104 is the usual first step towards AZ-400 (Azure DevOps Engineer Expert).

Microsoft expects you to be comfortable with operating systems, networking, servers and virtualization, and to have used PowerShell, Azure CLI, the portal, ARM templates or Bicep, and Entra ID. If Linux and networking basics are weak, fix those first. These Linux interview questions are a quick check.

Skills measured and weights

Skill area	Weight
Manage Azure identities and governance	20–25%
Implement and manage storage	15–20%
Deploy and manage Azure compute resources	20–25%
Implement and manage virtual networking	15–20%
Monitor and maintain Azure resources	10–15%

1. Identities and governance (20–25%)

Microsoft Entra users and groups. Create users and groups, manage their properties and licences, invite external (B2B) users, and configure self-service password reset (SSPR). Know the difference between assigned groups and dynamic groups (dynamic groups need Entra ID P1).

Access to resources. Know the built-in roles (Owner, Contributor, Reader, User Access Administrator) and the specialised ones, such as Virtual Machine Contributor and Storage Blob Data Reader. You'll assign roles at management group, subscription, resource group and resource scope, and work out someone's effective access from several assignments. Two traps:

RBAC permissions are additive. A deny assignment is a different thing.
"Contributor" can manage resources but cannot grant access to anyone else.

Subscriptions and governance.

Azure Policy: definitions, initiatives, assignment, effects (Deny, Audit, Append, Modify, DeployIfNotExists) and remediation.
Resource locks: CanNotDelete and ReadOnly.
Tags: apply them, and know that by default they are not inherited from resource groups. Use Policy to inherit them.
Resource groups, subscriptions and management groups.
Cost management: budgets, alerts and Azure Advisor.

2. Storage (15–20%)

Access to storage.

Storage firewalls and virtual network rules.
SAS tokens: account SAS, service SAS and user delegation SAS (signed with Entra credentials, so it's the most secure).
Stored access policies: they let you revoke a service SAS without rotating the keys.
Access key rotation.
Identity-based access for Azure Files: Entra Domain Services, on-premises AD DS, or Entra Kerberos.

Storage accounts.

Create and configure accounts.
Redundancy options: LRS, ZRS, GRS, GZRS and the read-access versions.
Object replication: asynchronous copying of blobs between accounts.
Encryption: Microsoft-managed keys or customer-managed keys in Key Vault.
Moving data with Storage Explorer and AzCopy.

Azure Files and Blob Storage.

File shares and blob containers.
Access tiers: Hot, Cool, Cold, Archive.
Snapshots and soft delete for Azure Files.
Lifecycle management rules, for example "move blobs to Cool after 30 days, delete after 365".
Blob versioning.

3. Compute (20–25%)

ARM templates and Bicep. Read and change templates, deploy them, export a deployment and convert ARM to Bicep. Know the structure of both:

ARM template: parameters, variables, resources, outputs.
Bicep: param, var, resource, output.

Virtual machines.

Create VMs and change their size (resizing can require a restart).
Manage disks and add data disks.
Azure Disk Encryption.
Move VMs across resource groups, subscriptions or regions. Moving across regions uses Azure Resource Mover or Site Recovery.
Availability sets (fault and update domains) vs availability zones.
Virtual Machine Scale Sets and autoscale rules.

Containers.

Azure Container Registry.
Azure Container Instances for single containers and quick jobs.
Azure Container Apps for microservices with scaling rules.
Sizing and scaling for both.

App Service.

App Service plans: tiers, scale up vs scale out, autoscale.
TLS certificates and custom domains, verified with CNAME/TXT records.
Backups.
Networking: VNet integration for outbound traffic, private endpoints for inbound.
Deployment slots: swap staging into production with no downtime. Slots need the Standard tier or above.

4. Virtual networking (15–20%)

VNets.

Address spaces and subnets.
Peering: non-transitive by default; gateway transit is a setting.
Public IPs (Standard SKU).
User-defined routes: route tables that force traffic through a firewall or network virtual appliance (NVA).
Troubleshooting with Network Watcher tools: IP flow verify, next hop and connection troubleshoot.

Secure access.

NSGs and application security groups: rule priority (a lower number wins) and the default rules.
Effective security rules on a NIC.
Azure Bastion: RDP/SSH from the browser without public IPs on the VMs.
Service endpoints vs private endpoints:
- A service endpoint keeps the service's public IP but limits access to your subnets.
- A private endpoint gives the service a private IP in your VNet and needs a private DNS zone.

Name resolution and load balancing.

Azure DNS: public zones and private zones linked to VNets.
Internal and public Azure Load Balancer (layer 4): health probes, load-balancing rules, inbound NAT rules.
Troubleshooting probes that fail because an NSG blocks them.

