Introduction
The AZ-104 (Microsoft Azure Administrator Associate) is the most valuable mid-level certification in the Azure ecosystem. It validates that you can configure, manage, monitor, and secure Azure environments end-to-end — the daily skills hiring managers actually look for. If AZ-900 proved you understand cloud concepts, AZ-104 proves you can operate Azure in production.
This guide covers the current AZ-104 objectives (refreshed in 2024 and still current in 2026), exam logistics, domain-by-domain breakdown, the hands-on skills you must build, and a realistic 8–12 week prep timeline.
Who Should Take AZ-104
AZ-104 is the right fit if you have:
- 6+ months of hands-on Azure experience (or strong on-prem admin background)
- Working knowledge of PowerShell, Azure CLI, or ARM/Bicep templates
- Familiarity with networking concepts (TCP/IP, DNS, VPNs)
- Comfort with virtualization (Hyper-V, VMware) or Linux/Windows server administration
If you don’t have this background yet, take AZ-900 first and spend 2–3 months in a free Azure account before attempting AZ-104.
AZ-104 Exam Specifications
| Attribute | Detail |
|---|---|
| Exam code | AZ-104 |
| Title | Microsoft Certified: Azure Administrator Associate |
| Format | Multi-choice, multi-select, case study, drag-and-drop, hot-area, sometimes a lab |
| Questions | 40–60 |
| Duration | 120 minutes testing + ~30 minutes admin |
| Passing score | 700 / 1000 (scaled) |
| Cost | $165 USD |
| Languages | English, Japanese, Chinese, Korean, German, French, Spanish, and more |
| Delivery | Pearson VUE in person or online |
| Validity | 1 year (free renewal via Microsoft Learn assessment) |
The 1-year validity with free online renewal is unusual and important: you don’t have to pay $165 again — just pass a 50-question renewal assessment on Microsoft Learn within the year before expiration.
AZ-104 Domains and Weights (Current 2026 Objectives)
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 20–25% |
| Implement and manage storage | 15–20% |
| Deploy and manage Azure compute resources | 20–25% |
| Implement and manage virtual networking | 15–20% |
| Monitor and maintain Azure resources | 10–15% |
Domain 1: Manage Azure Identities and Governance (20–25%)
The largest domain. Master these or fail the exam:
- Microsoft Entra ID: users, groups, administrative units, device registration, self-service password reset
- External identities: B2B collaboration, guest users
- Role-Based Access Control (RBAC): custom roles, role assignments, privileged identity management (PIM) basics
- Subscriptions and governance: management groups, cost analysis, budgets, resource tagging, resource locks
- Azure Policy: built-in vs. custom policies, initiatives, exemptions, remediation
Expect case-study questions like “User X needs to manage VMs in resource group Y but should not be able to delete the resource group. What role assignment is correct?”
Domain 2: Implement and Manage Storage (15–20%)
Storage is where candidates lose points unexpectedly. You need to know:
- Storage accounts: types (general purpose v2, premium block blob, premium file shares), redundancy (LRS, ZRS, GRS, GZRS, RA-GRS, RA-GZRS)
- Access: access keys, shared access signatures (SAS), stored access policies, Entra ID authentication for blob/queue
- Blob storage: access tiers (Hot, Cool, Cold, Archive), lifecycle management, immutability, object replication
- Azure Files: SMB and NFS shares, Azure File Sync, mounting on Windows/Linux
- Tools: Storage Explorer, AzCopy
Domain 3: Deploy and Manage Azure Compute Resources (20–25%)
The other largest domain. Hands-on essential:
- Virtual Machines: creating, sizing, availability sets, availability zones, scale sets (VMSS), encryption (Azure Disk Encryption, server-side encryption)
- VM management: custom script extensions, DSC, run command, Just-in-Time access
- Containers: Azure Container Instances (ACI), Azure Container Apps, Azure Kubernetes Service (AKS) basics — node pools, scaling, upgrades
- App Service: plans, deployment slots, custom domains, TLS, backups, scaling
- Templates: ARM and Bicep — deploy, export, modify; understanding parameters, variables, resources, outputs
