Study room

References

AZ-104 References: Your Azure Super-Power Map

This is the one-stop reference file. Bookmark it. Open it in a tab while you study.

IMPORTANT honesty note: I cannot embed screenshots. Microsoft Learn pages contain the authoritative screenshots and diagrams; I have linked directly to those pages instead. All URLs below are canonical learn.microsoft.com or azure.microsoft.com paths, which are stable. If a page has moved, the top-level slug redirects; the deep-link is my best knowledge as of the January 2026 training cutoff.

1. Official Microsoft Learn Resources

Exam page (start here)

  • AZ-104 exam page + current skills outline: https://learn.microsoft.com/credentials/certifications/exams/az-104/
  • Certification page: https://learn.microsoft.com/credentials/certifications/azure-administrator/

Free Microsoft Learn learning paths (this is the gold; each has hands-on sandbox labs at no cost)

  • Prerequisites: Prerequisites for Azure administrators: https://learn.microsoft.com/training/paths/az-104-administrator-prerequisites/
  • Domain 1: Manage identities and governance in Azure: https://learn.microsoft.com/training/paths/az-104-manage-identities-governance/
  • Domain 2: Implement and manage storage in Azure: https://learn.microsoft.com/training/paths/az-104-manage-storage/
  • Domain 3: Deploy and manage Azure compute resources: https://learn.microsoft.com/training/paths/az-104-manage-compute-resources/
  • Domain 4: Configure and manage virtual networking for Azure administrators: https://learn.microsoft.com/training/paths/az-104-manage-virtual-networks/
  • Domain 5: Monitor and back up Azure resources: https://learn.microsoft.com/training/paths/az-104-monitor-backup-resources/

Official practice assessment (free, from Microsoft)

  • Microsoft AZ-104 practice assessment (linked from the exam page): https://learn.microsoft.com/credentials/certifications/exams/az-104/practice/assessment

Microsoft Learn sandbox (free 4-hour Azure environment, no card required)

  • Sandbox is auto-provisioned inside the labs of the learning paths above. Look for the "Activate sandbox" button in modules that include lab steps.

2. Official Microsoft AZ-104 GitHub Lab Repository

  • GitHub: https://github.com/MicrosoftLearning/AZ-104-MicrosoftAzureAdministrator
  • 25+ hands-on labs with step-by-step instructions matching the exam objectives.
  • Uses your own Azure subscription (or a free trial). Each lab has an estimated time and prerequisites.

Recommended completion order for the learner.(given hands-on background): 1. Skim: lab 01 (identities), lab 04 (RBAC) - probably fast 2. Focus: lab 05 (governance / policy), lab 06 (storage), lab 08 (Azure Files + Sync) 3. Do fully: lab 09 (VMs), lab 10 (VMSS), lab 11 (App Service), lab 12 (containers) 4. Focus: lab 13 (VNets), lab 14 (peering), lab 15 (traffic management + LB + AGW) 5. Do fully: lab 16 (Azure Firewall), lab 17 (VPN), lab 18 (ExpressRoute concepts) 6. Skim: lab 19 (Azure Monitor), lab 20 (backup)

