Identity + Governance
20-25%of exam
Storage
15-20%of exam
Compute
20-25%of exam
Virtual Networking
15-20%of exam
Monitor + Maintain
10-15%of exam
Quick Facts
- Exam
- AZ-104
- Credential
- Azure Administrator
- Pass
- 700+
- Time
- 100 min assessment
- Level
- Associate
- Renewal
- Annual assessment
- Core
- Operate Azure
Scope Stack
Management group, subscription, group, resource.
MGSubscriptionRGResource
Entra ID vs RBAC
Entra ID
- Authentication
- Users/groups
RBAC
- Authorization
- Azure resources
Login vs permissions
Governance Picker
- Need sign-in control→Entra ID
- Need resource permissions→RBAC
- Need deny standards→Policy
- Need no delete→Lock
- Need cost grouping→Tags
- Need spend alert→Budget
- Need subscription hierarchy→Management groups
- Need recommendations→Advisor
Entra ID
- Tenant
- Identity boundary
- User
- Person identity
- Group
- Access collection
- Guest
- External user
- SSPR
- Password self-service
- MFA
- Extra sign-in proof
- Conditional Access
- Signal-based rules
- PIM
- Just-in-time roles
Policy vs Lock
Policy
- Evaluate rules
- Deny/audit/remediate
Lock
- Prevent changes
- Delete/read-only
Standard vs protection
RBAC + Governance
- Owner
- Full access
- Contributor
- Manage, no access
- Reader
- View only
- User Access Admin
- Assign roles
- Management group
- Subscription hierarchy
- Policy
- Enforce rules
- Initiative
- Policy bundle
- Lock
- Prevent changes
Storage Redundancy
L local, Z zones, G geo.
LRSZRSGRSGZRS
SAS vs Key
SAS
- Scoped token
- Time-limited
Key
- Account secret
- Broad access
Delegate vs master
Storage Access
- Access key
- Account secret
- SAS
- Scoped delegated access
- Stored policy
- Revocable SAS control
- Firewall
- Network allowlist
- Private endpoint
- Private Link IP
- Service endpoint
- Subnet service route
- Azure Files auth
- Identity-based SMB
- Encryption
- Data protection
Blob + Files
- Blob
- Object storage
- Container
- Blob namespace
- File share
- SMB/NFS storage
- Hot tier
- Frequent access
- Cool tier
- Infrequent access
- Archive tier
- Offline cheapest
- Soft delete
- Recover deleted data
- Lifecycle
- Automated tiering
Redundancy + Tools
- LRS
- One datacenter
- ZRS
- Zone copies
- GRS
- Region pair async
- GZRS
- Zones plus region
- AzCopy
- Command transfer
- Storage Explorer
- Desktop management
- Object replication
- Blob copy policy
- Snapshot
- Point-in-time copy
Compute Picker
- Need OS control→VM
- Need identical VM scale→VMSS
- Need simple container→ACI
- Need app-scale containers→Container Apps
- Need managed web app→App Service
- Need image storage→ACR
- Need IaC deployment→Bicep
- Need staging swap→Slots
Virtual Machines
- VM size
- CPU/memory profile
- Managed disk
- Azure-managed block
- Availability set
- Fault/update domains
- Availability zone
- Datacenter isolation
- VMSS
- Identical VM scale
- Encryption at host
- Host-level encryption
- Bicep
- Declarative IaC
- ARM template
- JSON IaC
Platform Compute
- ACR
- Container registry
- ACI
- Single container run
- Container Apps
- Serverless containers
- App Service
- Managed web apps
- App Service Plan
- Compute hosting plan
- Deployment slot
- Swap staging
- Custom domain
- DNS mapping
- TLS cert
- HTTPS binding
NSG vs ASG
NSG
- Traffic rules
- Subnet/NIC applied
ASG
- VM grouping
- Rule target
Filter vs group
VNet + Routing
- VNet
- Private network
- Subnet
- Address segment
- Peering
- VNet-to-VNet link
- UDR
- Custom route
- Next hop
- Route target
- Public IP
- Internet address
- NAT Gateway
- Outbound SNAT
- Bastion
- Browser RDP/SSH
LB vs App Gateway
Load Balancer
- Layer 4
- TCP/UDP
App Gateway
- Layer 7
- HTTP routing
Transport vs web
Network Security
- NSG
- Subnet/NIC filtering
- ASG
- App security grouping
- Effective rules
- Merged NSG view
- Private endpoint
- Private service IP
- Service endpoint
- Service route extension
- Azure DNS
- Public zones
- Private DNS
- Private resolution
- VPN Gateway
- Encrypted tunnel
Load Balancing
- Load Balancer
- Layer 4 distribution
- App Gateway
- Layer 7 routing
- Backend pool
- Target members
- Health probe
- Availability check
- Rule
- Frontend to backend
- Inbound NAT
- Port forwarding
- Traffic Manager
- DNS-based routing
- Front Door
- Global web entry
Monitor Flow
Collect, query, alert, act.
