AZ-104: Microsoft Azure Administrator Master Study Guide & Hands-On Blueprint

1. AZ-104 Exam Overview & Passing Benchmark

The Microsoft Certified: Azure Administrator Associate (AZ-104) certification validates your real-world ability to implement, manage, and monitor identity, governance, storage, compute, and virtual networks in cloud environments. It is widely considered one of the most hands-on, scenario-dense associate certifications in the entire cloud ecosystem.

2. Domain Weightages & Blueprint Breakdown

The exam is structured into five distinct domains. Understanding these weightages helps you prioritize your study time effectively:

3. Domain 1: Identities & Governance (Entra ID & Policy)

Microsoft Entra ID (formerly Azure AD) is central to every question in this domain. Key principles to master:

• Role-Based Access Control (RBAC): Understand the exact inheritance model: Management Group → Subscription → Resource Group → Resource. Remember: child resources inherit permissions from parent scopes and deny assignments take precedence over allow assignments.
• Azure Policy vs. RBAC: RBAC controls who can do what (user actions). Azure Policy controls what resource properties are allowed regardless of who deploys them (e.g. enforcing allowed locations, SKU sizes, or mandatory tags).
• Policy Effects: Memorize the difference between Audit, Deny, Append, and Modify. Modify and Append can inject default tags before deployment completes!
• Resource Locks: ReadOnly (Authorized users can read, but cannot delete or modify) vs CanNotDelete (Authorized users can read and modify, but cannot delete). Locks always override RBAC permissions!

4. Domain 2: Azure Storage Deep Dive (Tiers & AzCopy)

Storage questions frequently test tier transition economics and data movement tools:

• Blob Access Tiers:
  • Hot Tier: High storage cost, lowest access cost. For data actively in use.
  • Cool Tier: Lower storage cost, higher access cost. Minimum retention: 30 days.
  • Cold Tier: Even lower storage cost. Minimum retention: 90 days.
  • Archive Tier: Lowest storage cost, highest access cost. Offline storage with rehydration latency (Standard: up to 15 hours; High priority: under 1 hour). Minimum retention: 180 days.
• AzCopy Command Line: Remember that azcopy copy transfers files, directories, and blobs, while azcopy sync synchronizes source to destination with an optional --delete-destination=true flag.
• Shared Access Signatures (SAS): User delegation SAS (secured with Entra ID credentials) is recommended over Account or Service SAS (secured with storage keys).

5. Domain 3: Compute Resources (VMs, SLA Math & Scale Sets)

Understand the Service Level Agreement (SLA) calculations required for high availability:

Virtual Machine Scale Sets (VMSS): Auto-scaling requires two components: instance limits (default, minimum, and maximum capacity) and autoscale rules (metric thresholds such as Average CPU > 75% for 10 minutes to scale out by 1 instance).

6. Domain 4: Virtual Networking (VNets, Peering & NSGs)

Networking is traditionally the highest-failure domain on the AZ-104 exam. Focus on these high-frequency concepts:

• VNet Peering: Peering requires reciprocal links in both directions. If link 1 is created, state is Initiated. Only when link 2 is created from VNet2 → VNet1 does state become Connected. Transitive peering is NOT supported without a Network Virtual Appliance (NVA) or Azure Firewall!
• NSG Rule Priority: Rules are processed in order from 100 to 4096. Lower numbers have higher priority. As soon as traffic matches a rule, processing stops! Default rules (65000: AllowVNetInBound, 65001: AllowAzureLoadBalancerInBound, 65500: DenyAllInBound) cannot be deleted, only overridden by lower priority numbers.
• Azure Bastion: Deployed in a dedicated subnet strictly named AzureBastionSubnet (minimum /26 prefix). Provides browser-based RDP/SSH without public IPs on VMs.

7. Domain 5: Monitoring & Backup (AMA, KQL & Vaults)

• Azure Monitor Agent (AMA): The unified modern agent replacing legacy MMA/OMS. Managed via Data Collection Rules (DCRs) to specify what event logs and performance counters stream to Log Analytics workspaces.
• Kusto Query Language (KQL) Basics:

  Heartbeat
  | where TimeGenerated > ago(1h)
  | summarize count() by Computer, OSType
  | order by count_ desc

• Recovery Services Vault vs. Backup Vault: Recovery Services Vault protects Azure VMs, SQL in Azure VM, and SAP HANA. Backup Vault protects Azure Disks, Blobs, and PostgreSQL Flexible Servers.

8. Essential Azure CLI & PowerShell Commands

# Create Resource Group with mandatory tag
az group create --name rg-network --location eastus --tags CostCenter=IT

# Create Virtual Network and Subnet
az network vnet create --resource-group rg-network --name vnet-prod \
  --address-prefixes 10.0.0.0/16 --subnet-name subnet-web --subnet-prefixes 10.0.1.0/24

# Create NSG and allow port 443 with priority 100
az network nsg create --resource-group rg-network --name nsg-web
az network nsg rule create --resource-group rg-network --nsg-name nsg-web \
  --name AllowHTTPSInbound --priority 100 --source-address-prefixes Internet \
  --destination-port-ranges 443 --access Allow --protocol Tcp

# Peer two Virtual Networks
az network vnet peering create --resource-group rg-network --name vnet1-to-vnet2 \
  --vnet-name vnet-prod --remote-vnet vnet-hub --allow-vnet-access

9. Top 7 Tricky Scenarios That Fail Candidates