Microsoft Certified: Azure Administrator Associate (AZ-104) is the first hands-on step after finishing AZ-900. If AZ-900 draws the map, AZ-104 hands you that map and checks whether you can actually stand up a server, wire up a network, and track down the cause when something breaks. It's the stage after a new hire memorizes the org chart and actually gets assigned real work to handle. Microsoft recommends at least six months of Azure operations experience before sitting for it, and working through practice questions makes the gap between people who've clicked through the console and people who haven't obvious fast.
Who Needs This Exam, and How Renewal Works
A building superintendent handles plumbing, electrical, and security systems all at once, and an Azure administrator carries a similarly broad set of responsibilities — deploying resources, configuring networks, running backups, and keeping an eye on monitoring. It suits infrastructure engineers operating servers, networks, and storage, system administrators moving from on-premises to the cloud, and anyone who finished AZ-900 and is looking for the next step. There's no official prerequisite, but in practice the exam assumes you already know AZ-900-level fundamentals, so jumping straight in as a complete beginner is a rough start. True to its Associate level, this certification needs renewal every 12 months, but passing a free online assessment on Microsoft Learn handles that with no retake fee involved.
Exam Format: 150 Minutes of Real Operational Scenarios
This exam leans closer to a practical skills test than a knowledge quiz. AZ-104 spends 150 minutes running 40 to 60 questions that check how you'd actually respond to operational scenarios. The passing score is 700 out of 1000, and the exam fee is 165 USD. Beyond single- and multiple-choice questions, the format can include lab simulations where you perform tasks in a screen resembling the real Azure portal, and that's exactly where people who only memorized concepts tend to struggle.
Domain 1: Manage Azure Identities and Governance (20-25%)
Just as a company issues a badge to a new hire and decides which floors they can enter, this domain covers managing access to users and resources. The essentials are managing Microsoft Entra users and groups, role-based access control (RBAC), the structure of subscriptions and management groups, and enforcing rules with Azure Policy. The related post Identity and Governance covers this domain in depth.
Domain 2: Implement and Manage Storage, and Deploy and Manage Azure Compute Resources (35-40%)
Like snapping LEGO bricks together into the shape you want, this domain covers actually deploying and operating Azure's core resources — storage and compute. It carries the highest weight of any domain, so it decides the outcome of the exam more than any other. The essentials are Storage Accounts and access tiers, choosing between Blob, File, and Table storage, creating virtual machines and scaling them automatically through scale sets, deployment automation with ARM templates, and deploying containers and App Service. Three related posts cover this domain: Complete Storage Management, Virtual Machines and Deployment Automation, and Mastering Azure Containers and App Service.
Domain 3: Implement and Manage Virtual Networking (15-20%)
Just as an apartment complex needs water and electricity wired in before anyone can move in, this domain covers how Azure resources talk to each other and connect to the outside world. The essentials are designing Virtual Networks and subnets, controlling traffic with Network Security Groups (NSGs), DNS configuration, and distributing traffic with Load Balancer. The related post VNet, NSG, DNS, and Load Balancer Explained for Beginners covers this domain in depth.
Domain 4: Monitor and Maintain Azure Resources (10-15%)
Just as a car's dashboard warns about engine trouble before it becomes serious, this domain covers watching whether your deployed resources are actually behaving and getting ahead of problems before they hit. The essentials are collecting logs and metrics with Azure Monitor, disaster recovery through backup policies and Azure Site Recovery, and update management. Two related posts cover this domain: Getting a Clear View of Your Cloud's Current State and The Complete Guide to Azure Backup and Disaster Recovery.
A Study Order for Beginners, and Common Mistakes
If you just finished AZ-900, the concepts are familiar, but hands-on time is often what's missing. Walking a strange city with only a map means you'll still miss the actual curbs and traffic lights, and this exam heavily favors people who've built and torn down a virtual machine themselves on a free trial account. A study order that works well starts with Domain 1 (identity and governance) to build the underlying permission structure, then invests the most time in Domain 2 (storage and compute) since it carries the highest weight, and finishes with Domain 3 (networking) and Domain 4 (monitoring). The most common mistake is skimming lab simulation questions the way you'd skim a knowledge question — those require knowing exactly where a menu item lives in the real portal, so console time matters enormously here. A second common mistake is mixing up NSG rule priority, where a lower number always wins; getting that one rule straight alone can save several networking questions at once. A third is missing that policies and permissions inherit downward through the subscription and management group hierarchy, which costs points repeatedly on governance scenario questions if it isn't clear from the start.
Exam Key Takeaways
"Grants resource access based on assigned role" -- RBAC (role-based access control) "Enforces rules consistently across an organization" -- Azure Policy "Hot for frequent access, Cool for occasional, Archive for long-term" -- Blob storage access tiers "Automatically scales VM instances up or down with traffic" -- Virtual Machine Scale Sets (VMSS) "Defines infrastructure as code for repeatable deployment" -- ARM templates "Lower numbers take priority in traffic control rules" -- NSG priority "Distributes traffic evenly across multiple instances" -- Load Balancer "Collects and analyzes resource health in real time" -- Azure Monitor "Resumes service from another region during an outage" -- Azure Site Recovery "Automatically retains snapshots per backup policy" -- Azure Backup
AZ-104 tests whether you've actually done something in the console, not whether you know the concept, so the most reliable next step after reading this guide is opening a free trial account and building — then deleting — a virtual machine yourself.