Exam AZ-104: Microsoft Azure Administrator

Study Guide
Exam AZ-104: Microsoft Azure
Administrator

Quick navigation
Purpose of this document
Certification
Certification journey
Certification renewal
About the exam
Passing score
What to expect on the exam
Prepare to take the exam
Request accommodations
Take practice tests
Objective domain: skills the exam measures
Skills measured
Functional groups
Corresponding learning paths and modules
Additional study resources
Detailed exam changes
Audience Profile
Skills Measured
Functional groups

1
 Exam AZ-104: Microsoft Azure Administrator

Purpose of this document

This study guide should help you understand what to expect on Exam AZ-104: Microsoft Azure
Administrator, and includes a summary of the topics the exam might cover and links to additional
resources. The information and materials in this document should help you focus your studies as you
prepare for the exam.

Certification
Certification journey
For an overview of attaining Microsoft Certification, including prerequisites (if any) and additional
resources, explore The journey to Microsoft Certified: Azure Administrator Associate.

Certification renewal
Once you earn your certification, don’t let it expire. When you have an active certification that’s expiring
within six months, you should renew it—at no cost—by passing a renewal assessment on Microsoft
Learn. Remember to renew your certification annually if you want to retain it.
To identify which certifications are available for you to renew, visit your Certifications in your Microsoft
Learn profile:
• Ensure your certification profile is connected to your Learn profile.
• Expect an email that directs you to the applicable assessment that you must pass on Microsoft
Learn. You’ll receive this email as soon as you have a certification that you’re eligible to renew.
• When you pass an online assessment, your certification will extend by one year from the current
expiration date.
• To help prepare for the assessment, explore the collection of free modules on the certification
renewal page.

About the exam

Exam AZ-104: Microsoft Azure Administrator is required to earn the Azure Administrator Associate
certification.
This exam measures your ability to accomplish the following technical tasks: manage Azure identities
and governance; implement and manage storage; deploy and manage Azure compute resources;
configure and manage virtual networking; and monitor and back up Azure resources.
As an exam candidate, you should have subject matter expertise implementing, managing, and
monitoring an organization’s Microsoft Azure environment. A candidate for this exam should have at
least six months of direct experience administering Azure, along with a strong understanding of core
Azure services, Azure workloads, security, and governance. In addition, this role should have experience
using PowerShell, Azure CLI, Azure portal, and Azure Resource Manager templates.

2
 Exam AZ-104: Microsoft Azure Administrator

Passing score
A passing score is 700. Learn more about exam scoring and score reports.

What to expect on the exam

Are you new to Microsoft certification exams? You can explore the exam environment by visiting our
exam sandbox. We created the sandbox so you have an opportunity to experience an exam before you
take it. In the sandbox, you can interact with different question types, such as build list, case studies, and
others that you might encounter in the user interface when you take an exam. Additionally, it includes
the introductory screens, instructions, and help topics related to the different types of questions that
your exam might include. It also includes the non-disclosure agreement that you must accept before
you can launch the exam.

Prepare to take the exam

There are several points to consider, or pursue, as you prepare for an exam. The following sections
detail those points.

Request accommodations
We’re committed to ensuring all learners are set up for success. If you use assistive devices, require
extra time, or need modification to any part of the exam experience, you can request an
accommodation. We encourage you to learn more about available accommodations and how to obtain
them by visiting this page.

Take practice tests

Taking a practice test is a great way to know whether you’re ready to take the exam or if you need to
study a bit more. Subject-matter experts write the Microsoft Official Practice Tests, which are designed
to assess all exam objectives. Take the AZ-104: Microsoft Azure Administrator Microsoft Official Practice
Test.

Objective domain: skills the exam measures

The English language version of this exam will be updated on July 28, 2022. If you’re taking this exam’s
English version on or before this date, the following Skills Measured is what you should study. If you
want to review changes to the future version, scroll to the end of this document.
Some exams are localized into other languages, and those are updated approximately eight weeks after
the English version is released. Other available languages are listed in the Schedule Exam section of the
Exam Details webpage. If the exam isn’t available in your preferred language, you can request an
additional 30 minutes to complete the exam.

3
 Exam AZ-104: Microsoft Azure Administrator

Note
The bullets that follow each of the skills measured are intended to illustrate how we are assessing that
skill. Related topics may be covered in the exam.

Note
Most questions cover features that are general availability (GA). The exam may contain questions on
Preview features if those features are commonly used.

