Azure AZ-104 Exam Topics Explained with a Study Plan

The AZ-104 exam tests whether you can administer Azure identities, storage, compute, virtual networks, governance, monitoring and recovery. Preparation should combine Microsoft documentation with repeated portal, Azure CLI and PowerShell labs rather than relying only on theory.

Microsoft can revise the skills measured and domain weightings. Check the current official AZ-104 study guide before booking the exam, then use the following breakdown to organise your practical preparation.

What are the main AZ-104 exam topics?

The AZ-104 exam topics are organised into five broad domains covering identity and governance, storage, compute, networking, and monitoring. Identity, governance and compute generally receive significant attention, but every domain requires practical knowledge because administration tasks often combine multiple services.

The percentages are planning guides, not permission to skip a smaller domain. A storage problem, for example, may also test networking, identity and monitoring.

What must you learn about Azure identities and governance?

You must understand how identities receive access and how administrators control resources across management groups, subscriptions and resource groups. Focus on Microsoft Entra ID administration, Azure role-based access control, Azure Policy, tags, locks and cost-management features.

Microsoft Entra ID and RBAC

Know how to manage users, groups, external identities and licences. You should distinguish a Microsoft Entra role, which controls directory tasks, from an Azure RBAC role, which controls Azure resources.

A useful diagram in words is:

Tenant
└── Management group
    └── Subscription
        └── Resource group
            └── Virtual machine

An RBAC assignment applied at the subscription is inherited by its resource groups and resources. A resource-level assignment has a narrower scope.

Use Azure CLI to inspect and create role assignments:

az role assignment list \
  --resource-group rg-az104-lab \
  --output table

az role assignment create \
  --assignee user1@contoso.com \
  --role Reader \
  --resource-group rg-az104-lab

Understand the three parts of an assignment: security principal, role definition and scope. Also learn built-in roles such as Owner, Contributor, Reader, User Access Administrator and service-specific data roles.

Governance controls

Azure Policy evaluates whether resources meet defined rules. An initiative groups multiple policy definitions, while remediation can correct some non-compliant resources when the policy effect supports it.

Compare the common controls:

Practise moving resources between resource groups and subscriptions, checking quotas, applying tags, and identifying the effect of CanNotDelete and ReadOnly locks.

Which Azure storage skills does AZ-104 test?

The storage domain tests your ability to select, secure and operate storage services. You should configure storage accounts, Blob containers, Azure Files, access methods, redundancy, lifecycle policies and data movement tools.

Know the operational differences between locally redundant, zone-redundant, geo-redundant and geo-zone-redundant storage. The correct choice depends on regional availability, replication requirements, supported account type and cost constraints.

Storage security and access

Practise these access methods:

• Microsoft Entra ID with Azure RBAC
• Storage account access keys
• Shared access signatures, including service and account SAS
• Stored access policies where supported
• Managed identities for Azure workloads

A SAS grants delegated access for a defined resource, permission and time period. It should not be treated as a permanent credential.

Create a storage account and container with Azure CLI:

az group create --name rg-az104-lab --location centralindia

az storage account create \
  --name staz104lab001 \
  --resource-group rg-az104-lab \
  --location centralindia \
  --sku Standard_LRS \
  --kind StorageV2

az storage container create \
  --name reports \
  --account-name staz104lab001 \
  --auth-mode login

Also practise storage firewalls, private endpoints, soft delete, versioning, Blob access tiers, lifecycle rules, Azure File Sync and AzCopy. When a client cannot access a storage account, verify both authorisation and the network path; a valid role assignment does not bypass a storage firewall.

Which compute services should you practise?

AZ-104 compute preparation should cover virtual machines, availability, automation, Azure Container Instances, Azure Container Apps and Azure App Service. You need to deploy resources and modify their networking, disks, sizing, scaling and availability settings.

Virtual machines and availability

Understand VM images, sizes, OS and data disks, managed disk types, snapshots, extensions and boot diagnostics. Know the difference between availability sets, availability zones and Virtual Machine Scale Sets.

The deployment path can be pictured as:

Resource group
└── Virtual network and subnet
    ├── Network security group
    └── Network interface
        └── Virtual machine
            ├── OS disk
            └── Data disk

Create a basic Linux VM:

az vm create \
  --resource-group rg-az104-lab \
  --name vm-web-01 \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --admin-username azureadmin \
  --generate-ssh-keys

az vm get-instance-view \
  --resource-group rg-az104-lab \
  --name vm-web-01 \
  --query instanceView.statuses \
  --output table

Learn the difference between stopping a VM inside the guest operating system and deallocating it in Azure. Deallocation releases the compute allocation, although attached storage and some other resources can continue to incur charges.

App Service, containers and deployment automation

For App Service, study plans, deployment slots, scaling, custom domains, TLS, backups and application settings. For containers, understand when to use a lightweight container service instead of maintaining a full VM.

You should also be able to read and deploy ARM or Bicep templates. Pay attention to parameters, dependencies, resource IDs and deployment scope. Infrastructure templates are especially useful because a failed deployment can be reproduced and corrected consistently.

Students who want guided portal and command-line labs can review the Microsoft Azure AZ-104 course. The course path should support hands-on administration rather than replacing personal revision.

How much networking is required for AZ-104?

You need enough Azure networking knowledge to build connectivity, control traffic and isolate faults. Core tasks include subnet design, network security groups, route tables, VNet peering, DNS, private access, load balancing and Network Watcher.

Do not treat an NSG as a traditional stateful appliance with application-level inspection. It filters traffic using source, destination, port, protocol and direction, while Azure Firewall provides broader centralised firewall capabilities.

