This AZ-104 study guide covers everything you need to prepare for the Microsoft Azure Administrator exam in 2026: the five skill domains and their weights, a four week plan built on labs, and the admin decisions that show up again and again. AZ-104 rewards people who have actually configured Azure, so most of this plan happens in the portal and the command line, not in slides.
Quick answers
- Exam code: AZ-104, Microsoft Azure Administrator.
- Certification: Azure Administrator Associate.
- Passing score: 700 out of 1000.
- Level: Associate.
- Renewal: free, online, once a year.
- Skills outline: this study guide follows the official skills outline dated October 26, 2023. Always check the Microsoft Learn exam page for updates before you book.
AZ-104 exam domains and weights
Microsoft groups the AZ-104 skills into five domains. Each one is given as a range:
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 20 to 25% |
| Implement and manage storage | 15 to 20% |
| Deploy and manage Azure compute resources | 20 to 25% |
| Implement and manage virtual networking | 15 to 20% |
| Monitor and maintain Azure resources | 10 to 15% |
Identity and compute are the two biggest areas. Networking is smaller on paper but it causes the most trouble for most candidates, because the questions ask you to predict what traffic will be allowed, not just name a service.
How to use this AZ-104 study guide
Create a lab subscription with a budget alert before you start. Build everything in the plan, break it, and fix it. Delete resources at the end of each session so the cost stays low. When you get a practice question wrong, rebuild that scenario in the lab instead of only rereading the answer.
The four week AZ-104 study plan
Week 1: Identities and governance (20 to 25%)
- Create users and groups, use group based licensing, invite a guest user and enable self service password reset (SSPR).
- Assign RBAC roles at management group, subscription and resource group scope, then check what access results.
- Assign Azure Policy for allowed locations and required tags, then apply Delete and ReadOnly locks and see what each one blocks.
- Create a budget with an action group and review Azure Advisor recommendations.
Week 2: Storage (15 to 20%)
- Create a storage account, change its redundancy and restrict it with the storage firewall.
- Create a SAS from a stored access policy, then revoke it without rotating the account keys.
- Configure lifecycle rules, versioning, soft delete and object replication.
- Create an Azure file share, take a snapshot and copy data with AzCopy and Storage Explorer.
Week 3: Compute (20 to 25%)
- Deploy a VM from a Bicep file with parameters, then export a template from the portal.
- Resize a VM, add a data disk, and deploy VMs across availability zones and in a scale set.
- Push an image to Azure Container Registry and run it in Container Instances and Container Apps.
- Create an App Service app with autoscale, a staging slot swap, a custom domain and TLS.
Week 4: Networking, monitoring and review (25 to 35%)
- Build peered virtual networks, network security groups, a route table, Bastion, a private endpoint and a load balancer.
- Query logs with KQL, create alert rules, action groups and an alert processing rule, then back up and restore a VM.
- Do a full practice set and review every explanation, including the questions you got right.
- Take the free official Microsoft practice assessment and close the weak areas it shows.
Decisions the AZ-104 exam tests most
AZ-104 questions usually describe an admin task and ask for the feature that does exactly that, with the least effort. These pairings come up constantly:
| If the question says | Choose |
|---|---|
| Users reset their own passwords | SSPR |
| Enforce region or SKU rules | Azure Policy |
| Block deletion but allow changes | Delete (CanNotDelete) lock |
| Revoke a SAS without rotating keys | Stored access policy |
| Survive the loss of a datacenter | Availability zones |
| Zero downtime release with rollback | Deployment slot swap |
| RDP to VMs without public IP addresses | Azure Bastion |
| Force traffic through a firewall | User defined route to a virtual appliance |
| Mute alerts during maintenance | Alert processing rule |
| Back up Azure VMs | Recovery Services vault in the same region |
Two networking facts are worth memorizing on their own. Virtual network peering is not transitive: if A peers with B and B peers with C, A cannot reach C through B. And when several NSG rules match, the rule with the lowest priority number wins.
Try two original AZ-104 style questions
These are original practice examples written for this article, not real exam questions.
A team must be able to change resources in a resource group, but nobody should be able to delete the resource group by accident. What should you apply?
Correct answer: B
A Delete (CanNotDelete) lock blocks deletion but still allows changes. A ReadOnly lock and a deny policy would block the changes the team needs.
VNet A is peered with VNet B, and VNet B is peered with VNet C. VMs in VNet A cannot reach VMs in VNet C. What is the cause?
Correct answer: C
Peering connects two networks directly. To reach VNet C, add a peering between A and C or route through a hub with a network virtual appliance or gateway.
Common AZ-104 mistakes
- Mixing up availability zones and availability sets. Zones protect against the loss of a whole datacenter. Sets spread VMs across racks inside one datacenter.
- Forgetting the tier rules. Rule based autoscale in App Service needs the Standard tier or higher. If a question asks for autoscale on a Basic plan, the fix is to scale up the plan first.
- Assuming RBAC and Azure Policy do the same job. RBAC controls who can act. Policy controls what can be created and how, no matter who does it.
- Skipping storage redundancy. Know LRS, ZRS, GRS, GZRS and the read access versions. Questions often ask which option lets you read from the secondary region at any time.
Exam tips for AZ-104
- Know the scope. Many identity questions turn on where a role or policy is assigned: management group, subscription, resource group or resource.
- Read for the least administrative effort. When two answers both work, the exam usually wants the built in feature over a custom script.
- Use the official practice assessment. It is free on Microsoft Learn and shows the question style well.
Frequently asked questions
Is AZ-104 hard?
It is the most practical of the Azure associate exams. People with real admin experience find it fair. People who only read about Azure tend to struggle with networking and storage questions. The labs above close that gap.
Should I take AZ-900 before AZ-104?
It is optional. If Azure is completely new to you, AZ-900 gives you the vocabulary first. Our CLF-C02 vs AZ-900 comparison helps if you are still choosing a cloud.
How do I renew the Azure Administrator certification?
Microsoft associate certifications are renewed once a year with a free, unproctored online assessment on Microsoft Learn. You can take it during the six month window before your certification expires.
Is AZ-104 affected by the 2026 Microsoft exam changes?
Several AI and data exams were retired or replaced in 2026, but AZ-104 is still current. See our summary of every Microsoft certification change in 2026.
Practice before you book
Try the free practice questions on our AZ-104 page. The complete AZ-104 guide ($19) adds a full bank of original questions across all five domains, an explanation for every option, this four week plan with a cheat sheet, and interview questions for Azure admin roles. If you are also preparing for other Azure exams, the All-Access Pass covers every guide.