Skills measured
• Manage Azure identities and governance (15–20%)
• Implement and manage storage (15–20%)
• Deploy and manage Azure compute resources (20–25%)
• Configure and manage virtual networking (25–30%)
• Monitor and back up Azure resources (10–15%)

Functional groups
Manage Azure identities and governance (15–20%)
Manage Azure Active Directory (Azure AD) objects
• Create users and groups
• Create administrative units
• Manage user and group properties
• Manage device settings
• Perform bulk user updates
• Manage guest accounts
• Configure Azure AD join
• Configure self-service password reset

Manage role-based access control (RBAC)

• Create a custom role
• Provide access to Azure resources by assigning roles at different scopes
• Interpret access assignments

Manage subscriptions and governance

• Configure Azure policies
• Configure resource locks
• Apply and manage tags on resources
• Manage resource groups
• Manage subscriptions

4
 Exam AZ-104: Microsoft Azure Administrator

• Manage costs
• Configure management groups

Implement and manage storage (15–20%)

Secure storage
• Configure network access to storage accounts
• Create and configure storage accounts
• Generate shared access signature (SAS) tokens
• Manage access keys
• Configure Azure AD authentication for a storage account
• Configure access to Azure Files

Manage storage
• Export from Azure job
• Import into Azure job
• Install and use Azure Storage Explorer
• Copy data by using AZCopy
• Implement Azure Storage replication
• Configure blob object replication

Configure Azure files and Azure Blob Storage

• Create an Azure file share
• Create and configure Azure File Sync service
• Configure Azure Blob Storage
• Configure storage tiers
• Configure blob lifecycle management

Deploy and manage Azure compute resources (20–25%)

Automate deployment of virtual machines (VMs) by using Azure Resource
Manager templates
• Modify an Azure Resource Manager template
• Configure a virtual hard disk (VHD) template
• Deploy from a template
• Save a deployment as an Azure Resource Manager template
• Deploy virtual machine extensions

Configure VMs
• Configure Azure Disk Encryption
• Move VMs from one resource group to another

5
 Exam AZ-104: Microsoft Azure Administrator

• Manage VM sizes
• Add data disks
• Configure networking
• Redeploy VMs
• Configure high availability
• Deploy and configure virtual machine scale sets

Create and configure containers

• Configure sizing and scaling for Azure Container Instances
• Configure container groups for Azure Container Instances
• Configure storage for Azure Kubernetes Service (AKS)
• Configure scaling for AKS
• Configure network connections for AKS
• Upgrade an AKS cluster

Create and configure Azure App Service

• Create an App Service plan
• Configure scaling settings in an App Service plan
• Create an App Service
• Secure an App Service
• Configure custom domain names
• Configure backup for an App Service
• Configure networking settings
• Configure deployment settings

Configure and manage virtual networking (25–30%)

Implement and manage virtual networking
• Create and configure virtual networks, including peering
• Configure private and public IP addresses
• Configure user-defined network routes
• Implement subnets
• Configure endpoints on subnets
• Configure private endpoints
• Configure Azure DNS, including custom DNS settings and private or public DNS zones

Secure access to virtual networks

• Create security rules
• Associate a network security group (NSG) to a subnet or network interface
• Evaluate effective security rules
• Implement Azure Firewall

6
 Exam AZ-104: Microsoft Azure Administrator

• Implement Azure Bastion

Configure load balancing

• Configure Azure Application Gateway
• Configure an internal or public load balancer
• Troubleshoot load balancing

Monitor and troubleshoot virtual networking

• Monitor on-premises connectivity
• Configure and use Azure Monitor for Networks
• Use Azure Network Watcher
• Troubleshoot external networking
• Troubleshoot virtual network connectivity

Integrate an on-premises network with an Azure virtual network

• Create and configure Azure VPN Gateway
• Create and configure Azure ExpressRoute
• Configure Azure Virtual WAN

Monitor and back up Azure resources (10–15%)

Monitor resources by using Azure Monitor
• Configure and interpret metrics
• Configure Azure Monitor logs
• Query and analyze logs
• Set up alerts and actions
• Configure Application Insights

Implement backup and recovery

• Create a Recovery Services vault
• Create a Backup vault
• Create and configure backup policy
• Perform backup and restore operations by using Azure Backup
• Perform site-to-site recovery by using Azure Site Recovery
• Configure and review backup reports

Corresponding learning paths and

modules
The design of learning paths and modules should teach you how to perform a role and will help you
study for the applicable exam. However, learning paths aren’t always in the same order as an exam’s

7
 Exam AZ-104: Microsoft Azure Administrator

“skills measured” list. Therefore, we’ve created a convenient table that links the skills measured to
specific paths and modules.