Know where Application Gateway (layer 7, WAF) and Front Door fit, even though they're not the focus.

5. Monitor and maintain (10–15%)

Azure Monitor.

Metrics.
Diagnostic settings that send logs to Log Analytics, a storage account or Event Hubs.
KQL queries.
Alert rules, action groups and alert processing rules.
VM, storage and network Insights.
Network Watcher and Connection Monitor.

Backup and recovery.

Recovery Services vault (VMs, SQL in VMs, Azure Files) vs Backup vault (newer workloads such as blobs, disks and PostgreSQL).
Backup policies, backup and restore.
Azure Site Recovery: replicate VMs to another region, run a test failover, then failover and failback.
Backup reports and alerts.

6-week AZ-104 study plan (2 hours a day)

Week	Topics	Labs
1	Entra users, groups, SSPR, RBAC, Policy, locks, tags, costs	1–4
2	Storage accounts, redundancy, SAS, Files, lifecycle, AzCopy	5–7
3	VMs, disks, availability, scale sets, ARM/Bicep	8–10
4	App Service, slots, containers (ACR, ACI, Container Apps)	11–12
5	VNets, peering, NSG/ASG, Bastion, DNS, load balancer, private endpoints	13–14
6	Monitor, alerts, KQL, Backup, Site Recovery; two full practice assessments	15 + revision

Use Microsoft's free Practice Assessment for AZ-104 and the exam sandbox, which shows you the question types. Aim for 80%+ on practice tests before you book.

15 hands-on labs with Azure CLI

Run these commands in Cloud Shell (Bash). Use a free or pay-as-you-go subscription and delete the resource group after every lab so you don't get charged.

# Lab 0 — set up variables and a resource group
RG=rg-az104-lab; LOC=centralindia
az group create -n $RG -l $LOC

RBAC. Create a group and give it Reader on the resource group. Then check what the group's members can and can't do.

az ad group create --display-name az104-readers --mail-nickname az104-readers
GID=$(az ad group show -g az104-readers --query id -o tsv)
az role assignment create --assignee-object-id $GID --assignee-principal-type Group \
  --role Reader --scope $(az group show -n $RG --query id -o tsv)
az role assignment list -g $RG -o table

Policy. Assign the built-in "Allowed locations" policy to the resource group and try to deploy something in East US.
Locks. az lock create -n nodelete -g $RG --lock-type CanNotDelete, then try az group delete -n $RG.
Budget. Create a monthly budget with an 80% alert in Cost Management.

Storage and SAS.

SA=az104sa$RANDOM
az storage account create -n $SA -g $RG -l $LOC --sku Standard_ZRS --kind StorageV2 \
  --min-tls-version TLS1_2 --allow-blob-public-access false
az storage container create --account-name $SA -n docs --auth-mode login

Then create a user delegation SAS that expires in one hour, and test it in a private browser window.

Lifecycle. Add a rule that moves blobs to Cool after 30 days and deletes them after 365.
Azure Files. Create a file share, mount it on a VM, take a snapshot and turn on soft delete.

VM.

az vm create -g $RG -n vm1 --image Ubuntu2204 --size Standard_B1s \
  --admin-username azureuser --generate-ssh-keys --public-ip-address ""
az vm disk attach -g $RG --vm-name vm1 --name data1 --new --size-gb 8

The VM has no public IP. Use Bastion to reach it in Lab 13.

Scale set. Create a scale set with an autoscale rule (scale out above 70% CPU).
Bicep. Write a small main.bicep for a storage account, then deploy it with az deployment group create -g $RG -f main.bicep. Export a deployment and decompile it with az bicep decompile.
App Service. Create a Standard plan and a web app, add a staging slot, deploy to staging and swap.
Containers. Build an image into ACR with az acr build, run it in ACI, then deploy the same image to Container Apps with a scale rule.
Networking. Create a hub and a spoke VNet, peer them, add an NSG and an application security group, and deploy Bastion in the hub.
Private endpoint. Add a private endpoint for the storage account from Lab 5, link the private DNS zone, and confirm from the VM that the account's name resolves to a private IP.
Monitor and backup.
- Send the VM's logs to Log Analytics and query them with KQL.
- Create a CPU alert with an action group.
- Back up the VM to a Recovery Services vault and restore a file.

# Always clean up
az lock delete -n nodelete -g $RG 2>/dev/null; az group delete -n $RG --yes --no-wait

20 scenario questions with answers

These are original practice scenarios written for this guide, not exam questions.

1. A user can create VMs but must not be able to give anyone else access. Which role? Contributor at the right scope (or Virtual Machine Contributor). Neither can manage role assignments.

