Skip to main content
This lesson reviews the AZ-104: Microsoft Azure Administrator exam objectives and the core domains you should study. The AZ-104 assesses practical skills for managing Azure subscriptions, resources, identities, storage, compute, networking, and monitoring. Below are the five main domains and their approximate exam weightings:
  • Manage Azure identities and governance (20–25%)
  • Implement and manage storage (15–20%)
  • Deploy and manage Azure compute resources (20–25%)
  • Implement and maintain virtual networking (15–20%)
  • Monitor and maintain Azure resources (10–15%)
Use this guide as a structured study outline. Each domain includes the key subtopics you must know and suggested focus areas. Summary table — AZ-104 domains and focus areas Manage Azure Identities and Governance (20–25%)
  • Administer identity: Microsoft Entra ID (formerly Azure AD), user and group management, authentication methods (password hash sync, pass-through auth, MFA, conditional access).
  • Administer governance and compliance: management groups, subscriptions, Azure Policy, initiatives, role-based access control (RBAC), resource locks and tags.
  • Automate and manage resources: ARM templates, Bicep, Azure CLI, Azure PowerShell, and automation runbooks for deployment and configuration management.
A slide titled "AZ-104 Certification: Topics" showing a central blue box for "Manage Azure identities and governance (20–25%)" and a list of other colored boxes for exam domains like implement/manage storage, deploy/manage compute resources, implement/maintain virtual networking, and monitor/maintain Azure resources.
Implement and Manage Storage (15–20%)
  • Administer Azure Storage: create and configure storage accounts, manage blob containers and access tiers (Hot, Cool, Archive), Azure Files and Azure File Sync, queues and table storage.
  • Security and access: shared access signatures (SAS), RBAC for storage, encryption at-rest and in-transit, and managed identities for service access.
  • Resiliency and redundancy: locally redundant storage (LRS), zone-redundant storage (ZRS), geo-redundant (GRS) and read-access geo-redundant storage (RA-GRS).
Deploy and Manage Azure Compute Resources (20–25%)
  • Virtual Machines: provisioning VMs, selecting sizes, attaching and configuring managed disks, using availability sets vs. availability zones, extensions, VM scale sets, and backup/restore strategies.
  • Platform-as-a-Service (PaaS) and containers: App Service (web apps), Azure Container Instances, Container Apps, and other platform compute options relevant for the administrator role.
  • Note: Azure Kubernetes Service (AKS) is excluded from the AZ-104 exam scope; focus on the PaaS/container options above.
Slide titled "AZ-104 Certification: Topics" listing key exam areas. A large green box highlights "Deploy and manage Azure compute resources (20–25%)" and colored side boxes list identities & governance, storage, virtual networking, and monitoring Azure resources.
Implement and Maintain Virtual Networking (15–20%)
  • Administer virtual networking: design and configure VNets, subnets, Network Security Groups (NSGs), private and public IP addresses, and Azure DNS.
  • Intersite connectivity: VNet peering, ExpressRoute basics, and VPN Gateway — know when to use each. VPN Gateway is included for familiarity but not deep specialization.
  • Network traffic and routing: load balancers (public/private), Application Gateway basics, Azure Firewall, route tables and user-defined routes (UDRs), and troubleshooting connectivity.
Slide titled "AZ-104 Certification: Topics" with a purple highlight for "Implement and manage virtual networking (15–20%)" and subitems like administer virtual networking, intersite connectivity, and network traffic. Colorful side boxes show other domains: identities and governance, storage, compute resources, and monitoring.
Monitor and Maintain Azure Resources (10–15%)
  • Data protection and recovery: Azure Backup, Azure Site Recovery — plan backups, retention, and restore procedures.
  • Monitoring and observability: Azure Monitor, Log Analytics workspace configuration, diagnostic settings, metrics, alerts, Activity Log, and troubleshooting with Network Watcher and Service Health.
  • Operational tasks: resource tagging strategies, cost management basics, and updating or patching virtual machines and platform services.
A slide titled "AZ-104 Certification: Topics" with buttons labeled "Service name changes" and "Additional Resources." Below is a boxed bullet list of resources including Microsoft Learn, Azure Documentation, Channel 9, Azure Tuesdays, and Azure Fridays.
Service name changes
  • Important: Azure Active Directory is now called Microsoft Entra ID. This is a branding update — functionality and concepts remain the same across the platform.
Warning: Microsoft Entra ID is the new name for Azure AD. Update any study notes, scripts, or search queries to use “Microsoft Entra ID” to find the latest documentation and portal references.
Tip: AKS-related content is out of scope for AZ-104. Concentrate study time on VMs, App Service, Container Instances, networking, storage, identity, and monitoring for the Administrator role.
Additional resources Study tips
  • Map each AZ-104 objective to hands-on labs: create resources in a sandbox subscription to reinforce concepts (VNets, storage tiers, VM backups, role assignments).
  • Practice common admin tasks with Azure CLI and Azure PowerShell to build command-line fluency.
  • Use Log Analytics and Azure Monitor in a live environment to understand diagnostic logs, metrics, and alerting workflows.
  • Review exam weighting to prioritize study time by domain percentages.
That covers the AZ-104 exam domains and core topics to study. Let’s begin the lesson.

Watch Video