3. Domain-by-Domain Reference Map

Domain 1: Identity + Governance

| Topic | Primary doc | Notes | |---|---|---| | Entra ID overview | https://learn.microsoft.com/entra/fundamentals/whatis | Renamed from Azure AD | | Entra ID role reference | https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference | Full role catalog | | Azure RBAC overview | https://learn.microsoft.com/azure/role-based-access-control/overview | Different plane from Entra roles | | Built-in Azure roles | https://learn.microsoft.com/azure/role-based-access-control/built-in-roles | Owner, Contributor, Reader, UAA, etc. | | Custom role definitions | https://learn.microsoft.com/azure/role-based-access-control/custom-roles | JSON structure, Actions, NotActions, DataActions | | Deny assignments | https://learn.microsoft.com/azure/role-based-access-control/deny-assignments | From Managed Apps and Blueprints | | Management groups | https://learn.microsoft.com/azure/governance/management-groups/overview | Hierarchy, root group, MG limits | | Azure Policy overview | https://learn.microsoft.com/azure/governance/policy/overview | Definitions, initiatives, assignments | | Policy effects | https://learn.microsoft.com/azure/governance/policy/concepts/effects | Audit, Deny, DeployIfNotExists, Modify, Append | | Policy exemptions | https://learn.microsoft.com/azure/governance/policy/concepts/exemption-structure | Waiver vs Mitigated | | Resource locks | https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources | ReadOnly vs CanNotDelete | | Tags + inheritance | https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources | Not automatic; policy required | | Conditional Access basics | https://learn.microsoft.com/entra/identity/conditional-access/overview | AZ-104 tests basics only | | SSPR + password writeback | https://learn.microsoft.com/entra/identity/authentication/concept-sspr-writeback | For hybrid users | | B2B guest users | https://learn.microsoft.com/entra/external-id/what-is-b2b | Guest invitations, cross-tenant sync | | Administrative Units | https://learn.microsoft.com/entra/identity/role-based-access-control/administrative-units | Scope Entra roles to subsets | | Managed identities | https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview | System vs user-assigned | | Cost Management + budgets | https://learn.microsoft.com/azure/cost-management-billing/costs/quick-acm-cost-analysis | Alerts, forecast, anomaly detection |

Domain 2: Storage

| Topic | Primary doc | Notes | |---|---|---| | Storage account overview | https://learn.microsoft.com/azure/storage/common/storage-account-overview | Types: GPv2, Premium BlockBlob, FileStorage, Premium PageBlob | | Redundancy | https://learn.microsoft.com/azure/storage/common/storage-redundancy | LRS, ZRS, GRS, GZRS + RA variants | | Blob access tiers | https://learn.microsoft.com/azure/storage/blobs/access-tiers-overview | Hot, Cool, Cold, Archive + minimums | | Lifecycle management | https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-overview | Rule syntax, last-access tracking | | Immutable storage (WORM) | https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview | Time-based + legal hold, Locked state | | Blob versioning | https://learn.microsoft.com/azure/storage/blobs/versioning-overview | Independent of soft delete | | Soft delete (blob + container) | https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview | Retention 1-365 days | | Azure Files overview | https://learn.microsoft.com/azure/storage/files/storage-files-introduction | SMB + NFS shares | | Azure File Sync | https://learn.microsoft.com/azure/storage/file-sync/file-sync-planning | Sync groups, cloud tiering | | Files identity-based auth | https://learn.microsoft.com/azure/storage/files/storage-files-active-directory-overview | On-prem AD DS, Entra DS, Entra Kerberos | | SAS overview | https://learn.microsoft.com/azure/storage/common/storage-sas-overview | Account SAS, service SAS, user delegation SAS | | Storage network security | https://learn.microsoft.com/azure/storage/common/storage-network-security | Firewall, service endpoints, private endpoints | | Storage encryption + CMK | https://learn.microsoft.com/azure/storage/common/storage-service-encryption | SSE, CMK via Key Vault, infra encryption | | AzCopy | https://learn.microsoft.com/azure/storage/common/storage-use-azcopy-v10 | Optimize concurrency, syntax reference | | Data Box family | https://learn.microsoft.com/azure/databox/data-box-overview | Disk, Data Box, Heavy |

