The Microsoft Certified: Azure Administrator Associate certification validates that you can implement, manage, and monitor a real Azure environment. Unlike Azure Fundamentals, this is a hands-on administrator exam. Microsoft is testing whether you understand how Azure resources are organized, secured, connected, monitored, and maintained in day-to-day operations.
AZ-104 sits in the middle of the Azure path. It is often the certification that proves you can actually run Azure, not just talk about it. If you plan to move toward AZ-305, AZ-500, DevOps work, or broader platform operations, AZ-104 is one of the most valuable Microsoft certifications to get right.
As of May 28, 2026, Microsoft positions AZ-104 as an intermediate certification for administrators who work with identities, governance, storage, compute, networking, monitoring, and backup. The official certification page also expects familiarity with PowerShell, Azure CLI, the Azure portal, ARM templates or Bicep, and Microsoft Entra ID.
Exam At a Glance
| Attribute | Value |
|---|---|
| Certification | Microsoft Certified: Azure Administrator Associate |
| Exam code | AZ-104 |
| Level | Intermediate / Associate |
| Duration | 100 minutes |
| Cost | $165 USD |
| Renewal | Every 12 months |
| Prerequisites | No formal prerequisite, but Microsoft expects admin experience with operating systems, networking, servers, virtualization, Entra ID, Azure CLI, PowerShell, and Azure management tools |
| Target candidate | Azure administrators and cloud operations professionals implementing and managing Azure infrastructure |
| Primary focus | Identities and governance, storage, compute, networking, monitoring, and backup |
- Official certification page: Microsoft Certified: Azure Administrator Associate
- Official exam page: Exam AZ-104: Microsoft Azure Administrator
- Official study guide: AZ-104 study guide
- Official course: Microsoft Azure Administrator
- Official learning paths: AZ-104 prerequisites for Azure administrators, Manage identities and governance in Azure, Configure and manage virtual networks, Implement and manage storage in Azure, Deploy and manage Azure compute resources, Monitor and back up Azure resources
Official Assessed Areas
- Manage Azure identities and governance
- Implement and manage storage
- Deploy and manage Azure compute resources
- Implement and manage virtual networking
- Monitor and maintain Azure resources
Microsoft's current public exam page lists the active skill areas but does not publish a percentage weighting inline. Treat all five domains as active exam territory. AZ-104 is broad enough that weak spots in a single domain can still cost you the pass.
1. Manage Azure Identities and Governance
This domain is about who can do what in Azure, how access is structured, and how organizations impose consistent controls across subscriptions and resources.
- Microsoft Entra ID fundamentals for administrators - You need to understand users, groups, administrative units, device concepts, and hybrid identity positioning well enough to answer operational questions. Official resources: Manage identities and governance learning path, What is Microsoft Entra ID?.
- RBAC, role assignment scope, and least privilege - AZ-104 often tests whether you understand scope boundaries across management groups, subscriptions, resource groups, and resources. Official resources: Azure RBAC overview, AZ-104 governance path.
- Subscriptions, management groups, and governance structure - Be clear on how Azure organizes environments and how governance cascades downward. Official resources: Azure management groups overview, Manage identities and governance.
- Azure Policy and resource governance - Microsoft wants you to know how organizations enforce standards, permitted SKUs, tagging, and compliance behavior at scale. Official resources: Azure Policy overview, Governance learning path.
- This domain is operational, not theoretical - Questions usually revolve around the cleanest administrative control for access, governance, or scope, not high-level identity philosophy. Official resource: AZ-104 course.
Exam tip: If the scenario mentions permissions, scope inheritance, governance, or standards enforcement, think Entra ID plus RBAC plus Azure Policy before you think infrastructure services.
2. Implement and Manage Storage
This domain tests whether you can choose, configure, secure, and operate Azure storage services in realistic admin scenarios.
- Storage accounts and redundancy options - Know the differences between storage account types, replication choices, access tiers, and the admin tradeoffs behind them. Official resources: Implement and manage storage in Azure, Storage account overview.
- Blob, file, queue, and table services - AZ-104 is not a developer exam, but you do need to understand the main storage services and their operational characteristics. Official resources: Introduction to Azure Blob Storage, Storage learning path.
- Storage security and access controls - Study shared access signatures, identity-based access, private access patterns, and how storage is secured operationally. Official resources: AZ-104 storage path, Azure Storage network security.
- Import, migration, and lifecycle thinking - Microsoft expects you to understand storage administration as an ongoing operational task, not just one-time provisioning. Official resource: AZ-104 course.
Exam tip: Storage questions usually hinge on one of four ideas: durability choice, security boundary, data-access method, or the correct service type.
3. Deploy and Manage Azure Compute Resources
This section is about the core compute services Azure administrators operate and the decisions around provisioning, scaling, and maintaining them.
- Virtual machines and availability design - Know how Azure VMs, availability sets, zones, extensions, and scale-related options fit together from an administrator perspective. Official resources: Azure Virtual Machines overview, Deploy and manage Azure compute resources.
