Introduction
Microsoft’s own guidance puts a successful AZ-104 candidate at roughly 120 to 140 hours of preparation. Thirty days is enough to cover that if you already administer infrastructure and can give the exam four hours a day, or if you are starting from a strong AZ-900 base and can give it more. This plan spends the first three weeks building and breaking things in a real subscription, and the last week proving you can do it under a clock.
Every day has an output. If you cannot produce the output, that day is not finished.
Who This Plan Is For
You are in the audience Microsoft describes if you are comfortable with operating systems, networking, servers, and virtualization, and you have at least touched PowerShell, the Azure CLI, the Azure portal, ARM templates or Bicep, and Microsoft Entra ID. If two or three of those are new to you, stretch this plan to 45 days rather than skipping the hands-on work.
The Four Week Structure
| Week | Theme | Hours | Goal |
|---|---|---|---|
| 1 | Identity, governance, and storage | 28h | Role scope and storage access are second nature |
| 2 | Compute and deployment | 28h | Predict what a deployment and a resize actually do |
| 3 | Networking and monitoring | 28h | Trace a packet and build an alert without notes |
| 4 | Timed mocks and weak domain drilling | 30h | Clear 700 on two consecutive full-length exams |
Day 0: Setup
- Create or clean up an Azure subscription you can afford to break. A pay as you go subscription with a small budget and a cost alert is ideal.
- Install the Azure CLI and the Az PowerShell module locally, or commit to Cloud Shell.
- Bookmark the official AZ-104 study guide, which lists the skills measured as of April 17, 2026.
- Take the free 20-question AZ-104 practice test cold. Do not study first. Your score here is the baseline you will beat in week four, and the domain breakdown tells you where to spend the extra hours.
Week 1: Identities, Governance, and Storage (Days 1 to 7)
This domain pair is 35 to 45 percent of the exam. Front loading it is deliberate.
| Day | Topic | Output |
|---|---|---|
| 1 | Microsoft Entra users, groups, guests, and bulk operations | Create a dynamic user group and watch membership change when you edit an attribute |
| 2 | Licensing, usage location, group based licensing, and self-service password reset | Assign a license through a group and reproduce one licensing error deliberately |
| 3 | Azure RBAC: built-in roles, scope, inheritance, Actions and DataActions | Assign Storage Blob Data Reader and prove Contributor cannot read the blob data |
| 4 | Elevate access, Microsoft Entra roles versus Azure roles, deny assignments | Elevate access on your own tenant, then switch it back off |
| 5 | Azure Policy: definitions, initiatives, effects, exemptions, remediation | Apply a Modify policy and run a remediation task against an existing resource |
| 6 | Subscriptions, management groups, resource moves, locks, tags, budgets | Move a resource between groups and apply a ReadOnly lock, then find what it breaks |
| 7 | Storage accounts, redundancy, access tiers, and lifecycle management | Write a lifecycle rule with a prefix filter and predict where a blob lands in 100 days |
Week 2: Compute and Deployment (Days 8 to 14)
| Day | Topic | Output |
|---|---|---|
| 8 | Storage security: firewalls, service endpoints, private endpoints | Lock a storage account down and regain access from a virtual machine only |
| 9 | Shared access signatures, stored access policies, key rotation | Revoke one partner’s access without touching anyone else’s |
| 10 | Azure Files, identity based access, snapshots, and share protection | Mount a file share and restore a file from a snapshot |
| 11 | Virtual machines: sizes, disks, availability sets, availability zones | Resize a virtual machine and record which changes required a deallocation |
| 12 | ARM templates and Bicep, deployment modes, what-if | Run a what-if against a complete mode deployment and read the delete list |
| 13 | Scale sets, autoscale rules, and encryption at host | Build a scale set with a schedule based autoscale rule |
| 14 | Containers: Azure Container Registry, Container Instances, Container Apps | Push an image and run it in both Container Instances and Container Apps |
Checkpoint: retake the free practice test. If identity or storage questions still miss, spend the catch-up hours there before moving on.
