AZ-104 · Manage Azure identities and governance · Updated August 7, 2026
Microsoft Azure Administrator (AZ-104) Study Guide: Format, Domains, Cost, and How to Pass
Microsoft Azure Administrator (AZ-104) is the Associate-level certification that proves you can implement, manage, and monitor an organization’s Azure environment day to day: identities and governance, storage, compute, virtual networking, and monitoring. The exam runs 100 minutes, uses a 1,000-point scale with a pass mark of 700, and costs $165 USD through Pearson VUE. It assumes you’re already comfortable with operating systems, networking, servers, and virtualization, and that you have hands-on experience with PowerShell, the Azure CLI, the Azure portal, and Azure Resource Manager templates or Bicep files. This guide covers the exam format, all five domains with links to every topic you need, and a study plan that takes you from “I know Azure exists” to exam-ready.
What AZ-104 is and who it’s for
AZ-104 sits one level above Microsoft’s entry-level AZ-900 (Azure Fundamentals) exam, in Microsoft’s Associate tier alongside role-based certifications like Azure Security Engineer and Azure Solutions Architect Expert’s prerequisite path. Where AZ-900 tests vocabulary and recognition, AZ-104 tests configuration and hands-on judgment: given a scenario, can you pick the correct Azure feature, the correct CLI or PowerShell approach, and the correct setting, and can you explain why the plausible-looking wrong answer next to it is actually wrong.
Microsoft built this exam for people already doing the job, and the audience reflects that:
- IT administrators moving from on-premises infrastructure to Azure, who already understand servers, networking, and virtualization and need to map that knowledge onto Azure’s specific services and terminology.
- Azure administrators already doing the work, who want the credential to formalize skills they’ve picked up on the job and make that experience visible to employers or clients.
- Support and operations engineers who manage Azure resources day to day and need governance, monitoring, and troubleshooting depth beyond what AZ-900 covers.
- DevOps engineers and infrastructure engineers building toward the higher-level Expert certifications, for whom AZ-104 is the natural next step after AZ-900.
Microsoft states no formal prerequisites for registering, but the exam itself assumes real familiarity with Azure. Passing AZ-900 first isn’t required, but it removes a lot of vocabulary friction: concepts like the shared responsibility model, core service categories, and the resource hierarchy carry straight into AZ-104 rather than needing to be learned from scratch under exam pressure.
Exam format at a glance
| Attribute | Detail |
|---|---|
| Exam code | AZ-104 |
| Questions | Typically 40 to 60, subject to change |
| Time limit | 100 minutes |
| Question types | Multiple choice, drag and drop, hot area, build list, active screen, and case studies |
| Passing score | 700 on a scale of 1 to 1,000 |
| Scoring model | Compensatory across the exam, no separate pass/fail per domain |
| Cost | $165 USD (varies by country/region) |
| Delivery | Pearson VUE, online proctored or test center |
| Prerequisites | None formally required; hands-on Azure administration experience strongly assumed |
Microsoft doesn’t publish the exact mix of question formats in advance, but its own exam duration and exam experience guidance confirms that Associate-level, role-based exams like AZ-104 can include interactive item types beyond straight multiple choice: drag and drop, hot area (click the correct spot on a diagram or screenshot), build list (put items in the right order), active screen (interact with a simulated portal or settings screen), and case studies (a shared scenario with several questions attached). During the exam you also get limited access to Microsoft Learn documentation for questions that describe a lookup task, though the clock keeps running while you use it, so it’s a safety net, not a shortcut.
The five AZ-104 domains
Microsoft’s official AZ-104 study guide (skills measured as of April 17, 2026) breaks the exam into five weighted domains:
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 25% |
| Implement and manage storage | 18% |
| Deploy and manage Azure compute resources | 25% |
| Implement and manage virtual networking | 18% |
| Monitor and maintain Azure resources | 14% |
Domain 1: Manage Azure identities and governance (25%)
This domain covers Microsoft Entra ID user and group management, Azure RBAC, and the governance tools that keep a growing Azure environment under control.
- Azure RBAC roles explained: Owner, Contributor, Reader, User Access Administrator, Role Based Access Control Administrator, and how Privileged Identity Management (PIM) eligible and active assignments fit in.
- Azure Policy vs Azure RBAC: who can do what (RBAC) versus what state a resource must be in regardless of who created it (Policy).
- Azure management groups, subscriptions, and resource groups: the resource hierarchy, how role assignments and policies inherit down it, and why a resource group isn’t part of the management group tree.
- Azure resource locks: CanNotDelete vs ReadOnly: what each lock type blocks, how inheritance works, and the control-plane-only scope that trips people up.
Domain 2: Implement and manage storage (18%)
This domain covers securing and configuring Azure Storage accounts, and choosing between Azure Files and Blob Storage for a given workload.
- Azure Storage redundancy options: LRS, ZRS, GRS, GZRS, and their read-access variants, with durability figures and failover behavior.
