If you’re managing infrastructure in the cloud these days, you’ve probably noticed that Azure is no longer the platform people dismiss as “Microsoft’s cloud alternative.” Enterprise adoption is real, job postings are plentiful, and the Azure administrator certification has become one of the most pragmatic credentials you can earn in IT infrastructure.
The Azure administrator certification (AZ-104) is Microsoft’s core credential for cloud infrastructure professionals. But unlike some certifications that test trivia, this one actually validates skills you’ll use daily: managing virtual machines, storage accounts, networking, identity services, and governance across Azure subscriptions. After helping dozens of IT professionals prepare for this exam, I can tell you that success comes down to understanding not just the what but the why behind Azure’s architecture.
This guide walks you through everything you need to know to pass the AZ-104 exam and actually be competent managing Azure infrastructure.
What Is the Azure Administrator Certification?
The AZ-104 exam is Microsoft’s official certification for Azure administrators. It’s vendor-neutral in the sense that you don’t need to work for Microsoft to pass it—just need real Azure experience or dedicated study time.
The exam covers five main knowledge areas:
- Manage Azure identities and governance — Users, groups, role-based access control (RBAC), subscriptions, and Azure Policy
- Implement and manage storage — Storage accounts, data replication, access tiers, and managed disks
- Deploy and manage compute resources — Virtual machines, App Service, container instances, and scale sets
- Configure and manage virtual networking — Virtual networks, subnets, network security groups, load balancers, and VPN gateways
- Monitor and maintain Azure resources — Azure Monitor, alerts, backup, and disaster recovery
Exam format:
– 40-60 questions
– 120 minutes
– Multiple choice, multiple select, and interactive exercises (drag-and-drop, simulations)
– Passing score: approximately 700/1000
– Cost: $165 USD
– Valid for 3 years
The interactive elements are important here. Microsoft includes lab-style simulations where you actually configure resources in a live (sandboxed) Azure environment. You won’t pass this exam by memorizing facts—you need hands-on experience.
Why Get the Azure Administrator Certification?
Before investing 100+ hours in study time, let’s be direct about whether this is worth your career:
Valid reasons to pursue it:
– You’re actively managing Azure infrastructure or planning to — this is the baseline credential employers expect
– You’re transitioning from on-premises infrastructure — the cert forces you to learn Azure’s architectural patterns properly
– You want to move into cloud architecture or DevOps roles — AZ-104 is often a prerequisite for advanced certifications like AZ-305
– Your employer requires it or will pay for it — take the free training and exam vouchers when offered
– Job postings in your market specifically list it — this is market-dependent; check LinkedIn jobs in your region
Questionable reasons:
– You think it’ll guarantee a job — it won’t; it’s a credential, not a golden ticket
– You haven’t touched Azure yet and just want “a cloud cert” — start with hands-on projects first
– You’re trying to skip real infrastructure experience — Azure exam knowledge and production competence are different things
The realistic view: AZ-104 is a prerequisite credential in mid-to-large organizations using Azure. If that describes your market, it’s valuable. If you’re in a smaller market or your organization primarily uses AWS, your study time might be better spent elsewhere.
Detailed Exam Content Breakdown
Understanding exactly what Microsoft tests is critical. Here’s the actual breakdown with real examples of what you’ll encounter:
Domain 1: Manage Azure Identities and Governance (20-25%)
Azure AD/Entra ID fundamentals:
You need to understand modern Azure identity, not just the old Azure AD terminology (Microsoft renamed it to Entra ID in 2023).
Key concepts:
– User and group management — Creating users, managing group membership, understanding dynamic groups
– Multi-factor authentication (MFA) — Conditional access policies, combined registration
– RBAC implementation — Custom roles, scope assignment (subscription, resource group, individual resource)
– Subscriptions and management groups — Organizing your Azure estate, applying policies at the right level
Real scenario you might face on the exam: “You need to ensure that all developers can create resources in the Dev resource group but cannot create storage accounts. What should you do?”
Answer: Create a custom RBAC role with “Create virtual machines” permission but exclude “Microsoft.Storage/storageAccounts/write” and assign it at the resource group scope.
Azure Policy and governance:
– Creating and assigning policies
– Understanding effects (Deny, Audit, DeployIfNotExists, Modify)
– Compliance and remediation
Domain 2: Implement and Manage Storage (15-20%)
Storage accounts fundamentals:
This domain assumes you understand that not all data storage in Azure goes to storage accounts—you might use managed databases, SQL Database, or Cosmos DB. But for blob, file, queue, and table storage, you need deep knowledge.
Key topics:
– Storage account types (Standard, Premium; GPv2 vs. Blob storage)
– Redundancy options (LRS, ZRS, GRS, GZRS) and when to use each
– Access tiers (Hot, Cool, Archive) and lifecycle management
– Shared access signatures (SAS) vs. connection strings vs. managed identity access
– Storage account firewalls and virtual network integration
Practical example: You’re designing storage for a media company with 500GB of active files and 5TB of archive footage accessed once yearly. You’d use a General Purpose v2 account with Hot/Cool tier split, implement lifecycle policies to move files to Archive after 90 days of inactivity, and use SAS tokens for customer downloads.