Week 3: Networking and Monitoring (Days 15 to 21)
| Day | Topic | Output |
|---|---|---|
| 15 | Virtual networks, subnets, address planning, and peering | Build a hub and two spokes, then explain why the spokes cannot reach each other |
| 16 | Network security groups, application security groups, effective rules | Break a flow on purpose and diagnose it with effective security rules |
| 17 | Route tables, next hop types, and effective routes | Force traffic through a virtual appliance route and read the effective routes |
| 18 | Load balancing and Azure Bastion | Publish a two virtual machine backend and reach a machine with no public IP address |
| 19 | Azure DNS public zones, private zones, and virtual network links | Resolve a name across a peering with a linked private zone |
| 20 | Azure Monitor: metrics, diagnostic settings, Log Analytics, KQL | Write three queries against AzureActivity and Heartbeat |
| 21 | Alerts, action groups, alert processing rules, Network Watcher | Fire a real alert to your own email and then suppress it on a schedule |
Week 4: Backup, Recovery, and Timed Mocks (Days 22 to 30)
| Day | Focus | Output |
|---|---|---|
| 22 | Recovery Services vaults, backup policies, restore options | Perform a file level recovery from a recovery point |
| 23 | Azure Site Recovery, replication, test failover | Run a test failover in an isolated network |
| 24 | Full-length mock exam 1, timed at 100 minutes | Score recorded, every miss written down by domain |
| 25 | Review day: rebuild the two weakest topics in the portal | No notes, no video, just the configuration |
| 26 | Full-length mock exam 2, timed | Score, plus a list of the traps that caught you twice |
| 27 | Review day: read the explanations for every miss from both mocks | One sentence per topic that separates the confusable pair |
| 28 | Full-length mock exam 3, timed | Target 700 or higher on the 1 to 1000 scale |
| 29 | Light review, pacing rehearsal, exam logistics | Booking confirmed, ID ready, workspace or test center checked |
| 30 | Exam day | Pass |
Weekly Checkpoints That Matter
- End of week 1: you can explain the difference between a Microsoft Entra role and an Azure role without hedging, and you can revoke a single shared access signature.
- End of week 2: you can predict what complete mode deletes, and you know which virtual machine changes require a deallocation.
- End of week 3: you can trace an inbound packet through both network security groups and name the winning rule.
- End of week 4: two consecutive full-length mocks above 700.
Five Ways This Plan Goes Wrong
- Watching instead of building. The exam asks what happens when you do the thing. Videos cannot answer that for you.
- Skipping the identity domain because it feels like paperwork. It carries the joint largest weight and it fails the most candidates.
- Leaving all mock exams to the final two days. You need time to act on what they reveal.
- Studying without a clock. A 100 minute paper punishes the candidate who has never rehearsed the pacing.
- Assuming Microsoft Learn access in the exam will save you. It is available inside the exam interface, and your clock keeps running the whole time.
Exam Week Logistics
The exam runs 100 minutes and is delivered through Pearson VUE, either online proctored or at a test center. The fee is USD 165 in most regions, priced per region and subject to change. A first failure means waiting 24 hours before a retake, then 14 days between later attempts, with five attempts allowed in any 12 month period. Once you pass, the certification is valid for a year and renews free through an online assessment on Microsoft Learn.
Bring It Home
The plan is only as good as the feedback loop inside it. Start with the free 20-question AZ-104 practice test on day zero and again at the week two checkpoint. For weeks three and four, the Sailor.sh AZ-104 mock exam bundle gives you 8 timed 100-minute exams of 50 questions each plus the free sample, 420 unique questions in total, every one scored on the same 1 to 1000 scale and the same 700 bar as the real exam, with a written explanation on every answer.
Pair this schedule with the AZ-104 exam guide 2026 for the full breakdown of what is tested, and read how hard is AZ-104 before your first timed mock so you know which traps to watch for.