AZ-104 is the exam you take when you stop learning about Azure and start building in it.
It follows AZ-900 on the roadmap, but the two exams don’t really compare. AZ-900 tests whether you can describe cloud services. AZ-104 tests whether you can configure them, troubleshoot them, and make decisions under scenario pressure. Budget 40–60 hours of preparation. You’ll need hands-on practice, not just reading.
What AZ-104 Covers
Microsoft last updated the exam objectives on April 17, 2026. Five domains:
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 20–25% |
| Implement and manage storage | 15–20% |
| Deploy and manage Azure compute resources | 20–25% |
| Implement and manage virtual networking | 15–20% |
| Monitor and maintain Azure resources | 10–15% |
Identity and compute together represent 40–50% of your score. Do well on both and you’re more than halfway to 700 with margin. Underperform on either and the remaining sections won’t save you.
The monitor and maintain domain sits at 10–15%. Don’t treat it as filler. Azure Monitor, Log Analytics, Backup, and Site Recovery questions are scenario-based and appear consistently.
The Sections That Cause Problems
Networking. Fifteen to twenty percent of the exam, but a disproportionate share of wrong answers. Networking scenarios require troubleshooting logic, not recall.
NSG rule evaluation order: rules are processed by priority, lowest number first, and you need to understand how default rules interact with custom rules. Effective routes and user-defined routes. The difference between Azure Bastion, VPN Gateway, and ExpressRoute. Private endpoints vs. service endpoints for PaaS. These aren’t things you can memorize your way through.
The fix: work through scenarios where traffic is blocked and you have to identify why. Microsoft Learn’s networking modules include these exercises. Do them, don’t just read them.
Identity and Microsoft Entra ID. The rebranding from Azure Active Directory is now fully reflected in AZ-104. Exam questions use Entra ID terminology throughout. If you’re studying from materials older than 2024, the terminology will trip you up before the content does.
More importantly, the identity domain goes beyond “RBAC exists.” Exam questions test scope and inheritance: given this policy at this scope, what does a user in this specific resource group have permission to do? You need to trace through the management group, subscription, and resource group hierarchy, not just know that the hierarchy exists.
The Study Plan
Weeks 1–2: Identity and governance. Microsoft Learn’s “Manage Azure identities and governance” learning path is directly aligned to the exam and free. Complete it fully, exercises included. The Azure Policy section is heavier on the exam than most study materials suggest.
Weeks 3–4: Compute and storage. VMs, scale sets, ARM templates, Bicep basics. For storage: SAS tokens, access tiers, lifecycle management, redundancy options. The storage section catches people who’ve only worked with S3-style blob storage and haven’t dealt with Azure Files or identity-based access.
Week 5: Networking. Dedicate a full week. Create virtual networks, peer them, set NSG rules, trace why traffic isn’t flowing. Configure DNS. Implement Bastion. This is where technically confident candidates lose points they didn’t expect to lose.
Weeks 6–7: Monitor and maintain, then review. Azure Monitor, Log Analytics, Backup, Site Recovery. Then a full domain review. Identify your weakest section and spend an extra day on it before booking.
When to book: Pass-IT tracks mastery per domain. When you’re consistently above 70% across all five domains and your overall readiness score hits 80%, book the exam. That’s more reliable than whether you feel ready.
Labs
AZ-104 may include performance-based labs: tasks you complete in a live Azure environment using the portal, CLI, or PowerShell. Microsoft recommends preparing for labs by default, regardless of whether your specific exam session includes them.
Labs are timed alongside the rest of the exam. Candidates who know what to do but are slow in the portal run out of time. A practical benchmark: can you create a VM, configure an NSG rule, set up a storage account with the right redundancy type, and create a basic load balancer without looking anything up? If any of those steps require documentation, keep practicing before you book.
Quick Reference
| Detail | Value |
|---|---|
| Exam code | AZ-104 |
| Certification | Azure Administrator Associate |
| Exam time | 100 minutes |
| Pass score | 700/1000 |
| Renewal | Annual (free online assessment via Microsoft Learn) |
| Labs | Possible |
| Prerequisites | None formal |
What Comes After AZ-104
AZ-104 is the only required exam for the Azure Administrator Associate certification.
For admins moving toward an architecture track, AZ-305 (Azure Solutions Architect Expert) is the natural next step. It builds on AZ-104 topics at higher complexity, with a focus on solution design rather than implementation.
For the Azure vs. AWS comparison, see the cloud certification breakdown. For a full path from first cert onward, the cloud certification roadmap covers it. If you’re coming from AZ-900 and deciding whether it’s time to move on, the AZ-900 study guide has the guidance.
AZ-104 questions are in Pass-IT, adaptive and grounded in the current Microsoft exam objectives. Domain-level tracking shows you exactly where your gaps are. Free trial, no credit card.
