On this page
Intro
AZ-104 supports the Microsoft Certified: Azure Administrator Associate credential and focuses on running an Azure environment, including its resources, access and monitoring. This guide is for learners moving beyond recognizing service names toward explaining and performing administrative work, with CertMonk available for focused review. The role description follows Microsoft’s certification page.
Exam at a glance
| Detail | AZ-104 |
|---|---|
| Exam code | AZ-104 |
| Questions | Exam-specific count not published; Microsoft says most certification exams typically contain 40–60, with variation |
| Time | 100 minutes, as listed on the certification page |
| Passing score | 700 or greater; technical exams use a 1–1,000 scale |
| Question types | Specific mix not published in advance; interactive components may appear |
| Price | Check the vendor’s site for current pricing |
| Retirement | Date not published on the reviewed certification page |
Sources: certification details, exam experience and scoring policy. Check your booking for the time allocated to your appointment.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Manage Azure identities and governance | 20–25% | Organize access and apply rules to resources. |
| Implement and manage storage | 15–20% | Configure how information is stored, accessed and protected. |
| Deploy and manage Azure compute resources | 20–25% | Set up and maintain environments that run workloads. |
| Implement and manage virtual networking | 15–20% | Configure connectivity and investigate network behavior. |
| Monitor and maintain Azure resources | 10–15% | Observe services and prepare for recovery. |
These are Microsoft’s published ranges, not fixed proportions. This guide follows the English skills outline effective April 17, 2026, in the official exam objectives, reviewed September 28, 2026.
What each domain really tests
Manage Azure identities and governance
Make scope the organizing idea in your notes. When studying an administrative setting, record the identity involved, the resource it affects and where the setting applies. Draw the relationships rather than relying on a long list of portal labels.
An Azure role assignment connects an identity, a set of permitted actions and a scope. A role assigned to a resource group therefore needs to be understood in relation to that group, rather than remembered as a permission label alone. See Microsoft’s RBAC explanation.
Azure Policy evaluates resources against organizational rules and can audit or enforce the required behavior. Being permitted to create a resource does not mean the proposed resource complies with policy. This distinction is explained in Microsoft’s Policy overview.
Implement and manage storage
Treat storage as a collection of decisions about access, organization and protection. For each learning exercise, record what is being stored, how it is reached and which settings you changed. Keep the original requirement beside the configuration notes.
Give recovery-related options deliberate attention instead of stopping when a file becomes accessible. Your review should include how you would inspect the configuration afterward and what evidence would show that it matches the intended behavior. Use the published outline to keep the exercise focused.
Deploy and manage Azure compute resources
For compute study, move beyond the successful creation screen. Describe the workload's needs before following the deployment instructions, then record the resources and settings involved. Compare the result with the requirement you started from.
Microsoft includes templates and Bicep in the AZ-104 outline. When reviewing deployment material, annotate it in ordinary language: identify inputs, dependencies and the intended result. Do not judge understanding solely by whether a provided example runs.
Implement and manage virtual networking
Draw the traffic path before investigating a connectivity problem. Label the source, destination and relevant boundaries, then add the settings you are studying. Keep separate notes for the observation and your interpretation of it.
After a guided exercise, explain the configuration from the diagram without reading the instructions. Identify the evidence you would collect before changing it. That habit makes the study session about reasoning through connectivity rather than remembering a navigation sequence.
Monitor and maintain Azure resources
Start a monitoring exercise with the condition you want to observe. Record what information would help, where you would inspect it and what action might follow. Compare useful evidence with information that merely looks detailed.
For recovery study, write down the intended outcome before following the procedure. Review the result and document what you verified. A short, repeatable checklist is more useful than a screenshot whose meaning you cannot explain a week later.
These are suggested ways to study the domains in Microsoft’s skills outline, rather than a reproduction of its detailed objective list.
A realistic six-week study plan
Use six weeks as a planning framework and extend it when a topic needs more practical work. AZ-104 is an administrator exam, so this plan gives space to learning activities as well as reading. Prepare a place to record the goal, action, result and next step from each session.
Week 1: establish your starting point
Read the objectives and mark each area as familiar, partially understood or new. Review identity and governance first, then produce a diagram explaining the relationships you studied. Choose one small learning activity and explain its outcome in your own words.
At the end of the week, revisit your notes without the instructions beside you. Record where you can explain the intent but not the procedure, and where you can repeat steps but cannot explain their purpose. Those are different gaps requiring different follow-up.
Week 2: concentrate on storage
Organize sessions around access, configuration and protection. Begin each session with a small, specific learning goal. Finish with a written explanation of what changed and how you checked the result.