Exam skills measured Links to learning paths

Manage Azure identities and AZ-104 Learning Path: Manage identities and governance in
governance (15–20%) Azure
• Configure Azure Active Directory
• Configure user and group accounts
• Configure subscriptions
• Configure Azure policy
• Configure role-based access control
• Create Azure users and groups in Azure Active Directory
• Secure your Azure resources with Azure role-based
access control (Azure RBAC)
• Allow users to reset their password with Azure Active
Directory self-service password reset

Implement and manage storage AZ-104 Learning Path: Implement and manage storage in
(15–20%) Azure
• Configure storage accounts
• Configure blob storage
• Configure storage security
• Configure Azure files and Azure File Sync
• Configure storage with tools
• Create an Azure Storage account
• Control access to Azure Storage with shared access
signatures
• Upload, download, and manage data with Azure Storage
Explorer

Deploy and manage Azure AZ-104 Learning Path: Deploy and manage Azure compute
compute resources (20–25%) resources
• Configure virtual machines
• Configure virtual machine availability
• Configure virtual machine extensions
• Configure app service plans
• Configure Azure App Services
• Configure Azure Container Instances
• Configure Azure Kubernetes Service

8
 Exam AZ-104: Microsoft Azure Administrator

Exam skills measured Links to learning paths

• Manage virtual machines with the Azure CLI

• Create a Windows virtual machine in Azure
• Host a web application with Azure App Service
• Protect your virtual machine settings with Azure
Automation State Configuration

Configure and manage virtual AZ-104 Learning Path: Configure and manage virtual networks
networking (25–30%) for Azure administrators
• Configure virtual networks
• Configure network security groups
• Configure Azure Firewall
• Configure Azure DNS
• Configure virtual network peering
• Configure VPN Gateway
• Configure ExpressRoute and Virtual WAN
• Configure network routing and endpoints
• Configure Azure Load Balancer
• Configure Azure Application Gateway
• Design an IP addressing schema for your Azure
deployment
• Distribute your services across Azure virtual networks
and integrate them by using virtual network peering
• Host your domain on Azure DNS
• Manage and control traffic flow in your Azure
deployment with routes
• Improve application scalability and resiliency by using
Azure Load Balancer

Monitor and back up Azure AZ-104 Learning Path: Monitor and back up Azure resources
resources (10–15%)
• Configure file and folder backups
• Configure virtual machine backups
• Configure Azure Monitor
• Configure Azure alerts
• Configure Log Analytics
• Configure Network Watcher
• Improve incident response with alerting on Azure

9
 Exam AZ-104: Microsoft Azure Administrator

Exam skills measured Links to learning paths

• Analyze your Azure infrastructure by using Azure

Monitor logs
• Monitor performance of virtual machines by using Azure
Monitor VM Insights

Additional study resources

We offer several resources to help you prepare for the exam and stay current and engaged with the
Microsoft Azure community. These resources range from formal training to blogs and even interviews
with Microsoft team members.

Study resource link Resource description

Course AZ-104T00: Microsoft Take a four-day, instructor-led course that teaches IT

Azure Administrator Professionals how to manage their Azure subscriptions,
secure identities, administer the infrastructure, configure
virtual networking, connect Azure and on-premises sites,
manage network traffic, implement storage solutions, create
and scale virtual machines, implement web apps and
containers, back up and share data, and monitor your
solution.

Exam Prep Videos Visit our Exam Readiness Zone for short videos on strategies
and tips to prepare for the exam.

Azure documentation Stay informed on the latest products, tools, and features, and
get information on pricing, partners, support, solutions, and
more.

Azure Community Support Ask questions, get answers, and connect with Microsoft
engineers and Azure community experts.

Microsoft Learn Community Blog Get the latest information about certification tests and exam
study groups.

Azure Fridays Scott Hanselman, Partner Program Manager, speaks with

Azure engineers as they demo capabilities and share insights.

10
 Exam AZ-104: Microsoft Azure Administrator

Study resource link Resource description

Microsoft Azure Blog Keep current on what's happening in Azure, including what's
in preview and what’s generally available, along with Azure
news, updates, and much more.

Detailed exam changes

Our exams are updated periodically to reflect skills that are required to perform a role. The following
Objective Domain depicts the additions, deletions, and modifications to the exam.
Objective Changes
Audience Profile Major Revision
Manage Azure AD objects Major Revision
Manage role-based access control (RBAC) Minor Revision
Manage Azure subscriptions and governance Minor Revision
Secure Storage Major Revision
Manage storage Major Revision
Configure Azure files and Azure blob storage Minor Revision
Automate deployment of virtual machines (VMs) by using ARM templates Minor Revision
Configure VM Major Revision
Implement and manage virtual networks Major Revision
Secure access to virtual networks Minor Revision
Configure load balancing Minor Revision
Monitor and troubleshoot virtual networking Minor Revision
Integrate on-premises network with an Azure virtual network Minor Revision
Monitor resources with Azure Monitor Minor Revision
Implement backup and recovery Minor Revision

Audience Profile
Candidates for this exam should have subject matter expertise in implementing, managing, and
monitoring an organization’s Microsoft Azure environment, including virtual networks, storage,
compute, identity, security, and governance.
An Azure administrator often serves as part of a larger team dedicated to implementing an
organization's cloud infrastructure. Azure administrators also coordinate with other roles to deliver
Azure networking, security, database, application development, and DevOps solutions.
Candidates for this exam should be familiar with operating systems, networking, servers, and
virtualization. In addition, professionals in this role should have experience using PowerShell, Azure CLI,
the Azure portal, and Azure Resource Manager templates (ARM templates).