Managed disks:
– Disk types (Standard HDD, Standard SSD, Premium SSD, Ultra)
– Snapshots and images
– Disk encryption
– Disk sharing (advanced, but tested)
Domain 3: Deploy and Manage Compute Resources (20-25%)
Virtual machines:
This is the core infrastructure skill. You need hands-on experience with:
– VM sizing (understanding vCPU, memory, temp storage, network throughput)
– OS selection and marketplace images
– Extensions (PowerShell DSC, Custom Script Extension, Dependency Agent)
– Managed identities (accessing Azure services without storing credentials)
Common exam question: “How do you allow a VM to write to a storage account without storing a connection string?”
Answer: Assign a system-managed identity to the VM, then grant that identity “Storage Blob Data Contributor” RBAC role on the storage account.
Virtual Machine Scale Sets (VMSS):
– Creating scale sets with autoscaling
– Custom images vs. marketplace images
– Scaling rules based on CPU, memory, or custom metrics
– Application updates across scale sets
App Service (Platform-as-a-Service):
– Creating web apps, API apps, function apps
– App Service Plans and scaling tiers
– Deployment slots and traffic routing
– Authentication and authorization (App Service Easy Auth)
Container instances and Kubernetes:
– Azure Container Instances for simple containerized workloads
– Azure Kubernetes Service (AKS) basics (won’t be deep on this; that’s AZ-305)
– Container registries and image management
Domain 4: Configure and Manage Virtual Networking (20-25%)
This domain separates competent administrators from ones just clicking through portals. Network understanding is critical.
Virtual Networks (VNets) and subnetting:
– Address space planning (avoiding overlaps when peering or connecting on-premises)
– Subnet creation and Azure reserved addresses (each subnet reserves 5 addresses)
– Network security groups (NSGs) and application security groups (ASGs)
Practical scenario: You have a VNet with 10.0.0.0/16. You need subnets for web servers, app servers, and databases. You’d create:
– 10.0.1.0/24 for web (254 usable IPs)
– 10.0.2.0/24 for app
– 10.0.3.0/24 for database
This planning prevents the classic mistake of making subnets too small early on.
Network connectivity:
– VPN gateways (site-to-site and point-to-site)
– Azure ExpressRoute (dedicated circuits, not VPN)
– VNet peering (global peering across regions)
– Network Address Translation (NAT) gateways
Load balancing and traffic management:
– Azure Load Balancer (Layer 4, very high throughput)
– Application Gateway (Layer 7, HTTP/HTTPS, WAF capability)
– Traffic Manager (global load balancing, DNS-based)
– When to use each (this is tested, and people get it wrong)
Security components:
– Network security groups — stateful firewall at the subnet/NIC level
– Application security groups — logical grouping of resources for policy (instead of IP ranges)
– Azure Firewall — centralized firewall for hub-and-spoke topologies
Domain 5: Monitor and Maintain Azure Resources (10-15%)
Azure Monitor ecosystem:
– Metrics vs. Logs — metrics are time-series data, logs are searchable events
– Azure Monitor Agent (AMA) — the newer agent replacing older dependency agents
– Log Analytics workspaces — where logs are stored and queried with KQL (Kusto Query Language)
Example KQL query you might see:
Perf
| where ObjectName == "Processor"
| where CounterName == "% Processor Time"
| summarize AvgCPU = avg(CounterValue) by Computer
| where AvgCPU > 80
This finds all computers with average CPU over 80%.
Alerting and automation:
– Alert rules (metric, log, activity log)
– Action groups (notifications, runbooks, webhooks)
– Autoscaling based on metrics
Backup and disaster recovery:
– Azure Backup for VMs, SQL, and files
– Backup policies and retention
– Azure Site Recovery for disaster recovery (continuous replication, failover)
Study Path and Timeline
Here’s a realistic study schedule depending on your background:
If you have on-premises infrastructure experience (6-8 weeks):
Week 1-2: Azure fundamentals
– Complete Microsoft Learn modules for Azure Fundamentals (free)
– Create an Azure free account, deploy basic resources
– Focus: subscriptions, resource groups, basic networking
Week 3-4: Identity, storage, and governance
– Deep dive into RBAC with hands-on assignments
– Create storage accounts, test different redundancy options
– Configure and test Azure Policy
Week 5-6: Compute and networking
– Deploy VMs using different methods (portal, PowerShell, Terraform)
– Create VNets, subnets, NSGs; test traffic filtering
– Configure load balancers and understand the differences
Week 7-8: Monitoring and practice exams
– Set up monitoring for resources you’ve created
– Take full practice exams, review weak areas
– Final review of topics you struggled with
If you’re new to cloud (10-12 weeks):
Follow the above but add an extra month at the beginning understanding cloud concepts (VMs as services, managed infrastructure, scalability patterns).