Domain 3: Compute

| Topic | Primary doc | Notes | |---|---|---| | VM overview | https://learn.microsoft.com/azure/virtual-machines/overview | Sizes, families, availability | | VM sizes reference | https://learn.microsoft.com/azure/virtual-machines/sizes | B, D, E, F, M, N, H families | | Managed disks | https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview | Ultra, Premium SSD v2, Premium SSD, Standard SSD, Standard HDD | | Azure Disk Encryption (ADE) | https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview | BitLocker/DM-Crypt with Key Vault | | SSE + Encryption at Host | https://learn.microsoft.com/azure/virtual-machines/disk-encryption | Complementary to ADE | | Availability options (sets/zones/VMSS) | https://learn.microsoft.com/azure/virtual-machines/availability | Compare + SLA implications | | VMSS Uniform vs Flexible | https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes | Flexible is Microsoft's default now | | Autoscale rules | https://learn.microsoft.com/azure/azure-monitor/autoscale/autoscale-overview | Metric, schedule, custom | | VM extensions | https://learn.microsoft.com/azure/virtual-machines/extensions/overview | CustomScript, DSC, AAD Login, AMA | | App Service overview | https://learn.microsoft.com/azure/app-service/overview | Plans, tiers, scaling | | App Service plan tiers | https://learn.microsoft.com/azure/app-service/overview-hosting-plans | Free through Isolated | | Deployment slots | https://learn.microsoft.com/azure/app-service/deploy-staging-slots | Swap, slot settings, warm-up | | Container Instances | https://learn.microsoft.com/azure/container-instances/container-instances-overview | Single containers, serverless | | Container Apps | https://learn.microsoft.com/azure/container-apps/overview | Serverless K8s, KEDA | | AKS overview | https://learn.microsoft.com/azure/aks/what-is-aks | Managed K8s cluster | | ARM templates | https://learn.microsoft.com/azure/azure-resource-manager/templates/overview | JSON IaC | | Bicep overview | https://learn.microsoft.com/azure/azure-resource-manager/bicep/overview | Declarative DSL | | Update Manager | https://learn.microsoft.com/azure/update-manager/overview | Modern patching, replaces Update Management |

Domain 4: Networking

| Topic | Primary doc | Notes | |---|---|---| | Virtual network concepts | https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview | Address space, subnets | | Subnet reservations | https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq | 5 IPs reserved per subnet | | VNet peering | https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview | Non-transitive, gateway transit | | NSG overview | https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview | Rules, priority, default rules | | ASG | https://learn.microsoft.com/azure/virtual-network/application-security-groups | Logical grouping | | UDR overview | https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview | Next hop types | | Public IP | https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses | Basic retired, Standard is default | | Standard Load Balancer | https://learn.microsoft.com/azure/load-balancer/load-balancer-overview | L4, 5-tuple hashing | | NAT Gateway | https://learn.microsoft.com/azure/nat-gateway/nat-overview | Modern outbound pattern | | Application Gateway v2 | https://learn.microsoft.com/azure/application-gateway/overview-v2 | L7, WAF, path/host routing | | Azure Firewall | https://learn.microsoft.com/azure/firewall/overview | Rules, policy, Premium features | | Front Door | https://learn.microsoft.com/azure/frontdoor/front-door-overview | Global L7 + WAF + caching | | Traffic Manager | https://learn.microsoft.com/azure/traffic-manager/traffic-manager-overview | DNS-based global routing | | Service endpoints | https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview | VNet identity to PaaS | | Private endpoints | https://learn.microsoft.com/azure/private-link/private-endpoint-overview | Private IP for PaaS in your VNet | | Private DNS zones | https://learn.microsoft.com/azure/dns/private-dns-overview | Registration + resolution links | | DNS Private Resolver | https://learn.microsoft.com/azure/dns/dns-private-resolver-overview | Managed DNS forwarder for on-prem | | S2S VPN | https://learn.microsoft.com/azure/vpn-gateway/tutorial-site-to-site-portal | IKEv2, BGP, gateway SKUs | | P2S VPN | https://learn.microsoft.com/azure/vpn-gateway/point-to-site-about | OpenVPN, IKEv2, SSTP | | ExpressRoute | https://learn.microsoft.com/azure/expressroute/expressroute-introduction | Private circuit, peering types | | Network Watcher | https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview | IP flow verify, Connection Troubleshoot, packet capture |