- Shared Access Signatures (SAS) explained: account SAS vs service SAS vs user delegation SAS, and why Microsoft now recommends the Entra-signed user delegation SAS.
- Azure Blob Storage access tiers: Hot, Cool, Cold, and Archive, minimum retention periods, and rehydration priority.
- Azure Files vs Blob Storage: when you need a file share versus object storage, and how Azure File Sync bridges to on-premises.
Domain 3: Deploy and manage Azure compute resources (25%)
The largest domain by weight, covering infrastructure as code, virtual machines, containers, and App Service.
- ARM templates vs Bicep: why Bicep is now Microsoft’s recommended authoring language, deployment modes, and why deployment stacks are replacing Complete mode.
- Availability Sets vs Availability Zones: fault and update domains within a datacenter versus physically separate datacenters, and how VM Scale Sets fit in.
- Azure Disk Encryption vs Encryption at Host: the in-guest option Microsoft is retiring versus the host-level option it’s steering customers toward.
- ACI vs Container Apps vs AKS: when a single container group is enough, when you need managed autoscaling without a cluster, and when you need full Kubernetes control.
- App Service deployment slots explained: how slot swapping works, sticky versus swapped settings, and the tier requirement to use slots at all.
Domain 4: Implement and manage virtual networking (18%)
This domain covers building and securing Azure virtual networks and directing traffic to the right backend.
- Azure VNet peering explained: how peering works, why it’s non-transitive, and how a hub NVA with UDRs works around that limitation.
- NSG vs Azure Firewall vs Azure Bastion: layered network security, from subnet-level filtering to centralized firewalling to removing public IPs from management VMs entirely.
- Azure Load Balancer vs Application Gateway vs Traffic Manager: Layer 4 versus Layer 7, regional versus global, and DNS-based versus edge-terminated routing.
Domain 5: Monitor and maintain Azure resources (14%)
The smallest domain by weight but a frequent source of exam scenarios about how to observe and protect what you’ve built.
- Azure Monitor metrics vs logs: numeric time-series data versus queryable structured logs, and how Data Collection Rules and the Azure Monitor Agent tie them together.
- Azure Backup vs Azure Site Recovery: point-in-time data protection versus regional disaster recovery, and which vault type each one uses.
How AZ-104 is different from AZ-900
If you’ve already passed AZ-900, a lot of the conceptual scaffolding, like the shared responsibility model, core service categories, and basic governance vocabulary, carries forward directly. What changes is depth and format: AZ-104 expects you to know specific CLI commands, specific portal navigation paths, specific numeric limits (how many tags a resource can carry, how many management group levels are allowed, how long a SAS token’s underlying key stays valid), and to reason through multi-step scenarios rather than recall a single fact. Case studies and active-screen questions in particular test whether you can apply several pieces of knowledge together under a single, extended scenario, not just recite a definition in isolation.
Study plan
A realistic path to exam-ready, assuming some prior IT background:
- Get hands-on with a free or pay-as-you-go Azure subscription. Reading about a resource lock or a peering configuration is not the same as creating one, breaking it, and fixing it. Budget time to actually build the resources each domain covers.
- Work through each domain in order of weight, starting with identities and governance and compute (25% each), then storage and networking (18% each), then monitoring (14%). Heavier domains deserve more study time, but don’t skip monitoring: it’s a compact domain with concentrated, specific facts that are easy points once you know them.
- Drill the comparisons, not just the definitions. AZ-104 constantly tests “which of these two similar-looking options is correct for this scenario”: Availability Sets vs Zones, ARM Complete mode vs deployment stacks, Load Balancer vs Application Gateway. Comparison-style study, exactly what this Study Library is built around, targets that directly.
- Practice with scenario-based questions and explanations, not flashcards alone. Recall gets you through definitions; explanations that walk through why each wrong answer fails are what get you through the scenario questions that make up most of the exam.
- Track your readiness by domain, not just an overall score. A high overall percentage can still hide a weak domain if it’s a small one, and Compute and Governance together are half the exam.
Frequently asked questions
Do I need to pass AZ-900 first? No, it’s not a prerequisite, but it helps if you’re new to Azure. AZ-900 covers the cloud fundamentals that AZ-104 assumes you already know.
How many questions are on the AZ-104 exam? Microsoft doesn’t guarantee an exact number and it can change, but most Associate-level exams run roughly 40 to 60 questions in the allotted time.
What’s the passing score? 700 out of 1,000. Microsoft doesn’t publish exactly how many questions that translates to, since some question types and difficulty levels carry different weight.
How long is the AZ-104 certification valid? Microsoft’s Associate certifications expire after 12 months but can be renewed for free through a short online assessment on Microsoft Learn before the expiration date.
Is this exam only about the Azure portal? No. AZ-104 explicitly tests PowerShell, the Azure CLI, and ARM/Bicep template deployment alongside the portal, so comfort with at least one command-line approach matters for exam day.