Study Guide Microsoft

AZ-104: What the Exam Actually Tests (and What to Skip)

Tech Professionals 10 views
AZ-104: What the Exam Actually Tests (and What to Skip)
Identities and compute are nearly half the AZ-104 exam — and Microsoft tests decisions, not memorized portal clicks. Here's what each of the five domains actually grades you on, the question formats that eat the clock, and what to skip so your study hours go where the points are.

Most people study for AZ-104 the way you'd study for a driving test by memorizing the dashboard. They click through the portal, learn where every blade lives, and walk into the exam ready to find things. Then Microsoft asks them to decide things — which role at which scope, which redundancy for this scenario, which compute service for that workload — and the portal knowledge turns out to be worth very little.

The AZ-104 (Azure Administrator Associate) grades admin judgment, not navigation. Microsoft publishes the five measured domains and their weights, and the weights tell you exactly where judgment gets tested:

  • Manage Azure identities and governance — 20–25%
  • Implement and manage storage — 15–20%
  • Deploy and manage Azure compute resources — 20–25%
  • Implement and manage virtual networking — 15–20%
  • Monitor and maintain Azure resources — 10–15%

Two domains — identities/governance and compute — can be nearly half your exam. Study accordingly. Here is what each domain actually tests, and just as importantly, what you can safely skip.

The Two Domains That Decide Your Result

Identities and governance: the RBAC questions are scenario questions

This is the domain people underestimate because it looks like vocabulary: Entra ID users, groups, roles, policies, locks, tags. On the exam it is scenarios: a support engineer needs to restart virtual machines in one resource group but must not touch anything else in the subscription. Which built-in role, assigned at which scope, does that with least privilege?

To answer those, you need the mechanics, not the definitions:

  • Role assignment resolution. A user with Reader at the subscription and Contributor on one resource group — what can they actually do? Effective access is the union of assignments, deny assignments override everything, and the exam loves stacking assignments at different scopes to test exactly that.
  • The built-in roles, precisely. Owner, Contributor, Reader, and User Access Administrator will appear side by side in the answers. Know exactly what separates Contributor from User Access Administrator — one manages resources, the other manages access.
  • Governance as decisions. Management groups and subscription design for policy inheritance. Azure Policy effects — deny, audit, append, modify — and when each applies. Resource locks: CanNotDelete versus ReadOnly, and what breaks when you lock a resource group that contains a running workload.

RBAC and policy also underpin storage and networking — private endpoints and storage firewalls sit behind access-control decisions.

Compute: choose the service, then defend the choice

The compute domain tests selection and trade-offs. It does not ask you to recite VM sizes. It asks which configuration survives a rack failure, which deployment repeats reliably, which app service plan fits unpredictable traffic.

  • Availability. Zones versus sets versus scale sets — know which failure each one protects against and when each is the right answer. The distractors mix them on purpose: surviving a datacenter outage and surviving a host failure have different answers.
  • Moving and managing VMs. Moving VMs across resource groups, subscriptions, or regions — what moves with the VM, what does not, and how availability is affected.
  • App Service and containers. Plan tiers and what scaling actually requires. Deployment slots and when to swap. Container Instances versus Container Apps versus App Service — the exam wants the decision logic, not feature lists.
  • ARM templates and Bicep. The tested skill is interpreting and modifying templates and deploying them — not authoring hundred-line templates from memory. Spot the one parameter that changes the outcome.

If you can pick the compute service for a workload and defend the choice, you are ready for this domain. If you can only list the services, you are not.

Storage and Networking: The Scenario Domains

Storage is about access and durability decisions

Storage questions are almost always framed as constraints — survive a regional outage, keep finance data off the public internet, give a partner temporary access to one container. The answers live in a small set of mechanisms:

  • Durability and lifecycle: redundancy options (LRS, ZRS, GRS) chosen by scenario — know which survives what. Tiers, lifecycle management rules, soft delete, snapshots, versioning: the "cut cost, keep it recoverable" questions.
  • Access and movement: account keys and rotation, shared access signatures and stored access policies, identity-based access for Azure Files. SAS questions are favorites because they combine a time window, a permission set, and a scope — miss any one and the answer is wrong. Storage firewalls, service endpoints versus private endpoints, and AzCopy/Storage Explorer for moving data.