Hands-On Practice: The Non-Negotiable Part
Here’s what separates people who pass and can actually do the job from those who memorize and fail in production:
Set up a lab environment:
1. Create an Azure free account (includes $200 credit for 30 days)
2. Deploy at least these resources from scratch:
– A virtual machine with RDP/SSH access
– A storage account with different access tiers
– A virtual network with proper subnetting
– A load balancer in front of multiple VMs
– A backup policy and test recovery
- Complete Microsoft’s official hands-on exercises in Learn modules — don’t skip these
Use PowerShell and CLI regularly:
The exam includes CLI/PowerShell commands. You won’t pass by learning GUI clicks alone.
Example: Create a VM via PowerShell, not just the portal:
$resourceGroup = "myResourceGroup"
$vmName = "myVM"
$location = "eastus"
New-AzResourceGroup -Name $resourceGroup -Location $location
New-AzVM -ResourceGroupName $resourceGroup `
-Name $vmName `
-Location $location `
-Image UbuntuLTS `
-PublicIPAddressName "$vmName-pip" `
-SecurityGroupName "$vmName-nsg"
Doing this repeatedly builds real competence.
Official Study Resources
Microsoft Learn (free, official, best quality):
Microsoft’s own learning platform has path-structured modules for AZ-104. These are legitimately well done and free. Start here.
Practice exams:
– Official Microsoft practice exams (MeasureUp or Examtopics)
– Cost: $165 for official exams; practice exams $99
– Take these under timed conditions to identify weak areas
Structured training (optional, paid):
If you prefer guided courses over self-study, consider Udemy IT Courses which offer comprehensive Azure administrator courses at a fraction of traditional training costs. Look for courses with 40+ hours of video and practice labs.
YouTube channels:
– Microsoft Azure (official)
– John Savill’s Technical Training (comprehensive, detailed walkthroughs)
Common Failure Points (Learn from Others’ Mistakes)
After reviewing feedback from dozens of test-takers, here’s where people stumble:
1. Confusing RBAC scope levels
Many people understand Owner, Contributor, and Reader but fumble on assignment scope. Practice assigning roles at subscription, resource group, and individual resource levels.
2. Not understanding redundancy tradeoffs
LRS is cheap but risky. GRS is standard but has higher latency and cost. GZRS is premium. People memorize without understanding when to use each. Think about your RPO/RTO requirements.
3. NSG and ASG implementation
The difference between network security groups and application security groups confuses test-takers. NSGs are subnet/NIC level. ASGs are logical groupings for rules. Practice creating rules with both.
4. Virtual networking design
Designing address spaces, subnetting, and peering across multiple VNets is tested. Do the exercises multiple times.
5. Skipping the lab simulations
The interactive simulations are worth 25-30% of the exam. If you only study multiple choice, you’ll struggle when you hit the hands-on section.
Timeline to Exam Day
2 weeks before exam:
– Complete full-length practice exams weekly
– Review weak domain areas based on practice test results
– Stop learning new topics; focus on depth in areas you’re weak
1 week before exam:
– Review summary notes and flashcards
– Do 1-2 practice exams
– Get adequate sleep (seriously; last-minute cramming hurts more than it helps)
Day before exam:
– Light review only
– Get 8+ hours sleep
– Test your internet connection and webcam (if taking online)
Exam day:
– Take it during a time when you’re naturally alert
– Read questions carefully; re-read any you’re unsure about
– Flag for review and come back to tricky questions
– Budget time: 40-60 questions in 120 minutes means roughly 2 minutes per question
After Passing: What’s Next?
The AZ-104 opens doors to advanced certifications:
AZ-305 (Azure Solutions Architect Expert):
Takes your administrator knowledge and adds architecture, design for scalability, disaster recovery, and cost optimization. Requires AZ-104 as a prerequisite. This is the next logical step if you’re moving toward architecture roles.
AZ-500 (Azure Security Engineer):
If security is your interest. Requires AZ-104 or equivalent foundation.
Keeping your certification current:
Azure changes frequently. Your certification is valid for 3 years, but Microsoft updates the exam regularly. To stay current, you need to maintain skills through real-world usage or regular study.
Final Thoughts
The Azure administrator certification is a practical, relevant credential if you work with Azure infrastructure. Unlike some certifications that feel like hoop-jumping, this one actually prepares you for real responsibilities: managing user access, configuring storage, deploying VMs, designing networks, and monitoring systems.
The key to passing and being genuinely competent is treating study time as practical learning, not memorization. Deploy resources, break things in your lab, fix them, and learn why things work the way they do.
If you’re ready to commit 6-8 weeks of focused study and you have hands-on access to Azure, you can pass AZ-104 and walk away with legitimate cloud infrastructure skills. That’s worth the effort.