AZ-104 Exam Preparation Guide

1. Executive summary

• Learn the official skills list first. Avoid spending most of your time on adjacent topics that are not in the AZ-104 outline.
• Practise in a real Azure subscription or Microsoft Learn sandbox where possible. The exam expects operational judgement.
• Treat each question as a scenario: identify the required service, scope, permissions, constraints and best-practice answer.
• Use least privilege, cost control, security, resilience and operational maintainability as decision filters.
• Use the Exam Sandbox before exam day so the interface and question styles do not cost you time.

2. Exam blueprint and weighting

The five objective domains below should be used as your revision structure.

3. Preparation strategy

3.1 The working method

1. Read the current official Microsoft Learn AZ-104 study guide and copy the skills list into a tracker.
2. For each skill, decide whether you can perform it in the Azure portal, explain when to use it, and identify the common exam trap.
3. Build small labs for the key tasks. Do not only watch videos.
4. Use the free Practice Assessment to find weak areas. Treat it as diagnostic rather than as the exam itself.
5. Use the Exam Sandbox before booking or at least before exam week.
6. Do a final pass on high-yield comparison topics: RBAC vs Entra roles, policy vs locks, service endpoints vs private endpoints, scale up vs scale out, ACI vs ACA vs AKS, Backup vs Site Recovery.

3.2 What the exam is really testing

• Scope: management group, subscription, resource group or resource.
• Permissions: which built-in role is enough, and where it should be assigned.
• Constraints: region support, resource move limits, networking rules, SKU/tier limitations and feature prerequisites.
• Operational sequence: which steps must happen first, especially for backup, recovery, networking and deployment scenarios.
• Best practice: least privilege, policy-based governance, cost controls, secure access and resilient architecture.

3.3 Topics not to over-prioritise

The transcript warns candidates not to chase areas that are not in the official skills list. You may need awareness of related features, but deep configuration of the following should not dominate AZ-104 revision:

• Deep Intune administration.
• Deep Conditional Access design, beyond knowing licensing relationships where relevant.
• Advanced Microsoft Entra Privileged Identity Management configuration, beyond recognising P2 licensing where relevant.
• Deep Kubernetes design. Know when AKS is appropriate, but the AZ-104 container focus is ACR, ACI and Azure Container Apps.
• Application development internals. For App Service and Application Insights, focus on administrator tasks.

4. Domain 1 - Manage Azure identities and governance

This is one of the highest-value revision areas.

4.1 Core knowledge

4.2 Exam traps and decision rules

• Permissions are additive across assignments unless denied by other controls. If a user is Reader at one scope and Contributor at a lower scope, evaluate the effective result at the target resource.
• Scope inheritance flows downwards: management group to subscription to resource group to resource.
• Least privilege is normally the expected answer. Assign the narrowest role at the narrowest useful scope.
• Policy and RBAC do different things. RBAC says who can attempt an action. Policy can restrict what is allowed even when a user has permission.
• Resource locks protect against accidental deletion or modification. Policy enforces standards at scale. Know when to use each.
• Every Azure resource belongs to exactly one resource group; resource groups cannot be nested or renamed; resources in a group can be in different regions.
• Management groups sit above subscriptions and are used to organise policy and access control across multiple subscriptions.
• Cost questions often involve budgets, alerts, Azure Advisor recommendations, reservations and Azure Hybrid Benefit.

5. Domain 2 - Implement and manage storage

The topic list is broad, so do not underestimate this section.

5.1 Core knowledge

5.2 High-yield details from the transcript

• Storage firewalls and virtual network rules apply to data-plane operations.
• A stored access policy can make SAS revocation easier than managing individual SAS tokens directly.
• For Azure file shares over SMB, port 445 must be open and SMB 3.0 encryption matters for secure transfer.
• Blob access levels are private, blob and container. Know the security implication of each.
• Blob tiers: hot, cool, cold and archive. The transcript highlights minimum retention periods of 30 days for cool, 90 days for cold and 180 days for archive.
• Archive has the lowest storage cost but rehydration takes time. Moving data before minimum retention does not block the move, but may create early deletion charges.
• Blob lifecycle policies automate tiering and deletion based on rules such as blob age, container or path.
• Blob versioning creates versions on modification; understand the cost and latency implications of many versions.