Domain 5: Monitoring + Backup

| Topic | Primary doc | Notes | |---|---|---| | Azure Monitor overview | https://learn.microsoft.com/azure/azure-monitor/overview | Metrics + logs | | Log Analytics workspace | https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview | Design + retention | | KQL tutorial | https://learn.microsoft.com/azure/data-explorer/kusto/query/tutorial | Full KQL learning | | Data Collection Rules | https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview | AMA routing | | Azure Monitor Agent | https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview | Replaces MMA/OMS | | Diagnostic settings | https://learn.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings | Route logs/metrics | | Alert rules | https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview | Metric, log, activity, health | | Action groups | https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups | Email, SMS, webhook, Function, Runbook | | Application Insights | https://learn.microsoft.com/azure/azure-monitor/app/app-insights-overview | Instrumentation basics | | Recovery Services Vault | https://learn.microsoft.com/azure/backup/backup-azure-recovery-services-vault-overview | VMs, Files, in-VM SQL, MABS | | Backup Vault | https://learn.microsoft.com/azure/backup/backup-vault-overview | Blob, disks, PostgreSQL Flexible, AKS | | VM backup | https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction | Standard vs Enhanced policy | | Immutable vault | https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept | Compliance protection | | Cross-Region Restore | https://learn.microsoft.com/azure/backup/backup-create-rs-vault#set-cross-region-restore | GRS vault only | | Azure Site Recovery | https://learn.microsoft.com/azure/site-recovery/site-recovery-overview | Replication for DR | | Azure Advisor | https://learn.microsoft.com/azure/advisor/advisor-overview | Cost, security, reliability, performance, ops | | Service Health | https://learn.microsoft.com/azure/service-health/service-health-overview | Microsoft-side incidents | | Resource Health | https://learn.microsoft.com/azure/service-health/resource-health-overview | Per-resource platform signals |

4. PowerShell Az Module vs Azure CLI Cheatsheet

You already use PowerShell Az. The exam frequently gives you one syntax and asks you to identify the equivalent operation. Common resource-type-verb map:

| Operation | Azure PowerShell (Az) | Azure CLI | |---|---|---| | Create resource group | New-AzResourceGroup -Name X -Location L | az group create -n X -l L | | List VMs | Get-AzVM | az vm list -o table | | Start VM | Start-AzVM -Name X -ResourceGroupName RG | az vm start -n X -g RG | | Restart VM | Restart-AzVM -Name X -ResourceGroupName RG | az vm restart -n X -g RG | | Deallocate VM | Stop-AzVM -Name X -ResourceGroupName RG -Force | az vm deallocate -n X -g RG | | Create VM | New-AzVM ... | az vm create ... | | Create VNet | New-AzVirtualNetwork ... | az network vnet create ... | | Create subnet | Add-AzVirtualNetworkSubnetConfig then Set-AzVirtualNetwork | az network vnet subnet create ... | | Create NSG | New-AzNetworkSecurityGroup ... | az network nsg create ... | | Add NSG rule | Add-AzNetworkSecurityRuleConfig then Set-AzNetworkSecurityGroup | az network nsg rule create ... | | Effective NSG rules | Get-AzEffectiveNetworkSecurityGroup -NetworkInterfaceName NIC -ResourceGroupName RG | az network nic list-effective-nsg -n NIC -g RG | | Create storage account | New-AzStorageAccount ... | az storage account create ... | | Create Log Analytics workspace | New-AzOperationalInsightsWorkspace -Name X -ResourceGroupName RG -Location L | az monitor log-analytics workspace create -g RG -n X -l L | | RBAC assign role | New-AzRoleAssignment -SignInName u -RoleDefinitionName Reader -Scope /subs/... | az role assignment create --assignee u --role Reader --scope /subs/... | | RBAC list assignments | Get-AzRoleAssignment -Scope /subs/... | az role assignment list --scope /subs/... | | Policy assign | New-AzPolicyAssignment ... | az policy assignment create ... | | Policy compliance state | Get-AzPolicyState ... | az policy state list ... | | Set tag | New-AzTag -ResourceId r -Tag @{k=v} | az tag create --resource-id r --tags k=v |

