200+ Free Azure AZ-104 Practice Questions

Pass your Microsoft Azure Administrator Associate (AZ-104) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

~70% Pass Rate

200+ Questions

100% Free

1 / 200

Question 1

Score: 0/0

An administrator needs to create a new user account in Microsoft Entra ID that can be used for automated scripts and applications. What type of account should be created?

Member user

Guest user

Service principal

External user

to track

2026 Statistics

Key Facts: Azure AZ-104 Exam

700/1000

Passing Score

Microsoft

40-60 Q

Exam Questions

Microsoft (varies)

60-100 hrs

Study Time

Recommended

$165

Exam Fee

Microsoft

5 domains

Exam Domains

Microsoft AZ-104 outline

120 min

Exam Duration

Microsoft

AZ-104 is Microsoft's associate-level Azure administration certification, requiring a passing score of 700 out of 1000. The exam has approximately 40-60 questions in 120 minutes, covering identity/governance (20-25%), storage (15-20%), compute (20-25%), networking (15-20%), and monitoring (10-15%). This certification is required before taking AZ-305 and is ideal for Azure administrators, system administrators, and cloud engineers.

Sample Azure AZ-104 Practice Questions

Try these sample questions to test your Azure AZ-104 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 200+ question experience with AI tutoring.

1An administrator needs to create a new user account in Microsoft Entra ID that can be used for automated scripts and applications. What type of account should be created?

A.Member user

B.Guest user

C.Service principal

D.External user

Explanation: A service principal is the correct account type for automated scripts and applications. It represents an identity for an application or service that needs to access Azure resources. Member users are regular user accounts for employees. Guest users are external users invited to collaborate. While you could use a regular user account, service principals provide better security through credential separation and granular permissions.

2Where can an administrator configure self-service password reset (SSPR) settings in Microsoft Entra ID?

A.Microsoft Entra admin center > Password reset

B.Azure portal > Active Directory > Security

C.Microsoft 365 admin center > Users

D.Azure Security Center > Identity

Explanation: Self-service password reset settings are configured in the Microsoft Entra admin center under the Password reset section. This allows administrators to enable and configure SSPR for different user groups, set authentication methods required for reset, and configure notifications. The setting is not found in the Azure portal under Active Directory security or in Microsoft 365 admin center.

3Which authentication method allows users to sign in without using a password?

A.Multi-factor authentication (MFA)

B.Passwordless authentication

C.Conditional Access

D.Single sign-on (SSO)

Explanation: Passwordless authentication allows users to sign in without using a password. Instead, users authenticate using methods like Windows Hello for Business, Microsoft Authenticator app, or FIDO2 security keys. While MFA adds an additional layer of security, it still requires a password. Conditional Access is a policy engine, not an authentication method. SSO allows access to multiple applications with one set of credentials but typically still requires a password initially.

4A company needs to create a group where membership is automatically updated based on user attributes like department or job title. What type of group should be created?

A.Assigned group

B.Dynamic group

C.Security group

D.Microsoft 365 group

Explanation: A dynamic group automatically updates membership based on rules that evaluate user or device attributes. For example, you can create a rule that automatically includes all users with Department = "Sales". Assigned groups require manual membership management. Security groups and Microsoft 365 groups refer to group purpose/permissions, not how membership is managed. Dynamic groups require Azure AD Premium P1 or P2.

5What is the primary purpose of a security group in Microsoft Entra ID?

A.To create a shared mailbox and calendar

B.To manage access to resources like applications and SharePoint sites

C.To facilitate team collaboration in Microsoft Teams

D.To store shared documents

Explanation: Security groups in Microsoft Entra ID are primarily used to manage access to resources such as applications, SharePoint sites, and other Azure resources. You can assign permissions and roles to the group, and all members inherit those permissions. Microsoft 365 groups (not security groups) create shared mailboxes, facilitate Teams collaboration, and include shared document libraries.

6Which group type provides a shared mailbox, shared calendar, SharePoint document library, and can be used with Microsoft Teams?

A.Security group

B.Mail-enabled security group

C.Microsoft 365 group

D.Distribution list

Explanation: Microsoft 365 groups provide collaboration features including a shared mailbox, shared calendar, SharePoint document library, and integration with Microsoft Teams. Security groups are only for access management and do not include these collaboration features. Mail-enabled security groups can be used for both access control and email distribution but lack SharePoint and Teams integration.

7An administrator needs to grant a user permission to manage virtual machines in a specific resource group only. What should be used?

A.Azure Policy

B.Azure RBAC

C.Management groups

D.Resource locks

Explanation: Azure Role-Based Access Control (RBAC) should be used to grant permissions to manage resources at various scopes including resource groups. You can assign built-in roles like "Virtual Machine Contributor" or create custom roles scoped to a specific resource group. Azure Policy enforces rules and effects over resources but does not grant permissions. Management groups are for organizing subscriptions. Resource locks prevent accidental deletion or modification.

8What is the lowest level scope at which Azure RBAC roles can be assigned?

A.Management group

B.Subscription

C.Resource group

D.Individual resource

Explanation: Azure RBAC roles can be assigned at the individual resource level, which is the lowest and most granular scope. The hierarchy is: Management group (highest) > Subscription > Resource group > Individual resource (lowest). Assigning at a higher scope gives access to all child resources. For least privilege, assign roles at the lowest scope necessary.

9Which built-in Azure RBAC role allows a user to view all resources but not make any changes?