6. Domain 3 - Deploy and manage Azure compute resources

Along with identities and governance, this is a top-priority domain.

6.1 Core knowledge

6.2 Exam traps and decision rules

• Do not memorise every VM size. Know the family pattern and match the workload: general purpose, compute optimised, memory optimised and so on.
• Scale up means increasing the power/tier/size of an instance. Scale out means adding instances.
• VM scale sets manage groups of identical VMs and support automatic scale behaviour.
• ACI is for quick simple container execution; Azure Container Apps is managed/serverless for containerised apps; AKS is the full orchestration answer when the scenario requires Kubernetes-level control.
• An App Service plan defines the compute resources and cost model. Multiple apps can share the same plan.
• Deployment slot settings can be marked as slot settings so they stick to the slot and do not swap.
• For ARM/Bicep questions, focus on reading structure and intent rather than memorising full syntax.

7. Domain 4 - Implement and manage virtual networking

Expect scenario and troubleshooting questions.

7.1 Core knowledge

7.2 Exam traps and decision rules

• For NSG questions, sort rules by priority and direction before deciding allow/deny.
• Remember default NSG rules. A custom higher-priority rule can override the default behaviour.
• ASGs simplify rule management when IP addresses change; they do not replace NSGs.
• UDRs are used when the scenario wants to force traffic through a firewall or network virtual appliance.
• Private endpoints are usually the answer when the requirement is private IP access to a PaaS service.
• For Bastion scenarios, look for requirements such as no VM public IP, browser-based RDP/SSH and reduced attack surface.
• For load balancer troubleshooting, check frontend IP, backend pool membership, rules, health probes, NSGs and VM health.

8. Domain 5 - Monitor and maintain Azure resources

This is the smallest domain, but backup and recovery questions often require exact steps.

8.1 Core knowledge

8.2 Exam traps and decision rules

• Metrics and logs are different data types. Metrics are numerical time-series values; logs are queryable event/detail records.
• Log Analytics is used when you need richer retention, KQL querying, saved queries and dashboards.
• Action groups define what happens when an alert fires.
• Network Watcher is the expected diagnostic service for Azure networking problems.
• Azure Backup is for backup/restore. Azure Site Recovery is for disaster recovery and failover.
• For restore or failover questions, look carefully for required order: permissions, vault, policy/replication, validation, test failover/restore, cleanup.

9. Practical lab checklist

Use this as a practical build plan. The aim is not to create a large production environment, but to touch the administrator tasks likely to appear in scenarios.

10. Exam-day strategy

• Read the requirement before the scenario text. Identify the task: deploy, secure, troubleshoot, reduce cost, monitor or recover.
• Look for scope words: tenant, management group, subscription, resource group, resource, subnet, NIC, storage account, container or file share.
• Eliminate answers that are too broad, too privileged, too expensive or do not meet the stated constraint.
• When two answers work, prefer the one that is least privileged, policy-driven, secure and operationally simpler.
• For network questions, map direction and path: source, destination, protocol, port, route, NSG, endpoint and load balancer health.
• For sequence questions, identify dependencies: create vault before backup; define policy before assignment; create backend pool/probe/rules before expecting load balancer success.
• Use Microsoft Learn during the exam only for targeted lookup. The timer continues, so do not plan to research every question.
• Use mark-for-review strategically. Do not get stuck on one complex scenario at the expense of easier marks.
• Be careful with breaks. Microsoft warns that after starting an unscheduled break you cannot return to questions already viewed before the break.

11. Final readiness checklist

12. Useful official links and reference library

Use these links as the reference library for the guide. The first two links are the most important to check before booking because exam objectives and certification guidance can change.