Microsoft Azure Administrator AZ-104 exam guide

Official exam facts on this page were verified against Microsoft Learn on 20 August 2026. Microsoft can update the exam, so always check the live AZ-104 study guide before booking.

Current exam snapshot

Certification: Microsoft Certified: Azure Administrator Associate
Exam: AZ-104: Microsoft Azure Administrator
Skills version: Skills measured as of 17 April 2026
Assessment time: 100 minutes
Passing score: 700 or greater on Microsoft's scaled score
Level: Intermediate
Renewal: The role-based certification renews every 12 months. Eligible holders can renew through a free online Microsoft Learn assessment.

Microsoft does not promise a fixed question count on the live certification page. The assessment can include interactive question types, so prepare to interpret configurations and complete administrative tasks—not only recall definitions.

Skills measured

1. Manage Azure identities and governance — 20–25%

You should be able to:

Create Microsoft Entra users and groups and manage their properties.
Manage licenses, external users, and self-service password reset.
Manage built-in Azure roles, assign roles at the correct scope, and interpret effective access.
Implement Azure Policy, resource locks, tags, resource groups, subscriptions, budgets, alerts, Azure Advisor cost recommendations, and management groups.

2. Implement and manage storage — 15–20%

You should be able to:

Configure storage firewalls, virtual-network access, SAS tokens, stored access policies, access keys, and identity-based access for Azure Files.
Create and configure storage accounts, redundancy, object replication, and encryption.
Move data with Azure Storage Explorer and AzCopy.
Configure Azure Files and Blob Storage, including tiers, snapshots, soft delete, lifecycle management, and blob versioning.

3. Deploy and manage Azure compute resources — 20–25%

You should be able to:

Interpret, modify, deploy, and export ARM templates and Bicep files, including conversion from ARM JSON to Bicep.
Create and manage virtual machines, sizes, disks, encryption at host, moves, availability zones, availability sets, and Virtual Machine Scale Sets.
Create and manage Azure Container Registry, Azure Container Instances, and Azure Container Apps, including sizing and scaling.
Provision App Service plans and apps and configure scaling, TLS certificates, custom domains, backup, networking, and deployment slots.

4. Implement and manage virtual networking — 15–20%

You should be able to:

Create virtual networks and subnets, configure peering, public IP addresses, and user-defined routes, and troubleshoot connectivity.
Configure NSGs and application security groups, evaluate effective security rules, implement Azure Bastion, and configure service and private endpoints.
Configure Azure DNS and internal or public Azure Load Balancer and troubleshoot load balancing.

5. Monitor and maintain Azure resources — 10–15%

You should be able to:

Interpret Azure Monitor metrics, configure log settings, and query and analyze logs.
Configure alert rules, action groups, alert processing rules, Azure Monitor Insights, Network Watcher, and Connection Monitor.
Create Recovery Services and Backup vaults, configure policies, perform backup and restore operations, and interpret backup reports and alerts.
Configure Azure Site Recovery and perform failover of Azure resources to a secondary region.

What changed in the current blueprint

Older AZ-104 material can be misleading. Use these freshness checks:

Use Microsoft Entra ID for the current product name. Older documentation and questions may say Azure Active Directory or Azure AD.
Prepare for both Bicep and ARM JSON. A guide that covers only ARM JSON is incomplete.
Current container objectives emphasize Azure Container Registry, Container Instances, and Container Apps. Do not substitute old AKS-heavy question banks for the published blueprint.
Monitoring questions should use current Azure Monitor collection and configuration patterns. Treat questions built around retired legacy monitoring agents as stale.
Basic Load Balancer and Basic SKU public IP legacy scenarios should not be used as current deployment guidance.
Give priority to the explicit task list above. A real Azure feature is not automatically an AZ-104 objective.

Official preparation resources

How to use this guide

Start with one diagnostic set. Map every miss to one of the five domains, then study the smallest Microsoft Learn module that closes that gap. Return to a new scenario question and explain why every distractor fails. When your domain scores are stable, move to timed simulations.

Continue with the AZ-104 practice-first study plan.

CloudCert is independent from Microsoft. Microsoft, Azure, and Microsoft Entra are trademarks of the Microsoft group of companies.