Reserve one session for reviewing earlier material. Include untimed practice and read the explanations even when your choice was correct. Mark anything you selected through familiarity rather than clear reasoning.
Week 3: work through compute
Alternate deployment reading with guided practice. Keep a record of prerequisites and configuration choices so the exercise does not become a disconnected list of clicks. Set aside a session for interpreting deployment definitions in plain language.
Review mistakes promptly. If you followed an instruction successfully but could not repeat the reasoning later, return to the concept before moving to a larger activity.
Week 4: focus on networking
Use diagrams throughout the week. Begin with straightforward paths, then work through the networking topics on the checklist. During troubleshooting study, write down the evidence supporting each step.
End the week with mixed review that includes identity, storage and compute. This helps you see where your understanding becomes uncertain when several topics appear together.
Week 5: monitoring, maintenance and gap repair
Study monitoring and recovery, then revisit the areas that recur in your learning log. Complete a written walkthrough of one activity without looking at the instructions. Compare it with the documentation afterward and correct omissions.
Keep the final sessions flexible. Use them for gaps you actually found rather than assuming every domain needs the same amount of revision.
Week 6: pacing and readiness
Add timed practice and review the session afterward. Separate missing knowledge from misreading, uncertainty about scope and time pressure. Revisit Microsoft's exam-experience information before booking or attending.
Make your readiness decision from the whole record: explanations you can give, activities you understand and weaknesses that remain. If the gaps are substantial, extend the plan with specific tasks instead of repeating entire courses without a clear purpose.
Common mistakes and how to avoid them
- Studying only service names. Add the purpose, inputs and verification step for each activity.
- Ignoring scope. Identify where a setting applies before explaining its effect.
- Following instructions without reflection. Write the reasoning afterward with the instructions closed.
- Leaving deployment definitions until the final week. Include short interpretation sessions throughout compute study.
- Skipping smaller domains. Keep monitoring and maintenance on the schedule.
- Using a rising practice score as the only readiness measure. Check whether you can explain unfamiliar wording and carry out the underlying work.
How to use practice questions well
Work untimed while learning a domain. Review why each alternative does or does not fit, then record the missing distinction in your learning log. Follow that review with documentation or an activity that addresses the gap.
CertMonk provides explanations for every answer choice, randomized practice tests, timed and untimed modes, flip-card flashcards, study games and progress by exam domain. Use domain progress to select follow-up work and recall tools to reinforce terminology between longer sessions.
Introduce timing once you can explain your choices. Afterward, distinguish conceptual mistakes from rushed reading. Avoid treating a practice result as a conversion to Microsoft's exam score: Microsoft describes its result as a scaled score in its scoring policy.
Free practice questions
Explore the free AZ-104 samples below and use the explanations to identify topics for further study.
You are explaining resource groups to a new administrator. Which two statements are true? (Choose two.)
Choose 2.
- AResources automatically inherit the tags applied to their resource group
- BResources in a resource group can be in regions other than the group’s own location
- CDeleting a resource group leaves its resources in the subscription without a group
- DA resource group can contain other resource groups to build a hierarchy
- EEach resource can exist in only one resource group at a time
Show the answer and explanation
Answer: B. Resources in a resource group can be in regions other than the group’s own location and E. Each resource can exist in only one resource group at a time
Correct. The group’s location only stores its metadata; its resources can be in different regions.
Correct. A resource belongs to exactly one resource group, although it can be moved to another.
Why not the others
- A. Resources do not inherit resource group tags. Azure Policy can copy them if needed.
- C. Deleting a resource group deletes every resource inside it. A resource never remains in a subscription without a resource group.
- D. Resource groups cannot be nested. Management groups provide hierarchy above subscriptions.
Takeaway: A resource lives in exactly one resource group; the group’s location only holds metadata, so its resources can be in other regions. Tags are not inherited and deleting the group deletes its resources.
Source: What is Azure Resource Manager?
You must modify a Bicep file so that it creates one storage account for each name in an array parameter named accountNames. The number of names changes between environments. Which change should you make?
- ACopy the storage account declaration once for each name and wrap the extra copies in if conditions
- BMove the storage account into a module and pass the whole accountNames array as a single parameter
- CDeclare the storage account once with a for expression that iterates over accountNames
- DAdd the @batchSize decorator to the storage account declaration with the value of the array length
Show the answer and explanation
Answer: C. Declare the storage account once with a for expression that iterates over accountNames
Correct. A resource-level for loop deploys one instance for each array element, so the count follows the parameter.
Why not the others
- A. Hand-copied declarations do not adapt to the array length. You would have to edit the file whenever the list grows.
- B. Passing the array to a module does nothing unless the module itself loops. A plain module call deploys the module once.