Domain 4: Implement and Manage Virtual Networking (15–20%)
Networking is where exams reward depth:
- Virtual Networks: address spaces, subnets, peering (regional and global), service endpoints, private endpoints
- IP addressing: public IPs, NAT Gateway, IP forwarding
- Routing: system routes, user-defined routes (UDRs), Border Gateway Protocol (BGP) with VPN/ExpressRoute
- Connectivity: Site-to-Site VPN, Point-to-Site VPN, ExpressRoute (concepts), Virtual WAN basics
- DNS: Azure DNS public zones, private DNS zones, conditional forwarding
- Network security: Network Security Groups (NSGs), Application Security Groups (ASGs), Azure Firewall, Azure Bastion
- Load balancing: Azure Load Balancer (basic vs. standard), Application Gateway, Traffic Manager, Front Door (positioning)
Domain 5: Monitor and Maintain Azure Resources (10–15%)
Smallest domain by weight but high-yield questions:
- Azure Monitor: metrics, logs, alerts, action groups
- Log Analytics: workspaces, KQL basics, agents (Azure Monitor Agent)
- Backup: Recovery Services vault, Azure Backup for VMs and files, retention policies
- Disaster recovery: Azure Site Recovery (ASR) for VMs
- Network monitoring: Network Watcher, NSG flow logs, Connection Monitor
What the Real Exam Feels Like
Three things make AZ-104 noticeably harder than candidates expect:
- Case study questions. Two-page scenarios with 5–7 dependent questions. Read the whole case before answering — questions cross-reference earlier requirements.
- Sometimes a live lab. Not all exam deliveries include a hands-on lab, but some do. You may be asked to actually configure a resource group, NSG, or VM in a live Azure environment.
- Multiple correct answers, only one best. Several questions present 3–4 technically correct answers; you must choose the most cost-effective, secure, or scalable one.
Prerequisites and Hands-On Skills
Microsoft recommends 6 months of Azure administration experience before sitting AZ-104. If you don’t have that on the job, simulate it:
Build these in a free Azure account before booking the exam:
- Create a hub-and-spoke virtual network with peering and an Azure Firewall
- Deploy a Linux and a Windows VM, configure SSH and RDP via Azure Bastion
- Set up Azure Files with both SMB and Azure File Sync to a local machine
- Configure a storage account with lifecycle policies and SAS tokens
- Deploy an AKS cluster with two node pools and scale it
- Build an ARM or Bicep template from scratch for a 2-tier app
- Create RBAC custom roles and assign them at different scopes
- Configure Azure Backup for a VM and perform a test restore
- Build a Log Analytics query to find failed sign-ins or VM errors
If you can do all nine without referring to documentation, you’re exam-ready.
Recommended 8–12 Week Study Plan
Weeks 1–2: Identity and Governance
- Microsoft Entra ID deep dive, B2B, MFA, Conditional Access basics
- RBAC scopes and custom roles
- Subscriptions, management groups, tags, locks
- Azure Policy and initiatives
Weeks 3–4: Storage
- Storage account types and redundancy
- Blob tiers and lifecycle
- Azure Files and File Sync
- Authentication (keys, SAS, Entra ID)
Weeks 5–6: Compute
- VMs, availability sets, zones, VMSS
- Container services overview, AKS basics
- App Service and deployment slots
- ARM and Bicep templates
Weeks 7–8: Networking
- VNets, subnets, peering, private endpoints
- NSGs and ASGs
- VPN, ExpressRoute, Bastion
- Load balancers and traffic routing
Weeks 9–10: Monitoring and Backup
- Azure Monitor, Log Analytics, KQL basics
- Backup and Site Recovery
- Network Watcher
Weeks 11–12: Practice Exams and Review
- 3 full-length mocks from Sailor.sh’s AZ-104 mock exam bundle
- Review every wrong answer
- Targeted re-study on weak domains
- Live lab practice in your free Azure account
Cost Math
- Exam fee: $165 USD
- Free Microsoft Learn paths: $0
- Azure free account: $0 (uses your $200 credit and free-tier services)
- Practice exam bundle: ~$30–60
- Total realistic cost: ~$200
If you fail, retakes cost the full $165 each — making practice exams a high-ROI insurance policy.
