AZ-104 — Microsoft Azure Administrator Exam Blueprint

How to Use This Exam Blueprint

Use this checklist as a practical readiness map for the Microsoft Azure Administrator (AZ-104) exam from Microsoft. It is designed for final review and gap-finding, not as a replacement for hands-on Azure practice.

For each area, ask:

• Can I choose the right Azure service or configuration from a scenario?
• Can I explain why one option is safer, cheaper, more resilient, or easier to operate?
• Can I perform the task in the Azure portal, Azure CLI, or PowerShell when appropriate?
• Can I troubleshoot a misconfiguration using logs, metrics, effective routes, effective permissions, or diagnostic tools?

Do not study only definitions. AZ-104 readiness means being able to administer Azure resources under realistic constraints: least privilege, network isolation, backup requirements, monitoring needs, policy enforcement, and operational troubleshooting.

AZ-104 readiness areas at a glance

Identity and access checklist

Microsoft Entra ID and Azure RBAC

You should be comfortable distinguishing identity, authentication, authorization, and resource access.

Can you do this?

• Create or identify the correct Microsoft Entra user, group, or service principal for a scenario.
• Assign Azure RBAC permissions at the minimum required scope.
• Explain why a user with a directory role may still lack access to Azure resources.
• Explain why a user with Azure RBAC access may not be able to manage Microsoft Entra ID.
• Use a managed identity for an Azure resource that needs access to another Azure service.
• Troubleshoot “access denied” by checking role, scope, inheritance, policy, lock, and data-plane permissions.
• Recognize when privileged, temporary, or reviewed access is safer than permanent broad access.

Access decision checks

Governance and resource organization checklist

Subscriptions, resource groups, tags, locks, and policy

Governance “can you do this?” checklist

• Choose the right resource group structure for lifecycle, access, and deployment needs.
• Apply tags consistently and understand how policy can enforce them.
• Distinguish between a policy denial and an RBAC denial.
• Use locks to protect critical resources from accidental deletion or change.
• Explain how locks can affect normal admin operations.
• Assign policy at the appropriate scope.
• Recognize when remediation is needed for existing noncompliant resources.
• Interpret compliance results and understand that policy does not replace monitoring or access control.

Governance traps

Storage checklist

Storage account readiness

Storage access decision table

Storage command familiarity

You do not need to memorize every switch, but you should understand what each command is trying to accomplish and what object it targets.

az storage account create \
  --name <storage-account-name> \
  --resource-group <resource-group> \
  --location <region> \
  --sku <redundancy-option>

az storage container create \
  --name <container-name> \
  --account-name <storage-account-name>

az storage blob upload \
  --account-name <storage-account-name> \
  --container-name <container-name> \
  --name <blob-name> \
  --file <local-file>

PowerShell-style tasks to recognize:

New-AzStorageAccount
New-AzStorageContainer
Set-AzStorageBlobContent
Get-AzStorageBlob

Storage “can you do this?” checklist

• Choose a storage redundancy option from a resiliency scenario.
• Explain when Blob storage, Azure Files, or managed disks are appropriate.
• Configure secure storage access without exposing public endpoints unnecessarily.
• Generate or evaluate a SAS based on allowed operations, resource scope, and expiration.
• Troubleshoot storage access failures caused by RBAC, SAS, firewall, private endpoint, or key issues.
• Configure lifecycle management for aging data.
• Identify which data protection feature helps recover from deletion or overwrite.
• Select the correct tool for data transfer, such as portal upload, Azure Storage Explorer, AzCopy, Azure CLI, or PowerShell.

Compute checklist

Virtual machines and scale sets

App Service and container readiness

Compute decision cues

Compute “can you do this?” checklist

• Deploy a VM into the correct VNet and subnet.
• Attach and initialize data disks conceptually.
• Configure inbound access securely.
• Use NSGs to allow only required management or application traffic.
• Interpret boot diagnostics, serial console-style clues, and run-command options.
• Resize, stop, restart, redeploy, or reconfigure a VM for troubleshooting.
• Choose between availability sets, zones, and scale sets from a scenario.
• Configure or recognize autoscale rules at a high level.
• Deploy an App Service and configure app settings.
• Understand how deployment slots reduce deployment risk.
• Recognize when container-based deployment is the simpler fit.

