AZ-104 — Microsoft Azure Administrator Quick Reference

Exam identity and use

This independent Quick Reference supports candidates preparing for Microsoft Azure Administrator (AZ-104) from Microsoft. Use it as a compact decision aid while practicing scenario questions, labs, and troubleshooting tasks.

AZ-104 focuses on administering Azure environments across these practical areas:

Azure resource model and governance

Scope hierarchy

High-yield points:

• Azure RBAC assignments are inherited downward from management group to subscription to resource group to resource.
• Resource groups are not a network boundary, region boundary, or identity boundary.
• A resource can belong to only one resource group.
• Moving resources may require moving dependencies and may temporarily affect operations.
• Tags support organization, automation, and cost reporting, but tags are not inherited automatically by default.

Governance controls: choose the right tool

Azure RBAC roles and traps

Common traps:

• Management-plane vs data-plane: Contributor on a storage account can manage the account, but blob data access often requires a Storage Blob Data role or keys/SAS.
• Deny assignments can override allow assignments.
• Locks do not grant permissions. A user still needs RBAC access.
• A Delete lock prevents resource deletion; a ReadOnly lock can block management operations that normally write or retrieve keys.
• Azure Policy can deny or audit deployments, but it does not authenticate users.

Microsoft Entra ID objects

Managed identity decision table

Azure Policy effects

Policy remediation reminders:

• Existing non-compliant resources are not always fixed automatically.
• Remediation for deploy/modify effects may need a managed identity.
• Compliance evaluation is not the same as access authorization.

Storage quick reference

Storage service selection

Storage account and redundancy choices

Exam traps:

• Redundancy choice is made for the storage account, not for individual blobs.
• Changing redundancy can have restrictions depending on source/target combination.
• Geo-redundancy helps with regional failure, not accidental deletion. Use soft delete/versioning/backup patterns for that.

Blob access tiers and protection

Storage security decision table

Azure Files cues

Storage commands to recognize

## Create a resource group and storage account
az group create --name rg-demo --location eastus
az storage account create \
  --name mystorageacctdemo \
  --resource-group rg-demo \
  --location eastus \
  --sku Standard_LRS

## Upload with AzCopy using a SAS URL
azcopy copy "./data/*" "https://ACCOUNT.blob.core.windows.net/CONTAINER?SAS" --recursive=true

## Show storage account network rules
az storage account network-rule list \
  --resource-group rg-demo \
  --account-name mystorageacctdemo

Compute quick reference

VM availability and scaling

VM administration tasks

Managed disks

App hosting and container choices

App Service cues

Compute commands to recognize

## Create a VM with SSH key authentication
az vm create \
  --resource-group rg-demo \
  --name vm-demo \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys

## Open inbound port through NSG rule
az vm open-port \
  --resource-group rg-demo \
  --name vm-demo \
  --port 22

## Assign a system-managed identity to a VM
az vm identity assign \
  --resource-group rg-demo \
  --name vm-demo

Networking quick reference

Subnet sizing

Azure reserves addresses in each subnet. For IPv4 subnet planning, a common exam calculation is:

Examples:

Core network components

NSG rule evaluation

If traffic fails, check both subnet-level and NIC-level NSGs. Effective security rules show the combined result.

Routing decision points

Route selection reminders:

• Longest prefix match is evaluated first.
• User-defined routes override default system routes for matching prefixes.
• BGP routes from gateways can affect effective routes.
• VNet peering is not automatically transitive; hub-spoke designs need explicit routing.

Connectivity and edge service selection

Private Endpoint vs Service Endpoint

DNS quick reference

Network troubleshooting workflow

Monitoring, logging, and maintenance

Azure Monitor data sources

Diagnostic settings

High-yield trap: A resource may emit metrics automatically, but detailed resource logs often require diagnostic settings.

Alert selection

KQL patterns to recognize

// Recent administrative delete operations
AzureActivity
| where OperationNameValue has "delete"
| project TimeGenerated, Caller, ResourceGroup, ResourceProviderValue, ActivityStatusValue

// VMs that stopped sending heartbeat
Heartbeat
| summarize LastSeen=max(TimeGenerated) by Computer
| where LastSeen < ago(15m)

Backup and recovery choices

Backup traps:

• Backup protects against deletion/corruption; availability zones protect against infrastructure failure. They solve different problems.
• Vault redundancy and resource redundancy are separate design choices.
• Site Recovery is for replication/failover, not routine file-level backup.

Maintenance and optimization

High-yield scenario decisions

Access denied checklist

1. Confirm the identity: user, group, service principal, or managed identity.
2. Confirm the scope: management group, subscription, resource group, or resource.
3. Check role assignment inheritance.
4. Check whether the task is management plane or data plane.
5. Check deny assignments, policy deny effects, and locks.
6. For PaaS data access, check firewall, private endpoint, and DNS.
7. If using PIM or just-in-time access, confirm activation.

“Cannot deploy resource” checklist

“Need high availability” quick choices

Common exam traps

Compact command reference

## Select subscription
az account set --subscription "<subscription-id-or-name>"

## Create a resource group
az group create --name rg-app-prod --location eastus

## Assign a built-in role at resource group scope
az role assignment create \
  --assignee "<user-or-principal-id>" \
  --role "Contributor" \
  --resource-group rg-app-prod

## Deploy an ARM/Bicep template to a resource group
az deployment group create \
  --resource-group rg-app-prod \
  --template-file main.bicep \
  --parameters @parameters.json

## View effective routes for a NIC
az network nic show-effective-route-table \
  --resource-group rg-app-prod \
  --name nic-vm01

## View effective NSG rules for a NIC
az network nic list-effective-nsg \
  --resource-group rg-app-prod \
  --name nic-vm01

PowerShell equivalents often appear in admin tasks:

Connect-AzAccount
Set-AzContext -Subscription "<subscription-id-or-name>"

New-AzResourceGroup -Name "rg-app-prod" -Location "eastus"

New-AzRoleAssignment `
  -SignInName "user@contoso.com" `
  -RoleDefinitionName "Reader" `
  -ResourceGroupName "rg-app-prod"

Get-AzEffectiveRouteTable `
  -NetworkInterfaceName "nic-vm01" `
  -ResourceGroupName "rg-app-prod"

Final review checklist

Before your next AZ-104 practice block, make sure you can:

• Choose between RBAC, Policy, locks, tags, and management groups.
• Distinguish management-plane access from data-plane access.
• Select storage redundancy, access tier, SAS/RBAC model, and private connectivity pattern.
• Choose VM availability sets, availability zones, scale sets, App Service, ACI, or AKS based on scenario wording.
• Troubleshoot NSGs, UDRs, peering, DNS, private endpoints, and load balancer probes.
• Configure diagnostic settings, alerts, Log Analytics queries, Backup, and Site Recovery at a conceptual admin level.

Next step: use this Quick Reference beside timed, scenario-based AZ-104 practice questions, then turn every missed question into a one-line rule or troubleshooting checklist.