Microsoft Azure Administrator (AZ-104) study guide

How to use this guide

Know these cold:

• Microsoft Entra ID: users, groups, administrative units and licence assignment
• RBAC — built-in versus custom roles, and scope inheritance across the management hierarchy
• Subscriptions and governance: management groups, Azure Policy, resource locks, tags
• Cost management — budgets, alerts and cost analysis

Know these cold:

• Storage accounts: redundancy options (LRS/ZRS/GRS/GZRS) and access tiers
• Securing storage — SAS tokens, access keys, firewalls and private endpoints
• Azure Files, File Sync, and blob lifecycle management
• Moving data with AzCopy, Storage Explorer and Import/Export

Know these cold:

• Virtual machines: sizing, availability sets and zones, and scale sets
• ARM templates and Bicep — deploying, and reading a template to predict its result
• Containers: Azure Container Instances and Azure Kubernetes Service basics
• App Service plans, scaling and deployment slots

Know these cold:

• Virtual networks, subnets, peering and address planning
• Network security groups and application security groups — and evaluation order
• Load Balancer versus Application Gateway, and when each applies
• Azure DNS, private endpoints, and hybrid connectivity with VPN Gateway

Know these cold:

• Azure Monitor, Log Analytics workspaces and basic KQL queries
• Alerts, action groups and Application Insights
• Network Watcher for connectivity troubleshooting
• Backup and recovery — Azure Backup, Recovery Services vaults, Site Recovery

Common mistakes

• ✕Confusing Azure Policy with RBAC. Policy governs what resources may exist and how they must be configured; RBAC governs who may act on them. Questions are built on that distinction.
• ✕Guessing at NSG evaluation. Rules are processed by priority and the first match wins — walking the rules in order is the only reliable way through those questions.
• ✕Treating availability sets and availability zones as interchangeable. They protect against different failures.
• ✕Picking Load Balancer when the scenario describes HTTP path- or host-based routing, which is Application Gateway's job.
• ✕Skimming storage redundancy. LRS, ZRS, GRS and GZRS differ in exactly the way the scenarios test — regional versus zonal versus geo failure.
• ✕Not reading Bicep or ARM fragments carefully. The answer is usually one property, and the rest of the template is there to slow you down.

Exam-day tips

• ✓Read the last line of the scenario first — it carries the actual requirement, and it reframes everything above it.
• ✓Watch for least-privilege phrasing. When several roles would work, the answer is the narrowest one that still does the job.
• ✓Case studies reuse one scenario across several questions. Read it properly once rather than re-reading per item.
• ✓Some questions cannot be revisited once answered — check whether you are in a locked section before rushing.
• ✓There is no penalty for a wrong answer. Never leave one blank.
• ✓Identity and compute are 24% each — nearly half the exam between them. Prioritise accordingly.

How to know you’re ready

One good practice score can be luck. The signal that holds up: consistently at or above the real pass mark (700 on a 1–1000 scaled score) across multiple full-length sets, with no single domain dragging far below the rest. Kwizza tracks your per-domain readiness automatically as you practice.