- D. @batchSize only controls how many loop instances deploy at once. It needs an existing for expression and creates no instances by itself.
Takeaway: In Bicep, add a for expression to a resource or module declaration to deploy one instance per array element. @batchSize can then limit how many deploy at once.
Source: Iterative loops in Bicep
VNet-Core is linked to the private zone internal.fabrikam.com, and lookups worked. After the VNet’s DNS servers were changed to two domain controller VMs, lookups for internal.fabrikam.com names fail. The domain controllers resolve internet names correctly. What should you do?
- ADelete and re-create the virtual network link between the zone and VNet-Core
- BCreate a public DNS zone named internal.fabrikam.com with the same records
- CEnable autoregistration on the link so the domain controllers learn the records
- DOn the DCs, forward internal.fabrikam.com conditionally to Azure DNS at 168.63.129.16
Show the answer and explanation
Answer: D. On the DCs, forward internal.fabrikam.com conditionally to Azure DNS at 168.63.129.16
Correct. A custom DNS server must forward the private zone to Azure DNS (or use DNS Private Resolver) for linked zones to resolve.
Why not the others
- A. The link is not broken. With custom DNS, clients no longer query Azure DNS directly, so the link is not used.
- B. Publishing internal records publicly is unnecessary and risky, and the zone would still not be queried correctly.
- C. Autoregistration adds VM records to the zone; it does not make custom DNS servers forward queries.
Takeaway: Custom DNS servers on a VNet override direct use of linked private zones. Forward the zone to 168.63.129.16 from a server in a linked VNet, or use Azure DNS Private Resolver.
Source: Azure Private DNS zone overview
A script creates blob containers from project codes, and several creations have failed with HTTP 400. Which two names are valid container names? (Choose two.)
Choose 2.
- AFinance-2026
- Bfin2026q3
- Cfinance--2026
- Dfinance_2026
- Efinance-2026
Show the answer and explanation
Answer: B. fin2026q3 and E. finance-2026
Correct. Letters and numbers only, lowercase, and within the length limits.
Correct. Lowercase letters, digits, and single hyphens between them, within 3 to 63 characters.
Why not the others
- A. Container names must be all lowercase, so the capital F makes the name invalid.
- C. Container names may contain single hyphens between letters or digits, but two consecutive hyphens are not allowed.
- D. Underscores are not allowed. Only lowercase letters, numbers, and hyphens are valid.
Takeaway: Container names are 3 to 63 characters of lowercase letters, numbers, and hyphens, start with a letter or number, and have no consecutive hyphens.
Source: Naming and Referencing Containers, Blobs, and Metadata
A user accidentally deleted one folder from a data disk on an Azure VM that is protected by Azure Backup. The VM is otherwise healthy and must stay online. What is the BEST way to recover only that folder?
- AUse File Recovery for the VM’s recovery point to mount it on the VM and copy back the folder.
- BRestore the whole VM from the recovery point, replacing the existing VM.
- CRestore the data disk from the recovery point and replace the VM’s current data disk with it.
- DTake a new snapshot of the data disk and recover the folder from that snapshot.
Show the answer and explanation
Answer: A. Use File Recovery for the VM’s recovery point to mount it on the VM and copy back the folder.
Correct. File Recovery mounts a recovery point so individual files and folders can be copied without restoring the whole VM.
Why not the others
- B. Replacing the VM restores far more than one folder and interrupts a healthy VM that must stay online.
- C. Swapping the disk rolls back every other change on that disk and requires the disk to be detached.
- D. A new snapshot captures the disk after the deletion, so the folder is not in it.
Takeaway: Use Azure Backup File Recovery for item-level restores from a VM recovery point without restoring the whole VM or disk.
FAQ
Is AZ-104 aimed at complete beginners?
Microsoft labels the credential intermediate and describes an administrator audience on its certification page. If Azure concepts are new, build that foundation before attempting this schedule.
Does this guide cover the current outline?
It follows the April 17, 2026 English outline shown in Microsoft’s study guide. Recheck it as your exam date approaches.
How long should I prepare?
Six weeks is the suggested structure here, not a vendor requirement. Extend it until you can explain your work and address the gaps in your log.
Should I learn only through the portal?
No. Microsoft’s candidate profile includes familiarity with command-line tools and deployment definitions as well as the portal. Make room for those approaches in your learning.
Does Azure Administrator Associate need renewal?
Microsoft lists a 12-month renewal frequency and describes renewal through an online assessment on its certification page.
What should I do after a weak practice session?
Choose one recurring misunderstanding, revisit the relevant documentation and explain the correction. Take another mixed session later so you can check understanding rather than immediate memory.
Next step
Try free practice questions → https://app.certmonk.app/samples
