Microsoft Certified: Azure Administrator Associate (AZ-104) is the Associate-level certification for administrators who build and operate Azure environments themselves. It goes beyond explaining concepts and asks what you have to configure, and how, to satisfy a given requirement, so hands-on experience with resources in the portal and the CLI is what decides the result.
This post is the guide to our 16-part AZ-104 domain deep-dive series. Before getting into individual topics, it maps out the exam structure, who should take it, and where this certification sits on the Azure career path.
---
Who Is AZ-104 For?
If AZ-900 is about reading the subway map, AZ-104 is about driving the train. You have to be able to actually segment a virtual network, restrict access to storage, and put a backup policy in place.
This certification is a particularly good fit for the following people.
| Target Audience | Why It Fits | |------|------| | Azure operations and infrastructure engineers | Formal validation of day-to-day work such as managing VMs, storage, networks, and identities | | On-premises systems and network administrators | A reference point for carrying existing operations experience over to Azure | | AZ-900 holders | The next step from understanding concepts to actually configuring and operating | | DevOps and platform engineers | A prerequisite certification you can use toward AZ-400 (DevOps Engineer Expert) | | Aspiring solutions architects | The prerequisite certification required for AZ-305 (Solutions Architect Expert) |
There is no prerequisite certification, so you can sit AZ-104 without AZ-900. Microsoft does assume, however, that candidates are familiar with operating systems, networking, servers, and virtualization, and have worked with PowerShell, Azure CLI, the Azure portal, ARM templates or Bicep, and Microsoft Entra ID. The certification must be renewed every year, but you can do that with a free online assessment on Microsoft Learn instead of retaking the exam.
---
Exam at a Glance
| Item | Detail | |------|------| | Exam Code | AZ-104 | | Full Name | Microsoft Certified: Azure Administrator Associate | | Level | Associate (intermediate) | | Passing Score | 700 (out of 1,000) | | Duration | 100 minutes (120 minutes of seat time including instructions and agreements) | | Questions | Varies (Microsoft does not publish an exact question count) | | Exam Fee | Varies by country ($165 USD in the United States) | | Validity | 1 year (renewed through a free online assessment on Microsoft Learn) | | Languages | 10 languages, including English | | Delivery | Pearson VUE test center or online proctored exam | | Prerequisites | None (knowledge of operating systems, networking, and virtualization plus Azure operations experience recommended) |
One hundred minutes sounds generous, but time goes quickly on questions where you have to reason through the order of configuration steps or the result of a setup. Mark confusing questions for review, move on, and come back. If you fail, you can retake the exam after 24 hours; every attempt after that requires a 14-day wait, with a maximum of five attempts in a 12-month period.
---
Domain Breakdown
AZ-104 is made up of five domains, and the weight of each is published as a range. The breakdown below follows the official skills outline as revised on April 17, 2026.
| Domain | Topic | Weight | Deep dives | |------|------|------|------| | Domain 1 | Manage Azure identities and governance | 20–25% | 4 posts | | Domain 2 | Implement and manage storage | 15–20% | 2 posts | | Domain 3 | Deploy and manage Azure compute resources | 20–25% | 5 posts | | Domain 4 | Implement and manage virtual networking | 15–20% | 3 posts | | Domain 5 | Monitor and maintain Azure resources | 10–15% | 2 posts |
Domain 1 (identities and governance) and Domain 3 (compute) carry the most weight at 20–25% each, followed by storage and networking at 15–20%. The five domains are fairly evenly split, so going deep on only one area will not get you through. Networking in particular is full of things you only understand by configuring them yourself, such as NSG rule evaluation and routing, so budget plenty of lab time for it.
!AZ-104 exam domain weight breakdown across 5 domains
Domain 1: Manage Azure identities and governance (20–25%)
This domain covers who can do what, and how the organization's rules are enforced.
Key topics: Managing Microsoft Entra users, groups, and licenses; external users; self-service password reset (SSPR); built-in roles and role assignment at different scopes; Azure Policy; resource locks; tags; management groups, subscriptions, and resource groups; managing costs with budgets and alerts.
Exam tip: Role assignments are inherited from management group → subscription → resource group → resource. For a requirement like "let them manage VMs in one resource group only," assign Virtual Machine Contributor at that resource group scope: choose the narrowest scope and the smallest set of permissions that does the job.