2. All resources must carry a costcentre tag copied from their resource group. How? Assign the built-in Azure Policy that inherits a tag from the resource group (Modify effect), then run remediation for existing resources. Tags are not inherited by default.

3. Developers keep deleting a production storage account. What is the quickest control? A CanNotDelete lock on the account or its resource group.

4. You need to revoke a service SAS without rotating the account keys. How do you prepare for this? Issue the SAS against a stored access policy. Changing or deleting the policy revokes the SAS.

5. Which SAS type is signed with Entra ID credentials instead of the account key? User delegation SAS.

6. Logs must move to Archive after 90 days and be deleted after seven years. What do you configure? A blob lifecycle management rule.

7. A storage account must stay readable if the whole primary region fails. Which redundancy? RA-GRS or RA-GZRS.

8. You need zero-downtime deployment for an App Service web app. What do you use? Deployment slots (Standard tier or higher), then a swap.

9. A VM must stay running if one datacenter in Central India fails. What do you configure? Deploy VMs across availability zones behind a zone-redundant load balancer.

10. VNet A peers with B, and B peers with C. Can A reach C? Not by default, because peering is non-transitive. Peer A with C directly, or route through an NVA or gateway in B.

11. Traffic from a subnet must go through a firewall appliance. What do you create? A route table with a user-defined route (next hop: virtual appliance), associated with the subnet.

12. Admins need RDP to VMs that have no public IPs. Which service? Azure Bastion.

13. A web app must reach Azure SQL over a private IP. What do you add, and what DNS step is easy to forget? A private endpoint for the SQL server. Link the privatelink DNS zone to the VNet.

14. Two NSG rules match: priority 200 allows port 22, priority 100 denies it. What happens? The traffic is denied, because the lower number (100) is evaluated first.

15. Load balancer health probes fail although the app is running. What do you check first? Whether an NSG or the OS firewall blocks the probe port, and whether the probe path or port is correct.

16. You need an email and SMS when a VM's CPU stays above 85% for 10 minutes. What do you create? A metric alert rule with an action group.

17. Which vault backs up Azure VMs, and which backs up Azure Blob storage? Recovery Services vault for VMs. Backup vault for blobs.

18. You must prove a VM can be recovered in South India without affecting production. How? Replicate it with Azure Site Recovery and run a test failover into an isolated network.

19. You exported a deployment as an ARM template and want a readable version. What do you run? az bicep decompile --file template.json

20. A support engineer needs to see why a VM can't reach the internet. Which tools help? Network Watcher: IP flow verify, next hop and connection troubleshoot, plus the effective security rules and effective routes on the NIC.

Exam-day tips

Read the last line of each scenario first; it tells you what is actually being asked.
Look out for words like "minimise cost", "least administrative effort" and "least privilege". They decide between two technically correct answers.
For questions where you can't go back to an answer later, decide carefully before you move on.
Online proctored exams need a clean desk, ID and a stable connection. Run the system test the day before.
After you pass, put it on your LinkedIn profile and your résumé, and set a reminder to renew within 12 months. Renewal is free.

AZ-104 interview topics beyond the exam

Interviewers for Azure administrator roles in Hyderabad usually go further than the exam:

Production stories: how you handled a VM that wouldn't boot, a failed backup or a cost spike.
Infrastructure as code: Terraform or Bicep in a pipeline, often with Azure DevOps. See our Azure and Azure DevOps interview questions.
Migration: see the Azure migration interview questions.
Hybrid and end-user computing: Azure Virtual Desktop and Intune come up often for administrators with Citrix or VMware backgrounds.

Next steps

Not done the basics? Start with the AZ-900 guide.
Want multi-cloud? Pair AZ-104 with the AWS Solutions Architect Associate.
Interested in AI? Move on to Azure AI services and the Microsoft Foundry tutorial.
See the Azure cloud engineer career path and browse current IT jobs that list Azure skills.

Cloud Soft Solutions in Ameerpet, Hyderabad teaches Azure administration, Azure DevOps and multi-cloud DevOps with real-time projects. See the Azure DevOps course and all courses.

📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad

Frequently Asked Questions

How long is the AZ-104 exam?
Microsoft lists 100 minutes for the exam, which may include interactive components.

What is the AZ-104 passing score?
700 on a scale of 1 to 1000.

How often must AZ-104 be renewed?
Every 12 months, by passing a free online renewal assessment on Microsoft Learn.

Can a fresher pass AZ-104?
Yes, with Linux and networking basics and about six weeks of daily hands-on practice in a real Azure subscription.

Which AZ-104 areas carry the most weight?
Identities and governance, and compute, at 20–25% each.

What comes after AZ-104?
AZ-400 for DevOps, AZ-305 for architecture, or Azure AI skills such as Microsoft Foundry for AI engineering roles.