Guide
How to pass AZ-104 Azure Administrator
A practical six-week route through five skills domains, the topics that trip candidates up, and exam-day tactics.
The exam
What is AZ-104, and is it for you?
AZ-104 earns the Microsoft Certified: Azure Administrator Associate credential, the exam most job adverts mean by "Azure sysadmin".
- It proves you can run an Azure environment day to day, not just describe one — subscriptions, identities, storage, virtual machines, and networks.
- It sits above Fundamentals exams such as AZ-900 and below expert-level architecture (AZ-305), the assumed groundwork for both the architecture and specialist security tracks above it.
- It is genuinely hands-on: expect a Bicep file or an Azure CLI command and a question asking what it does, or a scenario asking you to pick the correct configuration.
- Microsoft refreshes the skills outline periodically — the current version dates from April 2026 — so study against the live objectives rather than an old syllabus.
Format & domains
Exam format and skills domains
Expect a mix of question styles rather than plain multiple choice. Alongside single-answer and multi-select questions, AZ-104 uses drag-and-drop ordering, hotspot questions where you tap the right area of a portal screenshot, and short case studies that group several questions around one scenario.
- QuestionsRoughly 40–60
- Duration100 minutes (120-minute seat)
- Pass score700 / 1000 (scaled)
- DeliveryOnline or a test centre
- ValidityRenew free every year
- FeeVaries by country
The exam fee changes from country to country, so check Microsoft's certification page for the price where you live. The five skills domains and their weights, from the official April 2026 outline, are below. The percentages are worth memorising because they tell you where to spend your time.
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 20–25% |
| Implement and manage storage | 15–20% |
| Deploy and manage Azure compute resources | 20–25% |
| Implement and manage virtual networking | 15–20% |
| Monitor and maintain Azure resources | 10–15% |
Identity, governance, and compute together account for roughly half the exam, so they deserve the largest share of your revision. Monitoring is the lightest domain, but it is also the one candidates most often neglect, which makes it easy marks if you give it a fair week.
Six-week study plan
A realistic six-week study plan
Most candidates pass after four to eight weeks of focused study, depending on how much Azure they already touch at work. Six weeks is a sensible middle path. Compress it if you administer Azure daily; stretch it toward three months if the platform is new to you. Each week below maps onto the domains in order of weight.
-
Identity and governance
The largest domain, and the one everything else assumes.
- Microsoft Entra ID: users, groups, licence assignment, external users, self-service password reset.
- Azure RBAC: built-in roles at management group, subscription, resource group, and resource scope.
- Governance: Azure Policy, resource locks, tags, management groups, cost budgets and alerts.
-
Storage
Storage crosses two axes the exam tests separately: how data survives, and how it's reached.
- Redundancy options: LRS, ZRS, GRS, and their read-access variants.
- Access control: SAS tokens, access keys, identity-based access for Azure Files, plus encryption.
- Blob tiers, lifecycle management, versioning, and soft delete; Azure Files shares and snapshots.
-
Infrastructure as code and virtual machines
Learn to read Bicep and ARM before you learn to write it — the exam hands you snippets, not blank pages.
- Read, modify, deploy, and convert ARM templates and Bicep files.
- Virtual machine sizing, disks, availability zones and sets, Virtual Machine Scale Sets.
- Encryption at host; deploy a VM or two yourself so the portal flow sticks.
-
Containers, App Service, and networking basics
Close out compute, then open networking so next week's security decisions have somewhere to land.
- Azure Container Registry, Container Instances, and Container Apps.
- App Service plans, scaling, deployment slots, custom DNS, and certificates.
- Virtual networks, subnets, and peering.
-
Networking and monitoring
Finish the networking decisions, then build the monitoring habit you'll keep long after the exam.
- NSGs versus application security groups; Azure Bastion; service endpoints versus private endpoints.
- User-defined routes, Azure DNS, internal and public load balancers.
- Azure Monitor metrics, logs, alert rules, action groups, and Network Watcher.
-
Backup, recovery, and simulation
Cover the last domain, then spend the rest of the week under exam conditions.
- Recovery Services vaults, Azure Backup, backup policies, Azure Site Recovery failover.
- Drill your weakest domain daily with Focus Weak Spots.
- Sit two full-length timed simulator runs before you book the real thing.
Where people lose marks
The hardest AZ-104 topics
Across the five domains, a handful of areas consistently cost candidates marks. None are unfair; they simply reward precise understanding over rote recall. Give these extra attention.
RBAC scope and inheritance
- Role assignments apply at management group, subscription, resource group, and resource scope, and they inherit downward, so effective permissions depend on every level at once.
- Practise reading a scenario and naming the exact scope an assignment belongs at, including where a deny or a resource lock overrides an allow.