Salary Impact
AZ-104 sits in a strong salary band:
- US average: $100K–$135K for “Azure Administrator + AZ-104”
- UK average: £55K–£75K
- India average: ₹10L–₹22L
The cert alone doesn’t unlock these salaries — but combined with 1–3 years of hands-on Azure work, it consistently signals readiness for senior administrator and junior cloud engineer roles.
AZ-104 vs. Related Certifications
| Certification | Role Focus | Difficulty | Validity |
|---|---|---|---|
| AZ-900 | Fundamentals (anyone) | Easy | Lifetime |
| AZ-104 | Administrator (ops/IT) | Medium-Hard | 1 year (free renewal) |
| AZ-204 | Developer | Medium-Hard | 1 year |
| AZ-305 | Architect Expert | Hard | 1 year |
| AZ-400 | DevOps Expert | Hard (requires AZ-104 or AZ-204) | 1 year |
| AZ-500 | Security Engineer | Hard | 1 year |
AZ-104 is the gateway to most expert-level Azure certifications. It’s required for AZ-305 and one prerequisite path for AZ-400.
Most Common Reasons People Fail AZ-104
- Skipping hands-on practice. Watching tutorials doesn’t build the muscle memory case-study questions test.
- Weak Entra ID and RBAC knowledge. This is the highest-weighted domain and the one most candidates underestimate.
- Ignoring KQL. You don’t need to be a query expert, but you should read a basic Log Analytics query without panic.
- Booking too early. Most candidates need 8–12 weeks. Don’t book at week 4 because you “want a deadline.”
- Not practicing case studies. Standalone practice questions don’t prepare you for multi-question case-study sections.
After You Pass
Your AZ-104 unlocks several natural next steps:
- AZ-305 (Solutions Architect Expert): for architect-track careers (requires AZ-104)
- AZ-400 (DevOps Engineer Expert): for DevOps/SRE careers
- AZ-500 (Security Engineer Associate): for security-focused administrators
- AI-102 (AI Engineer): if you’re pivoting to AI/ML on Azure
Frequently Asked Questions
Q: Is AZ-104 hard? A: Medium-hard. The breadth is the challenge — you must be comfortable across identity, networking, storage, compute, and monitoring. Depth in any one area isn’t enough.
Q: How long should I study for AZ-104? A: 8–12 weeks for working professionals with prior cloud or admin experience. 12–16 weeks if AZ-104 is your first technical Azure certification.
Q: Do I need AZ-900 before AZ-104? A: No, it’s not required. But the conceptual foundation in AZ-900 is assumed knowledge for AZ-104, so it’s recommended.
Q: Will I see a hands-on lab on the AZ-104? A: Sometimes. Microsoft introduces and removes lab components based on testing windows. Prepare as if you’ll see one — that practice helps the MCQs anyway.
Q: How do I renew AZ-104? A: Pass the free renewal assessment on Microsoft Learn within 6 months before expiration. No fee.
Q: Can I take AZ-104 online from home? A: Yes, via Pearson VUE OnVUE. You’ll need a webcam, a quiet private room, a clean desk, and a stable internet connection. Lab sections may not be available in all online deliveries.
Q: What’s the best way to practice for AZ-104 case studies? A: Realistic, scenario-based mock exams. Sailor.sh’s AZ-104 mock exam bundle includes case-study sections that mirror the real exam structure.
Ready to Start?
AZ-104 is one of the highest-ROI certifications in the Microsoft ecosystem — but it rewards hands-on practitioners, not memorizers. Spin up a free Azure account, build the 9 hands-on skills listed above, and drill realistic mock exams until you consistently score 80%+.
Start with a free AZ-104 practice test on Sailor.sh to identify your weakest domain. Then work the 8–12 week study plan with focused, exam-style practice.