How to Pass the AZ-104 Azure Administrator Exam in 2026: Complete Study Guide

What Is the AZ-104 Azure Administrator Certification?

The Microsoft Certified: Azure Administrator Associate (AZ-104) is the core Azure infrastructure certification for IT professionals who manage cloud environments. It validates your ability to implement, manage, and monitor Azure identities, storage, compute, virtual networks, and monitoring. For sysadmins, cloud engineers, and IT professionals moving from on-premises infrastructure to Azure, the AZ-104 is the natural starting point.

AZ-104 exam prep is different from many other cloud certifications because Microsoft tests administrative tasks, not architecture design. You need to know not just what Azure RBAC is, but how to assign a custom role, what scope it applies to, and what happens when role assignments conflict. The exam regularly presents operational scenarios where multiple configurations could work and asks you to identify the correct one.

AZ-104 Exam Format

• 40 to 60 questions (the exact number varies per attempt)
• 120 minutes to complete
• 700 out of 1000 passing score (70%)
• Question types include multiple choice, multiple select, drag-and-drop, case studies, and labs (live Azure portal tasks)
• $165 USD exam fee
• Available at Pearson VUE testing centers and via online proctoring

The lab questions deserve special attention. In a lab question, you are given a live Azure subscription and asked to complete specific tasks in the actual portal. There is no multiple-choice fallback: you either configure it correctly or you do not. Candidates who only study with videos and practice tests often struggle with labs because they have never navigated the Azure portal under exam pressure.

The Five AZ-104 Skill Areas

1. Manage Azure Identities and Governance (15-20%)

This covers Microsoft Entra ID (formerly Azure Active Directory), users, groups, and guest accounts. You also need to know Azure RBAC: built-in roles, custom roles, scope levels (management group, subscription, resource group, resource), and how role assignments are inherited. Azure Policy, Management Groups, and subscription governance are also tested here.

2. Implement and Manage Storage (15-20%)

Storage account types, access tiers (Hot, Cool, Archive), lifecycle management policies, and shared access signatures (SAS). You also need to understand Azure Files, Azure Blob Storage, storage replication options (LRS, GRS, ZRS, GZRS), and how to configure storage firewalls and private endpoints.

3. Deploy and Manage Azure Compute Resources (20-25%)

This is the largest domain. It covers Azure Virtual Machines: sizing, availability sets vs. availability zones, scale sets, VM extensions, and Azure Dedicated Hosts. It also includes Azure App Service plans, deployment slots, and scaling. Container solutions (Azure Container Instances, Azure Kubernetes Service) and Azure Functions basics are also in scope.

4. Implement and Manage Virtual Networking (25-30%)

Networking is the heaviest and most consistently difficult domain. It covers Azure Virtual Networks, subnets, Network Security Groups, Application Security Groups, VNet peering, Azure VPN Gateway, ExpressRoute, Azure DNS, Azure Load Balancer, Application Gateway, and Azure Firewall. If you have limited networking experience, budget extra study time for this domain.

5. Monitor and Maintain Azure Resources (10-15%)

Azure Monitor, Log Analytics workspaces, Azure Alerts, diagnostic settings, Azure Backup, and Azure Site Recovery. This domain is narrower but questions about backup policies, recovery time objectives, and alert rule configuration appear regularly.

What Makes AZ-104 Hard: Scenario Questions with Multiple Valid Answers

The AZ-104 exam does not test whether you know that Azure Blob Storage exists. It tests whether you can administer it correctly in a specific organizational context. The hardest question type presents a scenario where two or three of the four answer options would technically work, and you must identify the one that best satisfies all stated requirements.

For example: "A company needs to give a contractor read access to a specific storage container without exposing the storage account key. The access must expire in 72 hours." Four options are presented: RBAC Storage Blob Data Reader role, a service SAS token, an account SAS token, and a stored access policy with a SAS. All four could grant read access. Only one satisfies the expiration requirement and the key-exposure constraint simultaneously.

The Best AZ-104 Study Resources in 2026

1. Microsoft Learn

Microsoft Learn's AZ-104 learning path is the official free resource and it is genuinely good. The modules include sandbox exercises that let you complete real Azure tasks without needing your own subscription. This should be your primary study text.

2. John Savill's AZ-104 Study Cram (YouTube)

John Savill's YouTube channel is one of the best free technical resources for Azure certifications. His AZ-104 study cram video condenses the entire exam scope into a few hours of dense, whiteboard-style instruction. His explanations of networking concepts, in particular VNet peering, route tables, and service vs. private endpoints, are the clearest available anywhere.

3. MeasureUp Practice Tests

MeasureUp is Microsoft's official practice test partner for AZ-104. The questions closely mirror the real exam's format and difficulty. If cost is a concern, Whizlabs and Scott Duffy's Udemy practice tests are solid alternatives.

4. AI Tutoring for Scenario Question Analysis

The scenario question format is where AZ-104 candidates lose the most points. Reading an explanation after getting a question wrong tells you what the right answer is, but it often does not tell you the decision framework you should have used. Certify Copilot AI can walk through any Azure Administrator scenario question with you, explaining the specific administrative constraint that makes one configuration correct.

AZ-104 Study Plan: 6 to 8 Weeks

• Week 1: Identities and Governance: Complete Microsoft Learn modules for Microsoft Entra ID. Practice creating users, groups, and assigning RBAC roles at different scopes.
• Week 2: Storage: Storage account creation, access tier configuration, lifecycle policies, SAS token types, and Azure Files setup.
• Weeks 3-4: Compute: VM deployment, availability zones vs. availability sets, scale sets, App Service deployment slots, ACI and AKS fundamentals.
• Weeks 5-6: Networking: VNets, subnets, NSGs, peering, Azure DNS, VPN Gateway, load balancers, and Application Gateway. Watch John Savill's networking deep dives.
• Week 7: Monitoring and Backup: Azure Monitor, Log Analytics, diagnostic settings, alert rules, and Azure Backup policies.
• Week 8: Practice Exams and Weak Area Review: Two full-length practice exams under timed conditions. Identify weak domains from score reports and target them before exam day.

AZ-104 Exam Day Tips

• For lab questions, read the task description carefully before touching anything. Misconfiguring a resource early can affect subsequent tasks in the same scenario.
• On scenario questions with "select all that apply," do not assume there are always exactly two correct answers. Microsoft sometimes has three.
• When a question mentions a specific constraint (least privilege, no additional cost, no downtime), that constraint is the deciding factor. Eliminate any answer that violates it first.
• Networking questions often test the interaction between two services. Ask yourself: does the traffic flow through the correct path given the NSG rules and route tables described?
• If you consistently score above 75% on MeasureUp practice tests and can complete portal tasks without looking up every step, you are ready to sit the real exam.