1.3 Skills Outline and Weighted Study Map
Key Takeaways
- Identity and governance and compute are each weighted 20-25 percent, making them high-priority study domains.
- Storage and networking are each weighted 15-20 percent and commonly appear inside mixed operational scenarios.
- Monitoring and maintenance is weighted 10-15 percent but connects to every other resource domain.
- The skills bullets are examples, and related topics may be covered.
- A realistic study map should allocate time by weight, weakness, and hands-on complexity.
Build the study plan from the official weights
The AZ-104 skills outline is the exam map. Microsoft lists five domains: manage Azure identities and governance at 20-25 percent, implement and manage storage at 15-20 percent, deploy and manage Azure compute resources at 20-25 percent, implement and manage virtual networking at 15-20 percent, and monitor and maintain Azure resources at 10-15 percent. These are not equal buckets, and a serious study plan should not treat them as equal.
The weights do not create a fixed question count. If an exam form has a different number of items, or includes case studies and interactive components, the distribution you feel on screen can vary. Use the weights to decide study time, lab depth, and practice review intensity. Do not use them to predict the exact number of questions in your appointment.
| Domain | Weight | Study implication |
|---|---|---|
| Manage Azure identities and governance | 20-25% | Master Entra users/groups, RBAC, policy, locks, tags, subscriptions, budgets, and management groups. |
| Implement and manage storage | 15-20% | Practice access, network restrictions, redundancy, Azure Files, blobs, lifecycle, snapshots, and AzCopy. |
| Deploy and manage Azure compute resources | 20-25% | Spend major time on ARM/Bicep, VMs, VMSS, containers, App Service, scaling, slots, TLS, and backup. |
| Implement and manage virtual networking | 15-20% | Build and troubleshoot VNets, peering, NSGs, routes, Bastion, endpoints, DNS, and load balancers. |
| Monitor and maintain Azure resources | 10-15% | Know metrics, logs, alerts, insights, Network Watcher, backup, restore, ASR, and reporting. |
Domain 1: identities and governance
This domain is large because nearly every Azure action starts with scope and permission. Study Microsoft Entra users and groups, user and group properties, licenses, external users, and self-service password reset. Then connect identity to Azure RBAC. Know built-in roles, role assignment scopes, and access assignments. The exam often tests whether a permission belongs at management group, subscription, resource group, or resource scope.
Governance includes Azure Policy, locks, tags, resource groups, subscriptions, management groups, cost alerts, budgets, and Advisor recommendations. Learn which feature enforces, audits, prevents deletion, organizes metadata, manages hierarchy, or reports cost. Many wrong answers use a real Azure feature at the wrong governance layer.
Domain 2: storage
Storage questions often combine data protection, access, and network exposure. Study storage account creation, redundancy, object replication, encryption, firewalls, virtual network rules, SAS tokens, stored access policies, access keys, identity-based Azure Files access, Storage Explorer, and AzCopy. For Azure Files, know shares, snapshots, identity access, and common SMB access constraints. For Blob Storage, know containers, access tiers, soft delete, snapshots, lifecycle management, and versioning.
A good lab sequence is to create a storage account, block public network access, allow selected networks, generate a SAS with limited permissions, test access through Storage Explorer or AzCopy, configure soft delete and versioning, and then recover a deleted or overwritten object. That lab teaches more than memorizing feature names.
Domain 3: compute
Compute is another top-weighted area. You need to read, modify, deploy, export, and convert ARM templates or Bicep files. You need to create and configure virtual machines, encryption at host, VM moves, sizes, disks, availability zones, availability sets, and Virtual Machine Scale Sets. You also need container basics across Azure Container Registry, Azure Container Instances, and Azure Container Apps, including sizing and scaling concepts.
App Service is compute too. Know App Service plans, scaling, app creation, certificates, TLS, custom DNS, backup, networking, and deployment slots. Exam scenarios often hinge on whether a requirement belongs to the app, the App Service plan, the deployment slot, the DNS record, the certificate binding, or the network integration setting.
Domain 4: networking
Networking is weighted 15-20 percent, but it can be the hidden dependency in compute, storage, and monitoring questions. Study VNets and subnets, peering, public IP addresses, user-defined routes, network connectivity troubleshooting, NSGs, ASGs, effective security rules, Azure Bastion, service endpoints, private endpoints, Azure DNS, internal and public load balancers, and load-balancing troubleshooting.
Use a packet-path habit. Start from the source, then inspect DNS resolution, route selection, subnet and NIC NSGs, peering, endpoint type, load balancer rules, health probes, and target service firewall. This habit turns vague "cannot connect" questions into a checklist.
Domain 5: monitoring and maintenance
Monitoring and maintenance carries the smallest percentage range, but it is not optional. Study Azure Monitor metrics, diagnostic settings, log analysis, alert rules, action groups, alert processing rules, VM insights, storage insights, network insights, Network Watcher, Connection Monitor, Recovery Services vaults, Azure Backup vaults, backup policies, backup and restore, Azure Site Recovery, secondary-region failover, backup reports, and backup alerts.
Weighted weekly map
| Study block | Suggested share | Work product |
|---|---|---|
| Identity and governance | 25% | RBAC and policy lab notes, scope decision table. |
| Compute | 25% | VM, Bicep, App Service, and container deployment evidence. |
| Storage | 18% | Access, firewall, blob, file share, and recovery checklist. |
| Networking | 20% | Connectivity troubleshooting tree and load balancer lab. |
| Monitoring and maintenance | 12% | Alerts, logs, Network Watcher, backup and restore runbook. |
Use these percentages as a starting point, then adjust by missed practice questions. If your error log shows repeated storage access failures, raise storage time even if the official weight is lower than compute. If your compute score is high but every networking miss involves route tables, spend a focused session on UDRs and effective routes. Official weights guide the plan; your mistakes refine it.
Which two AZ-104 domains have the highest listed weight ranges?
How should the skills bullets in the Microsoft study guide be interpreted?
A learner is strong in compute but repeatedly misses SAS, stored access policy, and storage firewall questions. What should the weighted map do?