Create a VNet, subnet and NSG:

az network vnet create \
  --resource-group rg-az104-lab \
  --name vnet-hub \
  --address-prefix 10.10.0.0/16 \
  --subnet-name snet-web \
  --subnet-prefix 10.10.1.0/24

az network nsg create \
  --resource-group rg-az104-lab \
  --name nsg-web

az network nsg rule create \
  --resource-group rg-az104-lab \
  --nsg-name nsg-web \
  --name Allow-HTTPS \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-ranges 443

Remember that creating an NSG does not filter a subnet or network interface until the NSG is associated with it. Also check default NSG rules, effective security rules and effective routes during troubleshooting.

Learn the roles of Azure Load Balancer, Application Gateway and Traffic Manager. Load Balancer handles Layer 4 TCP and UDP distribution, Application Gateway provides Layer 7 web traffic features, and Traffic Manager uses DNS-based endpoint selection.

If IP addressing, subnetting and routing are unfamiliar, a structured CCNA course can provide the networking foundation needed for cloud administration.

What monitoring and recovery tasks appear in AZ-104?

This domain tests whether you can observe resource health, investigate performance and recover protected workloads. Study Azure Monitor metrics, Log Analytics, alerts, action groups, diagnostic settings, Network Watcher, Azure Backup and recovery services vaults.

Metrics are numerical time-series values such as CPU percentage. Logs are structured records that can be queried, while an alert rule evaluates data and can notify or trigger an action group.

A basic monitoring flow is:

Azure resource
├── Platform metrics ──> Azure Monitor ──> Alert rule ──> Action group
└── Diagnostic logs ──> Log Analytics workspace ──> KQL query

Practise a simple Kusto Query Language query:

AzureActivity
| where TimeGenerated > ago(24h)
| project TimeGenerated, ResourceGroup, OperationNameValue, ActivityStatusValue
| order by TimeGenerated desc

For backup, understand policies, vaults, restore points, soft delete and restore operations. Do not assume that high availability is a backup; availability keeps a service running through some failures, while backup provides recoverable copies for incidents such as deletion or corruption.

How should you troubleshoot an AZ-104 lab problem?

Use a layered method: confirm the resource state, identity, configuration, network path and logs before changing anything. Random changes can hide the original cause and make an exam scenario harder to interpret.

Consider a VM that is running but cannot be reached through SSH:

1. Confirm the VM power state with az vm get-instance-view.
2. Check whether the VM has the expected private or public IP address.
3. Review the NSG associated with both the subnet and network interface.
4. Inspect effective NSG rules for an inbound TCP 22 allow rule.
5. Check effective routes for an unexpected user-defined route.
6. Use Network Watcher IP flow verify or connection troubleshoot.
7. Review boot diagnostics and the guest firewall if the Azure path is open.

Useful discovery commands include:

az vm show \
  --resource-group rg-az104-lab \
  --name vm-web-01 \
  --show-details \
  --output table

az network nic list-effective-nsg \
  --resource-group rg-az104-lab \
  --name vm-web-01VMNic \
  --output json

az network nic show-effective-route-table \
  --resource-group rg-az104-lab \
  --name vm-web-01VMNic \
  --output table

The automatically generated network interface name can differ, so list the resource group's interfaces before running NIC-specific commands. In the exam and in real administration, verify names and scope rather than assuming defaults.

What is a practical eight-week AZ-104 study plan?

An eight-week plan gives each domain dedicated lab time and leaves room for revision. Adjust the schedule to your existing Azure experience, but keep the sequence because later labs depend on identity, resource and networking foundations.

Use a repeatable daily session:

• Read one objective from the official study guide.
• Build the feature in the Azure portal.
• Repeat the task with Azure CLI or PowerShell.
• Break one setting deliberately and troubleshoot it.
• Record the commands, errors and correction in a lab journal.

For the capstone, deploy a two-tier environment with a web subnet, management subnet, NSGs, a load-balanced compute tier, secured storage, managed identity, diagnostic settings and an alert. Apply tags and a resource lock, verify effective routes, then remove the lab resources to avoid leaving unnecessary services running.

How can you avoid common AZ-104 preparation mistakes?

The main mistake is memorising portal screens without understanding resource relationships. Azure interfaces change, but concepts such as scope, inheritance, effective permissions, routes and dependencies remain important.

Avoid these problems:

• Studying only definitions without deploying resources
• Ignoring PowerShell, Azure CLI and template syntax
• Confusing control-plane roles with storage data-plane roles
• Assuming an RBAC change is always visible immediately
• Forgetting NSG association, route precedence or DNS resolution
• Reading an answer before attempting to diagnose the lab
• Leaving paid resources running after practice
• Using outdated practice questions instead of the current skills outline

Cross-cloud learners can compare Azure design choices with the AWS Solutions Architect course, but should learn Azure service names and behaviour directly rather than forcing one-to-one service mappings.

Summary

The AZ-104 exam covers the daily responsibilities of an Azure administrator: controlling access, governing resources, operating storage and compute, building network connectivity, monitoring services and recovering workloads. The strongest preparation method is to map every current exam objective to at least one completed lab and one troubleshooting exercise.

Keep commands and screenshots as evidence of practice, repeat failed tasks, and revise weak domains based on lab results rather than guesswork.

Reviewed by Network Rhinos cloud trainers.

For guided labs, revision support and current batch details, enquire about the Microsoft Azure AZ-104 course.

Related reading: AWS Well-Architected Basics: Reliability, Cost and Security