A.Contributor

B.Reader

C.User Access Administrator

D.Owner

Explanation: The Reader role allows users to view all resources but not make any changes. The Contributor role allows managing resources but not managing access. The Owner role has full access including the ability to manage access. User Access Administrator can manage user access to Azure resources. For read-only access, always use the Reader role.

10What is the primary purpose of Azure Policy?

A.To assign permissions to users and groups

B.To enforce organizational standards and assess compliance

C.To monitor resource performance

D.To backup Azure resources

Explanation: Azure Policy is used to enforce organizational standards and assess compliance at-scale. It enables you to create, assign, and manage policies that enforce rules over your resources. For example, you can ensure all resources have specific tags, restrict which regions resources can be deployed to, or enforce specific SKUs. RBAC is for permissions, Azure Monitor is for performance monitoring, and Azure Backup is for backups.

About the Azure AZ-104 Exam

The Microsoft Azure Administrator Associate (AZ-104) exam validates expertise in implementing, managing, and monitoring Microsoft Azure solutions. Candidates should have at least six months of hands-on experience administering Azure, along with a strong understanding of core Azure services, Azure workloads, security, and governance. This certification is a prerequisite for the Azure Solutions Architect Expert (AZ-305) certification.

Questions

60 scored questions

Time Limit

120 minutes

Passing Score

700/1000

Exam Fee

$165 (Microsoft / Pearson VUE)

Azure AZ-104 Exam Content Outline

20-25%

Manage Azure identities and governance

Microsoft Entra ID users and groups, authentication and authorization, RBAC, Azure Policy, subscriptions, management groups, cost management, and resource governance

15-20%

Implement and manage storage

Storage accounts, Blob Storage tiers and lifecycle, Azure Files and File Sync, storage security, replication options, data migration, and storage monitoring

20-25%

Deploy and manage Azure compute resources

Virtual machines and VMSS, App Service, Azure Container Instances, AKS, VM backups, high availability, and configuration management

15-20%

Implement and manage virtual networking

VNets and subnets, VNet peering, NSGs and ASGs, load balancing, VPN Gateway, ExpressRoute, private endpoints, and Azure Firewall

10-15%

Monitor and maintain Azure resources

Azure Monitor, Log Analytics, alerts and autoscale, backup and recovery, Azure Advisor, and resource health monitoring

How to Pass the Azure AZ-104 Exam

What You Need to Know

Passing score: 700/1000
Exam length: 60 questions
Time limit: 120 minutes
Exam fee: $165

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

Azure AZ-104 Study Tips from Top Performers

1Get hands-on experience — the AZ-104 exam tests practical skills. Use Azure free tier to practice creating and managing resources.

2Master Azure CLI and PowerShell — know common commands for creating VMs, managing storage, configuring networks, and managing identities.

3Focus on RBAC — understand built-in roles, custom roles, and scope inheritance (management groups to resources).

4Study networking deeply — VNets, subnets, NSGs, load balancers, VPN Gateway, and private endpoints are heavily tested.

5Know your storage options — Blob tiers, Azure Files, replication types, and when to use each storage solution.

6Practice monitoring and backup — Azure Monitor, Log Analytics queries, alerts, and Recovery Services vault configuration.

Frequently Asked Questions

What is the AZ-104 passing score?

The Microsoft Azure Administrator Associate (AZ-104) exam requires a passing score of 700 out of 1000. The exam typically has around 40-60 questions and must be completed within 120 minutes. Microsoft uses scaled scoring, so the raw number of correct answers is converted to a 1-1000 scale.

What are the prerequisites for AZ-104?

While there are no formal prerequisites, Microsoft recommends that candidates have at least six months of hands-on experience administering Azure, along with strong understanding of core Azure services, Azure workloads, security, and governance. Candidates should also have experience using PowerShell, Azure CLI, Azure portal, and Azure Resource Manager templates. AZ-900 (Azure Fundamentals) is recommended but not required.

How hard is the AZ-104 exam?

AZ-104 is considered a moderately challenging associate-level exam. Unlike AZ-900 which tests concepts, AZ-104 tests hands-on implementation skills — how to configure resources, troubleshoot issues, and manage Azure environments. Most candidates need 2-3 months of study (60-100 hours) with hands-on Azure experience. The exam requires practical knowledge of Azure portal, CLI, and PowerShell.

How long should I study for AZ-104?

Most candidates need 2-3 months of study, investing 60-100 hours total. Key study actions: 1) Get hands-on experience with Azure free tier or sandbox environments. 2) Practice with Azure CLI and PowerShell commands. 3) Study all five exam domains with focus on Identity/Governance (20-25%) and Compute (20-25%). 4) Build and configure VMs, VNets, storage accounts, and monitoring solutions. 5) Complete at least 200 practice questions. Candidates without prior Azure experience should allow additional time.

What jobs does AZ-104 qualify me for?

AZ-104 qualifies you for Azure administration and cloud support roles: Azure Administrator, Cloud Administrator, System Administrator, Infrastructure Engineer, and Cloud Support Engineer. Certified professionals typically earn $80,000-$130,000+ depending on location and experience. AZ-104 is also required before pursuing AZ-305 (Solutions Architect Expert) and is valuable for any IT professional working with Azure.

What is the difference between AZ-104 and AZ-305?

AZ-104 (Azure Administrator) tests hands-on ability to implement and manage Azure resources — the "how" of Azure operations. AZ-305 (Solutions Architect Expert) tests design decision-making — the "why" and "when" of choosing solutions. AZ-104 focuses on day-to-day administration: creating VMs, configuring storage, managing identities, and monitoring. AZ-305 requires AZ-104 as a prerequisite and focuses on architecture design decisions.