Networking security choices
- The networking domain packs in "which one" decisions: NSGs versus application security groups, service endpoints versus private endpoints, and when a user-defined route forces traffic through an appliance.
- Learn what each control actually filters and at what layer, not just its name — the exam's wording is deliberately close.
Reading Bicep and ARM
- Compute questions often show you a Bicep or ARM snippet and ask what it deploys, or what one small edit would change — a reading skill, not a memorising one.
- Deploy a few templates yourself and step through the resource declarations until the syntax reads as quickly as prose.
Storage redundancy and access
- The storage domain crosses two axes that are easy to confuse: the redundancy tier protecting your data, and the access model exposing it.
- Know LRS, ZRS, and geo-redundant options apart from SAS tokens, access keys, and identity-based access, so you can pick the right pair for a given requirement.
Backup versus Site Recovery
- The monitoring domain lumps together two tools that solve different problems: Azure Backup protects and restores data, Azure Site Recovery replicates workloads so they fail over to another region.
- When a question states a recovery-time or recovery-point requirement, reach for the right one without hesitating.
How to practise
Practise the way the exam works
Reading and watching courses builds recognition, not recall, and AZ-104 tests recall under time pressure.
- Retrieval practice: answer from memory before you check the explanation — the effort of retrieving is what fixes the fact.
- Spaced repetition: revisit each topic just as it starts to fade rather than cramming a domain once and never returning; the topic you nailed in week two is the one you'll forget by exam day if you never see it again.
- Full-length simulation: a timed, mixed-domain run is the only way to find out whether you can sustain focus for 100 minutes and budget your time across 40 to 60 questions.
- Do at least two simulator runs before you book, and review every wrong answer properly rather than just noting the score.
Every answer comes with a why
Azure Mastery writes a rationale for every option on every AZ-104 question, so a wrong guess about RBAC scope or storage redundancy teaches you something instead of costing a mark. Exam IQ predicts your score on-device with a confidence range, and the study plan re-targets around your weakest domain. Free to start, and it works offline.
Download Azure Mastery — freeExam day
Tactics for exam day
A handful of habits protect the marks you've already earned.
- Sitting online? Run the system check the day before and clear your desk — proctors ask you to show the room and remove anything within reach.
- Arrive early either way. A rushed start eats into your focus before question one.
- Budget roughly ninety seconds to two minutes per question, and flag anything you hesitate on with mark-for-review instead of burning five minutes on it early.
- Read Bicep and Azure CLI questions twice. The trap is usually one argument or scope, and ten seconds of care catches it.
- Answer every question inside a case study before you move on — you generally cannot return to a case once you leave it.
- Remember the pass mark is 700 out of 1000, scaled. An unfamiliar question isn't a disaster: make your best call and keep moving.
Frequently asked
AZ-104 FAQs
How hard is the AZ-104 exam?
Harder than a Fundamentals exam, because it's practical rather than conceptual: identities and RBAC at scale, storage redundancy and access, VMs and containers, virtual networks, and reading Bicep and Azure CLI snippets. Most candidates with some IT background pass after four to eight weeks of focused study.
How long should I study for AZ-104?
Four to eight weeks with some IT or cloud experience already. Allow two to three months if Azure is genuinely new to you — the exam wants specific PowerShell and CLI behaviour, not just concepts. The six-week plan above is a realistic middle path; compress or stretch it to fit.
Do I need AZ-900 before AZ-104?
Not formally. With under six months of hands-on Azure experience, sit AZ-900 (Microsoft Azure Fundamentals) first for the conceptual map AZ-104 assumes. Already working with Azure day to day? Go straight to AZ-104 — it's the credential most hiring managers actually ask for.
What is the passing score for AZ-104?
700 out of 1000. The score is scaled, not a raw percentage, so it doesn't map to a fixed number of correct answers. Multi-part items usually award one point for each correctly answered component unless the question states otherwise, so treat 700 as a comfortable target, not a line to scrape over.
Does the AZ-104 certification expire?
Yes, annually, and renewal is free: a short assessment on Microsoft Learn inside the six-month window before expiry. It targets recent skills-outline updates, so staying current is easy if you're still in the role. AZ-900 and other Fundamentals certifications don't expire.
How much does AZ-104 cost and can I retake it if I fail?
Pricing varies by country — check Microsoft's exam page for your local fee. If you don't pass:
- First retake: 24 hours after the fail.
- Second and third retakes: a 14-day gap each.
- A five-attempt ceiling within any rolling 12 months, each one a fresh booking.
Ready to start on AZ-104?
AZ-104's simulator runs at real exam weight, every option comes with a rationale, and Exam IQ tracks your readiness on-device with a confidence range. Free to start, works offline.
Download Azure Mastery — free iPhone & iPad · Free to start · No account required