Related posts: Identity and Governance, Entra User and Group Management in Practice, Reading Azure RBAC Role Assignments, Governance Hierarchy and Cost Management
Domain 2: Implement and manage storage (15–20%)
This domain covers creating storage accounts, controlling access to them, and protecting the data in them.
Key topics: Storage firewalls and virtual networks; SAS tokens and stored access policies; access keys; identity-based access for Azure Files; redundancy options and object replication; encryption; Storage Explorer and AzCopy; access tiers; soft delete, snapshots, and versioning; blob lifecycle management.
Exam tip: "Give an outside party temporary access with limited time and permissions" → SAS token. "We must be able to revoke already-issued SAS tokens all at once" → issue them against a stored access policy. "Automatically move blobs to a cheaper tier after a set period" → lifecycle management.
Related posts: Storage Management Complete Guide, Storage Access and Security Explained
Domain 3: Deploy and manage Azure compute resources (20–25%)
This domain covers deploying and operating virtual machines, containers, and App Service, and automating that work with templates.
Key topics: Reading, modifying, and deploying ARM templates and Bicep files; creating VMs and managing sizes and disks; encryption at host; availability zones and availability sets; Virtual Machine Scale Sets; Azure Container Registry, Container Instances, and Container Apps; App Service plans and scaling; TLS and custom domains; deployment slots.
Exam tip: "It has to survive the failure of an entire datacenter" → availability zones. "Protect against rack failures and planned maintenance within one datacenter" → availability sets. "Automatically add and remove identical VMs as load changes" → Virtual Machine Scale Sets.
Related posts: Virtual Machines and Deployment Automation, VM Operations: Resizing, Disks, Encryption at Host, and Moving VMs, How to Read ARM Templates and Bicep Files, Mastering Azure Containers and App Service, App Service Operations: Plans, Scaling, Domains, TLS, and Backup
Domain 4: Implement and manage virtual networking (15–20%)
This domain covers designing virtual networks, controlling traffic, and configuring name resolution and load balancing.
Key topics: Virtual networks and subnets; peering; public IP addresses; user-defined routes; NSGs and application security groups; evaluating effective security rules; Azure Bastion; service endpoints and private endpoints; Azure DNS; internal and public load balancers.
Exam tip: NSG rules are evaluated from the lowest priority number up, and evaluation stops at the first match. "Reach a PaaS service through a private IP in the virtual network" → private endpoint. "Keep the service's public endpoint but allow traffic only from specific subnets" → service endpoint.
Related posts: VNet, NSG, DNS, and Load Balancer Explained for Beginners, Public IPs and Choosing a Load Balancing Service, Network Troubleshooting: When a VM Can't Connect
Domain 5: Monitor and maintain Azure resources (10–15%)
This domain covers observing the health of resources and configuring backup and recovery in case of failure. It is the smallest domain, but it shows up intertwined with resources from the other domains.
Key topics: Azure Monitor metrics and logs; log queries; alert rules and action groups; Insights for VMs, storage, and networks; Network Watcher and Connection monitor; Recovery Services vaults and Backup vaults; backup policies; Azure Site Recovery and failover.
Exam tip: "Restore an accidentally deleted file or VM to a point in time" → Azure Backup. "Keep the service running from another region even if a whole region goes down" → Azure Site Recovery. Tell them apart by purpose: Backup is for restoring data, Site Recovery is for service continuity.
Related posts: Get a Clear Picture of Your Cloud's Current State, Complete Guide to Azure Backup and Disaster Recovery
---
Where AZ-104 Fits in the Azure Certification Path
AZ-104 sits in the middle of the Azure certification path. AZ-900 supports it from below, and above it serves as the prerequisite for Expert certifications.
| Category | AZ-900 | AZ-104 | AZ-305 | |------|------|------|------| | Level | Fundamentals | Associate | Expert | | Full Name | Azure Fundamentals | Azure Administrator Associate | Azure Solutions Architect Expert | | Main Audience | Any role, including non-technical | Administrators who build and operate Azure environments | Architects who turn requirements into Azure designs | | Hands-on Experience | Not required | Experience with the portal, CLI, and PowerShell | Advanced IT operations and design experience | | Prerequisite Certification | None | None | Azure Administrator Associate (AZ-104) required | | Validity | Does not expire | 1 year (free online renewal) | 1 year (free online renewal) |
Earni