11
 Exam AZ-104: Microsoft Azure Administrator

Skills Measured
• Manage Azure identities and governance (15–20%)
• Implement and manage storage (15–20%)
• Deploy and manage Azure compute resources (20–25%)
• Configure and manage virtual networking (20-25%)
• Monitor and maintain Azure resources (10–15%)

Functional groups
Manage Azure identities and governance (15—20%)
Manage Azure Active Directory (Azure AD) objects
• Create users and groups
• Manage licenses in Azure AD
• Create administrative units
• Manage user and group properties
• Manage device settings and device identity
• Perform bulk updates
• Manage guest accounts
• Configure self-service password reset

Manage access control

• Create custom role-based access control (RBAC) and Azure AD roles
• Provide access to Azure resources by assigning roles at different scopes
• Interpret access assignments

Manage Azure subscriptions and governance

• Configure and manage Azure Policy
• Configure resource locks
• Apply and manage tags on resources
• Manage resource groups
• Manage subscriptions
• Manage costs by using alerts, budgets, and recommendations
• Configure management groups

Implement and manage storage (15—20%)

Configure access to storage
• Configure network access to storage accounts
• Create and configure storage accounts
• Generate shared access signature tokens
• Configure stored access policies
• Manage access keys

12
 Exam AZ-104: Microsoft Azure Administrator

• Configure Azure AD authentication for a storage account

• Configure storage encryption

Manage data in Azure storage accounts

• Create import and export jobs
• Manage data by using Azure Storage Explorer and AzCopy
• Implement Azure Storage redundancy
• Configure object replication

Configure Azure Files and Azure Blob Storage

• Create an Azure file share
• Configure Azure Blob Storage
• Configure storage tiers
• Configure blob lifecycle management

Deploy and manage Azure compute resources (20—25%)

Automate deployment of resources by using templates
• Modify an ARM template
• Deploy a template
• Save a deployment as an ARM template
• Deploy virtual machine (VM) extensions

Create and configure VMs

• Create a VM
• Manage images by using the Azure Compute Gallery
• Configure Azure Disk Encryption
• Move VMs from one resource group to another
• Manage VM sizes
• Add data disks
• Configure VM network settings
• Configure VM availability options
• Deploy and configure VM scale sets

Create and configure containers

• Configure sizing and scaling for Azure Container Instances
• Configure container groups for Azure Container Instances
• Configure storage for Azure Kubernetes Service (AKS)
• Configure scaling for AKS
• Configure network connections for AKS
• Upgrade an AKS cluster

Create and configure an Azure App Service

• Create an App Service plan
• Configure scaling settings in an App Service plan
• Create an App Service

13
 Exam AZ-104: Microsoft Azure Administrator

• Secure an App Service

• Configure custom domain names
• Configure backup for an App Service
• Configure networking settings
• Configure deployment settings

Configure and manage virtual networking (20—25%)

Configure virtual networks
• Create and configure virtual networks and subnets
• Create and configure virtual network peering
• Configure private and public IP addresses
• Configure user-defined network routes
• Configure Azure DNS

Configure secure access to virtual networks

• Create and configure network security groups (NSGs) and application security groups (ASGs)
• Evaluate effective security rules
• Implement Azure Bastion
• Configure service endpoints on subnets
• Configure private endpoints

Configure load balancing

• Configure Azure Application Gateway
• Configure an internal or public load balancer
• Troubleshoot load balancing

Monitor virtual networking

• Monitor on-premises connectivity
• Configure and use Azure Monitor for networks
• Use Azure Network Watcher
• Troubleshoot external networking
• Troubleshoot virtual network connectivity

Monitor and maintain Azure resources (10—15%)

Monitor resources by using Azure Monitor
• Configure and interpret metrics
• Configure Azure Monitor Logs
• Query and analyze logs
• Set up alerts and actions
• Configure monitoring of VMs, storage accounts, and networks by using VM insights

Implement backup and recovery

• Create an Azure Recovery Services vault
• Create an Azure Backup vault

14
 Exam AZ-104: Microsoft Azure Administrator

• Create and configure backup policy

• Perform backup and restore operations by using Azure Backup
• Configure Azure Site Recovery for Azure resources
• Perform failover to a secondary region by using Azure Site Recovery
• Configure and review backup reports

15