Az module install: Install-Module -Name Az -Repository PSGallery -Force Az login: Connect-AzAccount (device code option: Connect-AzAccount -UseDeviceAuthentication) Az switch subscription: Set-AzContext -Subscription SubName CLI equivalent: az login, az account set --subscription SubName

Reference:

  • PowerShell Az module: https://learn.microsoft.com/powershell/azure/what-is-azure-powershell
  • Azure CLI: https://learn.microsoft.com/cli/azure/what-is-azure-cli
  • CLI command reference (browsable): https://learn.microsoft.com/cli/azure/reference-index

5. Portal Navigation Quick Reference

Where things live in the portal (Microsoft occasionally reshuffles; if a blade moved use the top-search box):

| Feature | Path | |---|---| | Effective security rules (NSG) | VM > Networking > NIC > Effective security rules | | Effective routes | VM > Networking > NIC > Effective routes | | Cost analysis | Subscription (or MG) > Cost Management > Cost analysis | | Budgets | Subscription > Cost Management > Budgets | | Activity log | Resource or Subscription > Activity log | | Diagnostic settings | Resource > Monitoring > Diagnostic settings | | Log Analytics workspace queries | Workspace > Logs | | PIM activate role | Entra ID > Privileged Identity Management > My roles | | Directory roles + admins | Entra ID > Roles and administrators | | Conditional Access | Entra ID > Protection > Conditional Access | | App registrations | Entra ID > App registrations | | Enterprise applications | Entra ID > Enterprise applications | | External identities | Entra ID > External Identities | | Administrative units | Entra ID > Administrative units | | Access management for Azure resources (elevate) | Entra ID > Properties > "Access management for Azure resources" toggle | | Management groups | Subscriptions > Manage tenants > Management groups (or search) | | Resource locks | Resource > Locks (also RG > Locks, Sub > Locks) | | Policy compliance | Policy > Compliance | | Policy assignments | Policy > Assignments | | Policy exemptions | Policy > Exemptions | | Advisor | Search "Advisor" > Overview | | Service Health | Search "Service Health" | | Backup center | Search "Backup center" (unified VM/Files/Blob backup view) | | Update Manager | Search "Azure Update Manager" | | Network Watcher | Search "Network Watcher" |

6. Community Study Resources

These are widely used by AZ-104 candidates. I am NOT linking to specific videos (those move); the channels + creators are stable.

Free video courses / channels:

  • John Savill's Technical Training (YouTube channel): comprehensive AZ-104 study cram (multi-hour), plus deep-dives on individual services. Considered the definitive free video resource for Azure certs.
  • Adam Marczak - Azure for Everyone (YouTube channel): shorter, focused videos per feature.
  • Tim Warner (YouTube + Pluralsight): AZ-104 focused courses.
  • Microsoft Learn Live shows (search "Microsoft Learn Live" on YouTube): official Microsoft content.

Paid but often worth it:

  • Scott Duffy AZ-104 course on Udemy (usually goes on sale for ~$15)
  • MeasureUp AZ-104 practice test (official partner, closest to real exam experience)

Hands-on beyond MS Learn:

  • Azure free account: 12 months of free popular services + $200 credit for 30 days. https://azure.microsoft.com/free/
  • Azure for Students: $100 credit, no card required, for students. https://azure.microsoft.com/free/students/
  • Cloud Skills Challenges (Microsoft periodic events): free labs + often a free exam voucher offer.

7. Study Cadence Recommendation (2-4 weeks, given your background)

Week 1: Domain 1 + Domain 4 (weight + trap-heavy)

  • Days 1-3: Domain 1 (identity + governance). Read the 30 questions + 20 scenarios in 01-identity-governance.md. Skim MS Learn Domain 1 path (skip modules you know cold). Do MS Learn labs for RBAC + Policy.
  • Days 4-6: Domain 4 (networking). Read 04-networking.md. Focus on Load Balancer SKU tables, VPN gateway SKU comparison, peering transitivity, private DNS zone flows. Do MS Learn labs for VNets, peering, NSG.
  • Day 7: Review any incorrect answers.

