Guide to Pass AZ-104: Microsoft Certified Azure Administrator Exam

The AZ-104 is Microsoft's benchmark certification for Azure Administrators — the engineers who manage subscriptions, configure virtual machines, handle networking, and keep Azure environments running. It tests breadth over depth: you need to know five distinct skill domains rather than one technology in detail.

This guide covers the exam domain map, the skills that matter most by weight, and a study sequence that gets you to passing faster.

Who Should Take AZ-104?

AZ-104 suits engineers who: - Manage Azure resources day-to-day (VMs, storage, networking, access) - Have 6+ months of Azure hands-on experience - Want to formalise their Azure skills with a widely recognised credential - Are pursuing Azure Solutions Architect Expert (AZ-305 requires AZ-104 first)

It is not a beginner exam. If you are new to Azure, start with AZ-900 (Azure Fundamentals) first.

AZ-104 Exam Domain Map

The exam measures five skill areas. The table below shows each domain, its current weight, and the core topics you must know.

Table 1 — AZ-104 exam domain map. Weights are approximate and sourced from the official Microsoft skills outline [1][2]. Domains update periodically — always verify against the live study guide before your exam date.

Highest-weight domains: Manage Azure Identities and Governance and Deploy and Manage Azure Compute Resources (both 20–25%). Treat identity and compute as co-equal anchors: one tests how access and governance shape every Azure environment, the other tests whether you can deploy and operate the resources those policies protect. Know RBAC, policy inheritance, VM creation, resizing, availability options, and Bicep/ARM deployment cold.

Study Sequence That Works

Study in weight order, not alphabetical order.

Phase 1 — Compute (weeks 1–2) Spin up VMs, resize them, create a scale set, deploy via ARM template or Bicep, attach a data disk, enable encryption. Hands-on is mandatory. The portal hides complexity; use the CLI for everything.

Phase 2 — Networking (weeks 3–4) Create a VNet with multiple subnets. Attach NSGs. Peer two VNets. Configure a basic VPN Gateway. Set up an Azure load balancer across two VMs. DNS zone creation. This domain has the most "gotcha" questions about traffic flow and NSG evaluation order.

Phase 3 — Identity and Governance (week 5) Work through RBAC role assignments, custom roles, and policy definitions. Understand management group hierarchy and how policy inherits down. Cost Management and budgets appear occasionally.

Phase 4 — Storage (week 6) Create storage accounts with different redundancy levels. Practice SAS token generation, lifecycle policies, and setting up Azure File Sync. Blob access tier changes (hot/cool/archive).

Phase 5 — Monitor and Maintain (week 7) Configure Azure Backup for a VM. Set up Log Analytics with a workspace. Create an alert rule on CPU percentage. Practice Recovery Services vault and creating a backup policy.

Phase 6 — Practice Tests (week 8) Take three full 60-question practice exams under timed conditions. Any domain below 70% gets a targeted review week before the real exam.

Use Microsoft Learn as the spine for each phase, not as the only preparation source. The official study guide links directly to self-paced learning paths, documentation, the practice assessment, and Exam Readiness Zone videos [1][2]. A good rule: read the Learn module, perform the task in a real Azure subscription, then repeat it from CLI or PowerShell without copying the instructions. The exam rewards recall under time pressure, so passive reading has a low ceiling.

What the Exam Actually Looks Like

• Questions: ~40–60 questions (Microsoft varies the count)
• Format: multiple choice, multiple select, drag-and-drop, case studies
• Duration: 100 minutes
• Passing score: 700 out of 1000
• Language: English and 10+ other languages

Case studies appear at the end and cannot be revisited once you leave them. Treat them like a separate mini-exam: scan the requirements, identify the subscription, region, identity, and network constraints, then answer only from the facts in the scenario. Do not burn time trying to perfect earlier multiple-choice questions if you still have a case study ahead; Microsoft says interactive components may appear as part of the assessment [1], and those items are where time pressure feels sharpest.

Common Failure Points

1. Confusing NSG and ASG rules. NSG rules are stateful and apply at subnet or NIC level. ASGs let you group VMs by role for cleaner NSG rules. Know which controls traffic.

1. Missing the difference between LRS, ZRS, and GRS. ZRS replicates across availability zones in one region. GRS replicates to a secondary region. LRS keeps three copies in one datacenter. [5]

1. Underestimating policy and governance questions. Policy compliance evaluation, built-in definitions, and remediation tasks appear more than candidates expect.

1. Not practising the CLI. The exam includes CLI and PowerShell command questions. Know az vm create, az network vnet create, and az group lock create at minimum.

After AZ-104

AZ-104 is the required prerequisite for: - AZ-305 Azure Solutions Architect Expert — the most sought-after Azure credential - AZ-500 Azure Security Engineer Associate — security posture, identity, and threat protection - AZ-700 Azure Network Engineer Associate — advanced networking (not formally required but assumes AZ-104 knowledge)

Pass AZ-104, then choose the track that matches your next career target: architecture (AZ-305), security (AZ-500), or networking (AZ-700).

Learn More

• Secure Coding With Claude — Claude-assisted code review and security pattern guidance applicable to Azure IaC and policy-as-code.
• Claude Tool Use From Zero — Build agents that interact with Azure APIs using function calling.