Virtual networking checklist

Core networking topics

Network security and routing decision table

Networking “can you do this?” checklist

• Build a VNet and subnet plan from a short scenario.
• Detect overlapping address spaces before peering or VPN design.
• Evaluate NSG rules in priority order.
• Explain the difference between NSG rules on a subnet and on a NIC.
• Troubleshoot blocked traffic using source, destination, port, protocol, priority, and direction.
• Explain when a route table is needed.
• Troubleshoot incorrect routing using effective routes or next-hop analysis.
• Configure or evaluate VNet peering requirements.
• Choose public DNS vs private DNS.
• Explain how private endpoints affect connectivity and name resolution.
• Distinguish private endpoint from service endpoint in scenario terms.
• Select the right load-balancing option based on layer, protocol, and routing behavior.

Monitoring, logging, and alerting checklist

Azure Monitor readiness

KQL readiness

You should be able to read and lightly modify simple KQL queries.

AzureActivity
| where TimeGenerated > ago(24h)
| summarize Count = count() by OperationNameValue, ActivityStatusValue
| order by Count desc

Common KQL skills:

• Filter by time range.
• Filter by resource group, resource provider, operation, or status.
• Summarize counts or averages.
• Sort results.
• Identify failed operations.
• Understand that different tables contain different signal types.

Alert decision checks

Monitoring “can you do this?” checklist

• Enable diagnostic settings for an Azure resource.
• Send logs to a Log Analytics workspace.
• Use metrics for near-real-time operational thresholds.
• Use logs when you need query flexibility or event detail.
• Create an alert rule and connect it to an action group.
• Interpret Azure Activity logs for deployment and administrative changes.
• Use Resource Health to evaluate a resource-specific issue.
• Use Service Health to track broader Azure incidents.
• Select the right troubleshooting signal before changing configuration.

Backup, restore, and business continuity checklist

Backup readiness

Backup decision table

Backup “can you do this?” checklist

• Configure backup protection for an Azure VM conceptually.
• Choose a backup policy based on recovery needs.
• Locate backup jobs and troubleshoot failures.
• Identify restore options from a scenario.
• Distinguish backup from replication or disaster recovery.
• Understand that backup design must match workload, region, access, and retention requirements.
• Explain why monitoring backups is part of administration, not an optional add-on.

Deployment, automation, and admin tooling checklist

Tools you should recognize

Command and artifact readiness

Know the purpose of common command families even if you do not memorize every parameter.

az group create
az vm create
az network vnet create
az network nsg rule create
az role assignment create
az deployment group create
az monitor metrics list

New-AzResourceGroup
New-AzVM
New-AzVirtualNetwork
New-AzRoleAssignment
New-AzResourceGroupDeployment
Get-AzMetric

ARM/Bicep readiness checks:

• Identify parameters, variables, resources, outputs, and dependencies.
• Understand resource group vs subscription-level deployment context conceptually.
• Recognize deployment failures caused by missing permissions, policy denial, naming conflicts, provider issues, or invalid regions.
• Know why templates support repeatability and consistency.
• Understand that declarative deployment describes the desired resource state.

Troubleshooting scenario checklist

High-value “Can you do this?” final readiness list

Identity and governance

• Choose between Microsoft Entra role and Azure RBAC role.
• Assign permissions at the narrowest practical scope.
• Use group-based access for maintainability.
• Explain management-plane vs data-plane permissions.
• Use tags, locks, and policy for governance.
• Diagnose policy vs permission vs lock problems.

Storage

• Select Blob, Azure Files, disks, or another storage option from requirements.
• Secure storage with identity, SAS, firewall rules, or private access.
• Choose a redundancy direction based on resiliency needs.
• Configure lifecycle management for aging objects.
• Troubleshoot access failure using identity, network, and authorization checks.