Week 2: Domain 3 + Domain 2

  • Days 8-10: Domain 3 (compute). Read 03-compute.md. Do MS Learn labs for VMSS, App Service slots, Bicep basics.
  • Days 11-12: Domain 2 (storage). Read 02-storage.md. Skim the redundancy comparison table (LRS vs ZRS vs GRS vs GZRS + RA variants).
  • Day 13: Review.
  • Day 14: Take the free Microsoft practice assessment (linked in section 1 above). Note score by domain.

Week 3: Domain 5 + weak areas

  • Days 15-16: Domain 5 (monitoring). Read 05-monitoring.md. Focus on RSV vs Backup Vault distinction, Update Manager, action group actions.
  • Days 17-19: Re-drill weakest domain from practice assessment.
  • Day 20: Full practice test (MeasureUp or another). Aim for consistent 80%+.
  • Day 21: Rest / light review.

Week 4 (optional, or bring exam forward): Final polish

  • Re-drill missed scenarios. Watch John Savill AZ-104 study cram video end-to-end (about 4-6 hours; good final consolidation).
  • Book the exam. Schedule for late morning your local time (fresh but not too early).

8. Exam-Day Tips (Applicable to All Microsoft Role-Based Certs)

  • Format warning: case studies are 5-7 questions on the same scenario. You can review answers within the case study but cannot return to it once you exit. Answer all case study questions before moving on. The rest of the exam allows mark-for-review + navigation.
  • Time management: ~100 minutes for 40-60 questions. If a case study appears, budget 20-25 minutes for it and adjust the rest.
  • Language of options: "Best" answer questions have several correct-looking options. Pick the one that most directly satisfies the stem's constraints ("least-privileged," "least-effort," "highest-durability").
  • Multi-answer questions: the stem tells you how many to pick ("Select two"). Getting one right + one wrong is typically zero credit.
  • Drag-and-drop: each item can be dragged only to its intended target; there is no partial-credit hint. Get it fully right or fully wrong.
  • What the exam prefers:
  • Modern Microsoft-recommended patterns (RBAC over access policies for Key Vault; AMA over MMA; NAT Gateway over LB outbound; Flexible VMSS over Uniform; Update Manager over Automation-Update; Front Door over Traffic Manager for HTTP).
  • Standard SKUs over Basic (Basic LB and Basic PIP are being retired).
  • Managed identities over service principals with secrets, over account keys.
  • Private endpoints over service endpoints for regulated PaaS.
  • When two answers seem equally right, ask: which is (a) least-privileged, (b) least-effort to maintain, (c) least-cost, (d) most-recently-recommended by Microsoft. Usually one dimension favors one option decisively.

9. After You Pass

  • AZ-104 credential is valid for 1 year and free to renew via a short online assessment on Microsoft Learn (no proctor, no fee).
  • Renewal opens 6 months before expiry. Complete anytime in that window.
  • Natural next step: AZ-305 (Azure Solutions Architect Expert). AZ-104 + AZ-305 = Solutions Architect Expert.
  • Adjacent role-based certs: AZ-500 (Security Engineer), AZ-700 (Network Engineer), SC-300 (Identity + Access Administrator).
  • Rare but useful: AZ-800/AZ-801 (Windows Server Hybrid Administrator) if hybrid AD is core to your role.

10. Files in This Study Set

  • 00-INDEX.md - table of contents, weights, study order
  • 01-identity-governance.md - 30 core questions + 20 scenarios + doc links
  • 02-storage.md - 28 core questions + 20 scenarios + doc links
  • 03-compute.md - 30 core questions + 20 scenarios + doc links
  • 04-networking.md - 30 core questions + 20 scenarios + doc links
  • 05-monitoring.md - 25 core questions + 20 scenarios + doc links
  • 06-REFERENCES.md - this file