AZ-104 has a reputation for being the exam where Azure stops being friendly. That reputation is earned, but not for the reason most people assume. The content is not exotic. What makes the Azure Administrator exam hard is that it asks you to predict behavior under constraints, in 100 minutes, from scenarios that hide the single detail that decides the answer.
Here is what actually makes it difficult, and what to do about each part.
First, the Numbers That Are Real
Microsoft does not publish pass rates for any certification exam. Every percentage you have seen quoted is somebody’s estimate. These facts, on the other hand, come from Microsoft:
- 100 minutes of exam time. Seat time is longer to cover the introduction and agreements.
- Scored 1 to 1000, pass at 700 or higher. The score is scaled, so 700 is not 70 percent of the questions.
- No penalty for guessing. Never leave an item blank.
- Some delivered items are unscored pilot questions. A brutal question may not count at all.
- Microsoft Learn is available inside the exam interface, with the clock running the entire time.
- Retakes: 24 hours after a first failure, 14 days between later attempts, five attempts maximum in a 12 month period.
- Study effort: roughly 120 to 140 hours for a typical successful candidate.
The Microsoft Learn access is the tell. An exam that hands you the documentation and keeps the clock running is not testing recall. It is testing whether you can apply what you already know fast enough.
What Makes It Hard, in Order
1. The scenarios bury the decisive detail
A typical item gives you a role, a business constraint, an existing configuration, and a goal, then asks what to do. Most of the paragraph is context. One clause decides the answer, and it is rarely the one your eye lands on first. A peering is Connected in both directions, and the design has no network virtual appliance. That second clause is the whole question, because peering is not transitive and there is nothing in the hub to relay the traffic.
What to do: practice reading for constraints rather than keywords. Before looking at the options, say out loud what the scenario forbids.
2. Neighboring services look identical until they do not
The exam is built on distinctions that feel like trivia until you get one wrong in production:
- Microsoft Entra roles govern the directory, Azure roles govern resources, and neither grants the other.
- Contributor cannot assign roles. User Access Administrator can assign roles but cannot touch the resources.
- Azure Policy governs what resources look like, role assignments govern who can act, locks stop everyone including Owners, and tags only label.
- A service endpoint keeps the public endpoint and changes the source address. A private endpoint gives the service a private IP and needs DNS to match.
- Soft delete protects against deletion, versioning protects against overwrite, and point-in-time restore needs versioning, change feed, and soft delete together.
What to do: build a comparison sheet per domain and write the one sentence that separates each pair. If you cannot write the sentence, you do not know the pair.
3. Defaults and side effects are fair game
Plenty of items turn on what Azure does when nobody configures anything. A complete mode deployment deletes resources the template does not declare. A ReadOnly lock blocks listing storage account keys. Regenerating a storage account key invalidates every shared access signature signed with it. Tags on a resource group do not reach the resources inside it. Policy does not repair existing resources without a remediation task.
What to do: every time you learn a feature, ask what it breaks. That question generates most of the exam’s hard items.
4. The format mix costs time
A sitting can mix single answer multiple choice, multiple response items that state how many to pick, yes or no statement sets, drag and drop ordering, build lists, one or two case studies, and a problem-solution set where the same scenario is proposed with different solutions. Microsoft also aims to include a lab on role-based exams, told to you on the introduction screen, and the lab is scored on the end result rather than the path.
Case studies come with a review screen you cannot return to once you leave it, and you cannot go back to earlier questions after an unscheduled break. Pacing errors are unrecoverable in a way they are not on other exams.
What to do: rehearse the clock, not just the content. On a 50 question paper in 100 minutes you have two minutes per item, and the long scenarios will eat four while the short ones give back one.
5. The identity domain is the biggest and the least forgiving
Manage Azure identities and governance carries 20 to 25 percent, the joint largest weight, and it is where candidates lose the most points. Dynamic membership rules need Microsoft Entra ID P1. A license assignment fails without a usage location. NotActions subtract, they do not deny. A Global Administrator has no rights over a subscription until access is elevated, and that elevation is a per user root scope assignment you are expected to remove afterward.
What to do: treat identity as its own study block, not as the warm up before the interesting infrastructure topics.
How It Compares
Against AZ-900, AZ-104 is a genuinely different exercise. Fundamentals asks you to describe. Administrator asks you to predict outcomes in a configured environment, with hands-on work assumed.
Against AZ-305, AZ-104 is narrower and more concrete. The architect exam asks which design meets a set of business requirements. The administrator exam asks what happens when you run this command in this subscription.
Against AZ-204, the difficulty is sideways rather than up. The developer exam expects you to read code. AZ-104 expects you to read a network security group rule table. Our AZ-104 versus AZ-204 comparison covers the choice in detail.
An Honest Readiness Checklist
You are ready when you can do all of these without looking anything up:
- Explain why a Global Administrator cannot see a subscription, and what fixes it.
- Say what a complete mode deployment removes from a resource group, and what survives.
- List the ways a delegated access token can be revoked, and say which one leaves other consumers untouched.
- Trace an inbound packet through a subnet network security group and a network interface network security group and say which rule wins.
- Choose between a service endpoint and a private endpoint for a client that sits on-premises.
- Name what point-in-time restore requires before it can be enabled.
- Predict which virtual machine sizes and states allow encryption at host to be turned on.
Anything on that list you cannot answer cleanly is a study session, not a gap to hope the exam skips.
Prove It Under the Clock
Reading about difficulty is not the same as measuring it. Take the free 20-question AZ-104 practice test first. It is written at full exam depth with a complete explanation on every item and no signup, so twenty questions will tell you honestly which of the five domains is weakest.
When you want the full rehearsal, the Sailor.sh AZ-104 mock exam bundle gives you 8 timed 100-minute exams of 50 questions each plus the free sample, 420 unique questions in total. Every exam is scored on the same 1 to 1000 scale with the same 700 bar, multiple response items are scored all or nothing exactly as they are on exam day, and every answer comes with the reasoning and a reference to official documentation.
Two consecutive mocks above 700 is the readiness signal worth trusting. For the full breakdown of what is tested, read the AZ-104 exam guide 2026, and if you still need the calendar, follow the 30-day AZ-104 study plan.