AZ-104 — Microsoft Azure Administrator Quick Review

Quick Review purpose

This independent Quick Review is for candidates preparing for the real Microsoft Azure Administrator (AZ-104) exam from Microsoft. Use it to refresh the main administration decisions before moving into topic drills, mock exams, and detailed explanations.

The exam rewards practical Azure administration judgment: choosing the correct service feature, applying least privilege, understanding where a setting is scoped, and recognizing what happens when networking, identity, storage, compute, and monitoring controls interact.

High-yield AZ-104 mental model

Think like an Azure administrator responsible for day-to-day operations:

A strong AZ-104 answer usually follows this order:

1. Identify the resource type and scope.
2. Separate identity, network, and configuration problems.
3. Prefer least privilege and least operational effort.
4. Check whether the question asks for high availability, security, cost, or recoverability.
5. Watch for wording such as existing resources, without downtime, minimum administrative effort, least privilege, or no public internet access.

Identity and access review

Microsoft Entra ID and Azure RBAC

Microsoft Entra ID is the identity provider. Azure role-based access control controls permissions to Azure resources.

RBAC scope decision rule

Assign the role at the narrowest scope that still meets the requirement.

Key built-in roles:

Management plane vs data plane

This is one of the most common AZ-104 traps.

If a user can manage a storage account but cannot read blobs, the missing permission is likely a data-plane role, such as a Storage Blob Data role.

Identity traps to avoid

• Contributor is not Owner: Contributor cannot assign RBAC roles.
• Reader cannot view secrets by default: viewing a resource is not the same as reading protected data.
• A managed identity has no useful permissions until assigned to the target service.
• RBAC inheritance flows downward from management group to subscription to resource group to resource.
• Deny assignments and policy effects can override expected access in some scenarios.
• Removing a user from a group can remove inherited resource permissions even if no direct role assignment exists.

Governance: policy, locks, tags, and cost controls

Governance tool decision table

Azure Policy vs RBAC

RBAC answers who can act. Policy answers what is allowed or required.

Resource locks

Important trap: resource locks operate at the Azure management layer. A delete lock on a storage account helps prevent deletion of the storage account resource, but it is not a substitute for data protection, backup, versioning, soft delete, or data-plane permissions.

Tags and organization

Tags are useful for cost allocation, ownership, environment, and automation. They are not a security boundary.

Common traps:

• Tags are not automatically inherited in all scenarios.
• Policy can require or append tags depending on configuration.
• Moving resources between resource groups may affect management scope, but it does not automatically redesign the resource.

Storage review

Storage account choices

Redundancy quick comparison

Do not assume every redundancy conversion is immediate, free, or available for every account type. In exam questions, choose the redundancy that matches the stated resilience requirement and budget.

Blob access tiers

Lifecycle management can move blobs between tiers or delete them based on rules. If the question asks for automatic cost optimization over time, look for lifecycle management.

Storage security

SAS traps:

• A SAS grants access according to its permissions, resource scope, and time window.
• Revoking a SAS can be difficult if it was created directly from account keys.
• A user delegation SAS for Blob storage is tied to Microsoft Entra authentication and is often the more least-privilege choice when supported.

Azure Files and Azure File Sync

Common mistakes:

• Confusing Blob storage with Azure Files. Blob is object storage; Azure Files provides file shares.
• Forgetting that network access, identity, share permissions, and NTFS permissions can all matter depending on the scenario.
• Assuming a storage account firewall rule automatically creates private connectivity. Private endpoints are different.

Compute review

Virtual machines

High-yield VM concepts:

Availability choice:

VM disks

Common trap: a stopped VM can still incur storage charges for disks. To stop compute billing, the VM must be deallocated, but attached disks and other resources can still cost money.

App Service

Decision points:

• Scaling up changes the plan tier/size.
• Scaling out adds instances.
• Deployment slots reduce deployment risk.
• The App Service plan is the billing and compute container.

Containers

For AZ-104, focus on administrative tasks: deployment, scaling, networking, identity, and monitoring rather than deep Kubernetes internals.

ARM templates, Bicep, and deployment behavior

You may see infrastructure deployment concepts.

Trap: if the question asks for repeatable deployments, do not choose manual portal configuration.

Networking review

Addressing and subnet basics

Azure reserves IP addresses in each subnet. For IPv4 subnet sizing, a useful review formula is:

\[ \text{usable IPv4 addresses} = 2^{(32 - \text{prefix length})} - 5 \]

Common traps:

• Subnet address ranges cannot overlap within a VNet.
• Peered VNets cannot have overlapping address spaces.
• Some Azure services require dedicated subnets or minimum subnet sizes.
• Resizing a subnet may be blocked if resources are already deployed into it.

NSGs, ASGs, and effective security rules

NSG troubleshooting order:

1. Identify source, destination, port, and protocol.
2. Check NSG on source subnet/NIC and destination subnet/NIC.
3. Review rule priority.
4. Consider default rules.
5. Check route tables, firewall/NVA, and application listening state.