MetricsLogsAlertsActions
Monitor vs Service Health
Monitor
- Your resources
- Metrics/logs
Service Health
- Azure incidents
- Provider events
Workload vs platform
Recovery Picker
- Need VM backup→Recovery vault
- Need backup schedule→Backup policy
- Need restore file→Recovery point
- Need DR replication→ASR
- Need metrics alert→Alert rule
- Need log query→KQL
Monitoring
- Azure Monitor
- Metrics and logs
- Metric
- Numeric time series
- Log Analytics
- KQL workspace
- Diagnostic setting
- Send platform logs
- Alert rule
- Condition trigger
- Action group
- Notification target
- Insights
- Curated monitoring
- Network Watcher
- Network diagnostics
Backup + Recovery
- Recovery vault
- Backup/ASR container
- Backup vault
- Newer backup container
- Backup policy
- Schedule and retention
- Restore point
- Recoverable snapshot
- ASR
- Replication/failover
- Failover
- Switch region
- Backup report
- Protection visibility
- Soft delete
- Backup protection
Common Traps
RBAC Inheritance
Child scopes inherit ≠ Deny can override
Locks
Override RBAC actions ≠ Not data protection
Private Endpoint
Private IP access ≠ Needs DNS alignment
SAS Revocation
Stored policy helps ≠ Ad hoc expires only
VM Move
Not always supported ≠ Validate before move
Alert Routing
Rule detects ≠ Action group notifies
Last Minute
- 1.Pass score is 700+
- 2.Blueprint changed April 2026
- 3.Entra authenticates; RBAC authorizes
- 4.Policy enforces; locks protect
- 5.SAS is scoped access
- 6.Private endpoint needs DNS
- 7.LB is Layer 4
- 8.App Gateway is Layer 7
- 9.Monitor queries your telemetry
- 10.ASR handles disaster recovery
Buy on Amazon
Take courses on Udemy
Learning path on PluralsightSame family resources
Explore More Microsoft Azure Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
VideoAZ-104 Study Plan 2026: Pass Azure Administrator ExamThis examVideoFREE MD-102 Exam Guide 2026: Pass Microsoft Endpoint Administrator (Intune, Autopilot, Windows 11)This examVideoAI-900 Exam Guide 2026: FREE Azure AI Fundamentals Study PlanVideoAZ-900 Exam Guide 2026: Pass Azure Fundamentals Free (Complete Study Plan)ArticleAZ-104 Study Plan 2026: Pass Azure Administrator Exam17 min readArticleAzure vs AWS Certification 2026: Which Cloud Cert Should You Get First?19 min readArticleFREE AZ-700 Exam Guide 2026: 5 Domains, $165, Pass Score 700/100017 min readArticleFREE MD-102 Exam Guide 2026: Pass Microsoft Endpoint Administrator (Intune, Autopilot, Windows 11)24 min read