Networking is about tracing what actually happens

Networking questions trace a packet or a connection through your configuration and ask what actually happens — memorized diagrams will not save you:

  • Effective security rules. Multiple NSGs and application security groups on a NIC and a subnet — which rule wins for this traffic? Learn to evaluate the effective set, not to recite rule syntax.
  • Connectivity design. VNet peering including gateway transit, user-defined routes that override system routes, VPN gateways for hybrid. The classic trap: peering is configured but traffic fails because the route table or the NSG was not considered.
  • Private access and DNS. Service endpoints versus private endpoints — know the security difference cold, because the exam asks it in storage, database, and networking clothing. Private DNS zones for internal resolution, public versus internal load balancers, Azure Bastion for secure VM access, Network Watcher for diagnosing the mess when something breaks.

For both storage and networking, the winning study method is the same: build the scenario in a free-tier subscription, break it, and fix it. Reading about effective NSG rules is forgettable. Debugging why your peered VNet cannot reach the storage account is not.

Monitoring: Small Domain, Don't Skip It

At 10–15% this is the lightest domain — easy to skip, which is exactly why it is cheap points. The questions are decision-shaped:

  • Metrics versus logs. Which answers "is it healthy right now" and which answers "why did it fail last Tuesday"? Know where each lives and how Log Analytics queries them.
  • Alerts that matter. Alert rule anatomy: the signal, the condition, and the action group. The exam asks you to design an alert that fires when it should and stays quiet otherwise — which means understanding aggregation and thresholds, not just the alert blade.
  • Backup and recovery. Recovery Services vaults, backup policies and retention, Azure Site Recovery for failover. The questions test whether you know what is protected and how it restores, not the backup wizard steps.

You do not need deep KQL fluency. You need to read a basic Log Analytics query and know what it returns, and to make the monitoring decision the scenario demands.

What to Skip

Study time is finite and the weights are public, so cut ruthlessly:

  • Authoring long ARM templates from memory. Interpret, modify, deploy — that is the tested skill. Time spent memorizing template schema is time stolen from RBAC.
  • Every SKU table and price number. The exam tests decision logic (which tier fits this workload), not price lists. If you know why you would pick Premium over Standard storage, you do not need the per-gigabyte figure.
  • AZ-900-level definitions. The exam assumes you know what a resource group, a subscription, and a virtual network are. If you are still learning those, take AZ-900 first — do not burn AZ-104 study weeks on them.
  • Deep command-line parameter memorization. Recognize what az vm create and New-AzVM do and when the CLI versus PowerShell fits; do not memorize every flag.
  • Brand-new preview features and obscure services. The exam tests the stable, mainstream services administrators actually manage.

How the Questions Eat Your Clock

The format matters as much as the content. Expect 40–60 questions in about 100 minutes — roughly two minutes per question if you pace evenly — including multiple choice, drag-and-drop sequencing, build lists, hot-area selections, and case studies.

The case studies are the time trap: a multi-paragraph company scenario followed by a run of linked questions. They reward careful reading and punish skimming, so budget for them deliberately. The drag-and-drop ordering questions give no partial credit — one step out of place loses the whole question — which is why practicing the sequence of operations matters more than knowing the operations exist.

The only way to learn pacing is timed practice. Full-length sets, one sitting, no pausing to look things up. That is where you discover that reading a scenario carefully is faster than re-reading it twice.

The Bottom Line

AZ-104 is a decisions exam wearing an administrator's uniform. Identities and compute are nearly half of it. Storage and networking are scenario puzzles built on a small set of mechanisms. Monitoring is light but not skippable. And the portal tour — where every blade lives, every SKU costs — is the thing to stop studying.

Stop studying the portal. Start making decisions. Take a free AZ-104 practice test with exam-style questions and instant feedback — no signup, start now — and gauge your readiness against the same scenario-style questions the exam uses. The exam page carries the full AZ-104 set with 813 Q&As at https://study4pass.com/study-material/microsoft/az-104. Walk in ready on exam day.