- App Service, containers, and managed hosting tradeoffs - AZ-104 is still an admin exam, but you need to recognize the operational differences between VMs and managed compute platforms. Official resources: App Service overview, Compute learning path.
- Automation and deployment tooling - Microsoft expects familiarity with the Azure portal, CLI, PowerShell, ARM templates, and Bicep in practical administration workflows. Official resources: Azure Resource Manager overview, AZ-104 course.
- Compute questions are about operations - Expect troubleshooting, sizing, deployment, and service-fit questions rather than deep application-code questions. Official resource: AZ-104 compute path.
Exam tip: If the prompt is about provisioning, scaling, patching, hosting, or operational control, start by deciding whether the workload belongs on VMs, managed web hosting, or a container-oriented platform.
4. Implement and Manage Virtual Networking
Networking is a high-value AZ-104 domain because it connects almost every other Azure service domain together.
- Virtual networks, subnets, and IP planning - Study core VNet design, subnet boundaries, address space planning, and how services attach to private networking. Official resources: Azure virtual network overview, Configure and manage virtual networks.
- NSGs, routing, and traffic control - AZ-104 often asks how traffic is filtered, routed, or isolated. Official resources: Network security groups overview, Networking learning path.
- VPN Gateway, ExpressRoute, and hybrid connectivity - Be able to distinguish internet-based VPN connectivity from dedicated private connectivity and know where each belongs. Official resources: What is VPN Gateway?, What is ExpressRoute?.
- Load balancing and name resolution basics - You should understand the purpose of Azure Load Balancer, Application Gateway, DNS, and related traffic-distribution concepts at the admin level. Official resources: Azure Load Balancer overview, Azure DNS overview.
Exam tip: Networking questions usually become easier once you classify the problem correctly: segmentation, reachability, hybrid connectivity, traffic filtering, or traffic distribution.
5. Monitor and Maintain Azure Resources
This domain covers visibility, backup, recovery, and day-two operations. It is the part of AZ-104 that checks whether you can keep Azure running reliably after deployment.
- Azure Monitor, metrics, logs, and alerts - Know what Azure Monitor does, when to use logs versus metrics, and how alerts fit into operational response. Official resources: Azure Monitor overview, Monitor and back up Azure resources.
- Backup, recovery, and retention - Microsoft expects you to understand the role of Azure Backup, Recovery Services vaults, and business-continuity style thinking for admin tasks. Official resources: Azure Backup overview, Backup learning path.
- Operational health and maintenance - Review service health, resource health, monitoring posture, and ongoing maintenance actions that support reliability. Official resources: Azure Service Health overview, Monitor overview.
- This domain is about day-two ownership - The right answer usually improves visibility, recoverability, or operational stability rather than simply provisioning a service. Official resource: AZ-104 course.
Exam tip: If the scenario mentions alerts, logs, metrics, recovery, or business continuity, think Monitor plus Backup plus Service Health before you think deployment tooling.
Recommended 5-Week Study Plan
| Week | Focus | Primary resources |
|---|---|---|
| 1 | Prerequisites review, Azure admin tooling, Entra ID, RBAC, governance | AZ-104 prerequisites path, identities and governance path, Entra ID overview, RBAC overview |
| 2 | Storage accounts, access controls, redundancy, operational storage management | AZ-104 storage path, storage account overview, storage security docs |
| 3 | Virtual machines, App Service, deployment tooling, ARM/Bicep awareness | AZ-104 compute path, VM overview, App Service overview, ARM overview |
| 4 | VNets, NSGs, routing, hybrid connectivity, load balancing | AZ-104 networking path, VNet overview, NSG overview, VPN Gateway, ExpressRoute |
| 5 | Monitoring, backup, service health, mixed review, practice assessment | AZ-104 monitor and backup path, Azure Monitor overview, Azure Backup overview, Microsoft practice assessment |
Last-Mile Exam Strategy
- Study AZ-104 as an operations exam. The core skill is choosing the right administrative action under real Azure constraints.
- Use the Microsoft Learn learning paths as the spine of your preparation, then reinforce each domain with the linked Azure documentation overviews.
- Practice the scope model repeatedly: management groups, subscriptions, resource groups, resources, and RBAC scope questions show up everywhere.
- Treat networking and monitoring as first-class domains. Many candidates over-focus on compute and storage and lose points on hybrid connectivity, NSGs, alerts, and backup.
- Read every question for the real objective: access control, governance, durability, connectivity, operations, or recovery. That classification often gets you to the answer fast.
If you want exam-style reinforcement after the official docs, use our AZ-104 practice questions. If you need the Azure vocabulary underneath this exam, start with our Azure Fundamentals study guide. If you plan to move upward after AZ-104, it also pairs naturally with AZ-305 and AZ-500.
The fastest way to pass AZ-104 is to study it as a set of recurring operational decisions: who gets access, where resources live, how they connect, how data is protected, and how you monitor and recover the environment. Stay close to Microsoft's current Learn paths, and make sure every domain is strong enough to survive mixed scenario questions.