Compute

• Deploy and configure VMs.
• Troubleshoot VM connectivity and startup issues.
• Choose scale sets for fleets of similar VMs.
• Choose App Service for managed application hosting scenarios.
• Configure scaling, app settings, and deployment concepts.
• Use managed identities for secure service-to-service access.

Networking

• Design non-overlapping VNet and subnet address spaces.
• Evaluate NSG rules by direction, priority, source, destination, protocol, and port.
• Use route tables for custom traffic paths.
• Explain private endpoint DNS implications.
• Choose the right load-balancing pattern.
• Use Network Watcher-style diagnostics to isolate connectivity issues.

Monitoring and recovery

• Choose metrics vs logs for a monitoring requirement.
• Create alert rules and action groups.
• Query logs with basic KQL.
• Use Activity Log for administrative events.
• Configure backup policies and identify restore paths.
• Distinguish backup, restore, replication, and failover concepts.

Common AZ-104 weak areas and traps

Scenario decision prompts

Use these prompts when reviewing practice questions.

Access prompt

1. Who or what needs access?
2. Is the target Microsoft Entra ID, an Azure resource, or data inside a resource?
3. What is the smallest valid scope?
4. Is a built-in role sufficient?
5. Is temporary, group-based, or managed identity access safer?
6. Could a lock, policy, firewall, or private endpoint still block the action?

Networking prompt

1. Are the address spaces valid and non-overlapping?
2. Is the traffic allowed by NSGs in the correct direction?
3. Is there a custom route changing the path?
4. Does DNS resolve to the intended private or public address?
5. Is the service listening and healthy?
6. Which diagnostic tool confirms the next hop or blocking rule?

Storage prompt

1. What type of data is being stored?
2. How often is it accessed?
3. Who or what needs access?
4. Is access temporary or ongoing?
5. Should traffic remain private?
6. What recovery or retention capability is required?

Monitoring prompt

1. Is the signal a metric, log event, activity event, or health event?
2. Where should the data be collected?
3. What condition should trigger an alert?
4. Who or what should be notified?
5. Is historical query or dashboarding required?
6. How will you verify the alert works?

Final-week checklist

Hands-on review

• Create a resource group, VNet, subnet, NSG, VM, and storage account in a test environment.
• Assign RBAC to a user or group at resource group scope.
• Create and test a storage container access scenario.
• Configure a VM with restricted inbound access.
• Create a basic alert with an action group.
• Enable diagnostic settings for at least one resource.
• Run a simple KQL query in Log Analytics.
• Review backup configuration and restore options conceptually.
• Deploy or inspect a simple ARM template or Bicep file.
• Troubleshoot one intentional network or permission misconfiguration.

Concept review

• Revisit all wrong answers from recent practice sets.
• Write down the difference between RBAC, policy, and locks.
• Write down the difference between private endpoints and service endpoints.
• Write down the difference between metrics, logs, and activity logs.
• Write down the difference between backup and replication.
• Review when to choose VM, scale set, App Service, or container deployment.
• Review storage access methods: RBAC, SAS, keys, managed identities, and network controls.
• Review the troubleshooting order for VM connectivity and storage access.

Exam-readiness self-check

You are close to ready for AZ-104 when you can consistently:

• Explain why the correct answer is better than two plausible alternatives.
• Identify the Azure scope involved before choosing an access or governance answer.
• Read a scenario and separate identity, network, storage, compute, and monitoring requirements.
• Troubleshoot from symptoms instead of guessing configuration changes.
• Recognize least-privilege and private-access patterns.
• Work through short command, template, or KQL examples without being distracted by syntax.
• Finish mixed-topic practice questions with time left for review.

Practical next step

Use this Exam Blueprint to mark weak areas, then practice with mixed AZ-104 scenarios that force service selection, configuration judgment, and troubleshooting. Prioritize hands-on repetition for any item you cannot explain or perform without notes.