Routes and next hops

Route traps:

• UDRs can break connectivity if the next hop is wrong.
• Peering alone does not make routing transitive.
• Gateway transit must be configured intentionally.
• DNS resolution and routing are separate problems.

VNet peering

Private endpoint vs service endpoint

Private endpoint trap: creating the endpoint is not enough if clients still resolve the public hostname to a public IP. Private DNS configuration is often the missing step.

Load balancing and traffic distribution

Do not choose Application Gateway for simple non-HTTP TCP load balancing. Do not choose Traffic Manager for packet-level load balancing; it uses DNS responses.

DNS

DNS is a frequent hidden cause of private endpoint failures.

Monitoring, alerts, and backup

Azure Monitor core components

Metrics vs logs:

Diagnostic settings

A common mistake is assuming logs are automatically available in Log Analytics. Many platform logs must be sent using diagnostic settings.

Diagnostic settings can route supported logs and metrics to destinations such as a Log Analytics workspace, storage account, or event streaming destination. Choose the destination based on query, retention, archive, or integration needs.

Alerts

Alert design:

1. Choose the signal: metric, log, activity log, service health, or resource health.
2. Define condition and threshold.
3. Define scope.
4. Attach action group.
5. Tune frequency, severity, and dimensions where relevant.

Trap: an alert rule without an action group may evaluate but not notify the intended people.

Backup and recovery

Backup decision points:

• Backup protects against deletion, corruption, and restore scenarios.
• Replication/failover protects availability in disaster scenarios.
• Snapshots are not a full backup strategy by themselves.
• Vault, region, policy, retention, and supported workload matter.

Cross-topic decision rules

“Least privilege” questions

When a question says least privilege, avoid broad roles.

“No public internet access” questions

Look for a combination of:

• Private endpoint
• Private DNS zone
• Disabled public network access where supported
• VNet integration or subnet placement
• NSG/route/firewall alignment
• Correct client network path

Do not rely on an NSG alone if the service endpoint is still public and the requirement is private access.

“Minimum administrative effort” questions

Prefer managed and built-in features:

“High availability” questions

“Troubleshoot connectivity” questions

Use this path:

1. DNS: does the name resolve to the expected IP?
2. Source network: subnet, NIC, NSG, route table.
3. Destination network: NSG, firewall, private endpoint, service firewall.
4. Routing: next hop, UDR, peering, gateway, NVA.
5. Service configuration: listener, port, protocol, access policy.
6. Identity: if network works but access fails, check RBAC, keys, SAS, or app identity.
7. Logs: Network Watcher, flow logs where configured, diagnostic logs, activity log.

Common candidate mistakes

Quick command and tooling awareness

AZ-104 is not a pure command memorization exam, but you should recognize common administrative tooling.

Focus less on memorizing every parameter and more on knowing what the command is trying to configure: RBAC assignment, VM operation, storage setting, route, NSG rule, diagnostic setting, or deployment.

Fast self-check before practice

Use these prompts before starting topic drills:

• Can you explain the difference between Owner, Contributor, and User Access Administrator?
• Can you choose between Azure Policy, RBAC, locks, and tags?
• Can you distinguish storage account management access from blob data access?
• Can you choose between private endpoint and service endpoint?
• Can you troubleshoot a blocked VM connection using NSGs, UDRs, DNS, and service configuration?
• Can you choose the right load balancing service for Layer 4, Layer 7, and DNS-based routing?
• Can you explain when to use metrics, logs, activity log, and diagnostic settings?
• Can you choose between backup, snapshot, and site recovery?

If any answer feels uncertain, use targeted topic drills before attempting a full mock exam.

Practice plan for AZ-104

After this Quick Review, move into IT Mastery practice in this order:

1. Topic drills for identity, governance, networking, storage, compute, and monitoring.
2. Original practice questions that force service selection and least-privilege decisions.
3. Scenario sets combining networking, RBAC, diagnostics, and recovery.
4. Timed mock exams to practice reading constraints under pressure.
5. Detailed explanations for every missed or guessed answer.

For each missed question, write down:

• The Azure service or feature being tested.
• The keyword you missed.
• The wrong assumption you made.
• The decision rule that would have led to the correct answer.

Final exam-readiness reminders

• Always identify the scope: tenant, management group, subscription, resource group, resource, subnet, NIC, or data object.
• Separate management-plane access from data-plane access.
• Prefer built-in managed Azure features when the question asks for minimum effort.
• Use least privilege unless the scenario clearly requires broad control.
• Treat DNS as a first-class part of private networking.
• Do not ignore diagnostic settings when logs are required.
• Match availability and recovery answers to the failure the question is trying to survive.

Next step: use the AZ-104 question bank for focused topic drills first, then move to mixed mock exams with detailed explanations once your weak areas are visible.

Continue in IT Mastery

Use this Quick Review as a final concept map, then move into IT Mastery for focused topic drills, mixed practice sets, timed mock exams, and detailed explanations. The practice questions are original IT Mastery practice items; they are not official Microsoft questions, copied live-exam content, or exam dumps.