AZ-104 Study Guide: How to Pass Azure Administrator in 2026

The AZ-104 is Microsoft's Azure Administrator Associate exam — one test covering identities, storage, compute, networking, and monitoring — and most working admins need about six weeks of structured, hands-on prep to pass it. It is the default "I can run production Azure" credential: intermediate level, scenario-heavy, and respected by hiring managers precisely because it is not easy.

This guide covers the current exam blueprint, what actually trips candidates up in each domain, a week-by-week plan, and how the genuinely free renewal works.

AZ-104 exam facts

As of 2026, per Microsoft's official AZ-104 exam page:

Two details worth underlining: 700 is a scaled score, not 70%, and there is no penalty for wrong answers — never leave a blank. The question count also genuinely floats; Microsoft says most of its exams run 40–60 questions and reserves the right to vary it.

What's on the AZ-104?

Microsoft revises the skills outline periodically. The current version is dated April 17, 2026 — always pull the latest from the official AZ-104 study guide before you build a study plan, because the weights below can shift.

Where each domain actually hurts:

• Identities and governance. RBAC scope inheritance is the trap: a role assigned at a management group flows down through every subscription, resource group, and resource beneath it. Candidates also mix up Microsoft Entra roles and Azure RBAC — separate systems; a Global Administrator gets no access to VMs by default. And know Azure Policy vs RBAC: policy controls what can exist, RBAC who can act.
• Storage. Redundancy tiers are the classic point-loser: LRS, ZRS, GRS, GZRS, and the RA- variants — know which survives a zone outage vs a regional one, and which conversions are possible without migrating. Then SAS tokens: account vs service vs user-delegation, and why stored access policies matter (revocation).
• Compute. You will read ARM templates and Bicep files on this exam — not write them from scratch, but interpret and modify them. Availability sets vs availability zones (fault and update domains vs physically separate datacenters) shows up constantly, and App Service scaling belongs to the plan, not the app.
• Virtual networking. NSG rule evaluation fails more candidates than anything else in this domain. Rules process in priority order — lowest number first, first match wins — and NSGs apply at both the subnet and the NIC, so inbound traffic has to pass both. Add VNet peering being non-transitive and the service endpoint vs private endpoint distinction, and this "15–20%" domain punches above its weight.
• Monitoring and maintenance. Expect basic KQL against Log Analytics, alert rules vs action groups, and the difference between a Recovery Services vault and the newer Backup vault — they protect different workloads.

Is the AZ-104 hard?

Yes — for an associate-level exam, it has a real failure rate among experienced admins. It is widely considered a much bigger step up from AZ-900 than the naming suggests: AZ-900 tests definitions, AZ-104 tests decisions and configurations. If you have never touched Azure, warming up with AZ-900 practice questions first is a reasonable on-ramp, but it is not a prerequisite.

Two things make it hard. First, breadth: the five domains are effectively five products' worth of surface area — each has enough depth for its own exam. Second, hands-on experience is non-negotiable. The formats include case studies, drag-and-drop, and hot-area questions, and Microsoft's own wording is that you "may have interactive components to complete" — it deliberately does not publish which exams include lab-style tasks. If your prep was all videos, the scenario questions will expose it.

One consolation: on role-based exams, Microsoft lets you open Microsoft Learn documentation in a split screen during the test. That sounds like open book. It is not — the clock keeps running, and the time budget assumes barely any lookups. Treat it as a lifeline for one or two exact-syntax questions.

6-week AZ-104 study plan

Assumes roughly 10 hours a week. Add a week or two if Azure is brand new to you; cut one if you administer Azure daily. Every week has the same rhythm: learn the material, lab it in a real subscription, then answer 20–30 practice questions on that domain.

Week 1: Identities and governance

Entra users and groups, SSPR, license management; built-in RBAC roles and assignments at different scopes; Azure Policy, resource locks, tags, management groups, budgets and cost alerts. Lab: create test users, assign the same role at resource-group and subscription scope, and compare the effective access.

Week 2: Storage

Storage accounts and redundancy options, storage firewalls, SAS tokens plus stored access policies, identity-based access for Azure Files, blob tiers, lifecycle management, versioning and soft delete, AzCopy and Storage Explorer. Lab: build an account, generate each SAS type, and write a lifecycle rule that moves blobs to cool and then archive.

Week 3: Compute, part one — VMs and templates

Create, resize, and move VMs; disks and encryption at host; availability sets, zones, and scale sets. Then ARM and Bicep: deploy, export a deployment as a template, modify it. Lab: deploy a VM in the portal, export the template, convert it to Bicep, and redeploy it.

Week 4: Compute, part two — containers and App Service

Azure Container Registry, Container Instances, Container Apps, and their sizing and scaling; App Service plans, scaling rules, deployment slots, custom domains, TLS, and backup. Lab: push an image to ACR and run it in ACI; deploy a web app with a staging slot and swap it. Take your first mixed-domain practice set this week to surface cross-topic gaps early.

Week 5: Virtual networking

VNets and subnets, peering, public IPs, user-defined routes; NSGs, application security groups, and effective security rules; Azure Bastion; service endpoints vs private endpoints; Azure DNS; internal and public load balancers. Lab: peer two VNets, build an NSG that allows HTTP but blocks SSH, verify with effective security rules, then put an internal load balancer in front of two VMs.

Week 6: Monitoring, backup, and full practice

Azure Monitor metrics, logs, alert rules, and action groups; VM insights; Network Watcher; Recovery Services vaults, backup policies, restores, and a Site Recovery failover. Then two full-length timed practice exams. Review every miss, drill the weak domains, and book the real exam once you are landing 80%+ consistently.

Best AZ-104 study resources

• The official Microsoft Learn path (free). Start from the exam page and study guide linked above. The self-paced AZ-104 learning path covers every objective, and many modules include a temporary sandbox subscription — real portal labs without a credit card.
• Your own Azure subscription. Microsoft offers a free account with starter credit, and pay-as-you-go costs little at lab scale. Running your own subscription teaches what the exam quietly tests: cleanup, cost visibility, RBAC in practice. Delete resource groups when you finish.
• Microsoft's free practice assessment and exam sandbox. The practice assessment shows you the official question style; the sandbox lets you rehearse the exam UI, including how case studies and review screens behave.
• A question bank with rationales. Volume of scenario questions is how you find gaps before the exam does. Work through AZ-104 practice questions with full explanations, or gauge where you stand right now with a free AZ-104 practice test — no signup needed.

Exam-day tips and renewal

• Budget for case studies. You may get one or more: a scenario with several tabs of background feeding multiple questions. Read the requirements and constraints tabs first, skim the rest, and let each question pull you back to the details it needs.
• Mark for review — with one caveat. If you take an unscheduled break, you cannot return to any question you saw before it, and the clock keeps running. Review everything before you step away.
• Answer everything. No penalty for wrong answers. A blind guess beats a blank.
• Use the built-in Learn access sparingly. Two or three lookups, maximum.
• If you fail, the retake wait is 24 hours for the first retry, longer for subsequent attempts.

Renewal is where Microsoft is unusually generous. The certification is valid for one year — but per Microsoft, as of 2026, renewal is free: a short, unproctored, open-book assessment on Microsoft Learn. Your window opens six months before expiration, a pass extends the certification one year from its expiration date (not the day you pass), and you can retake as many times as needed before it lapses. You never re-sit the $165 proctored exam. Few vendors make maintenance this cheap.

Once you hold AZ-104, common next moves are Azure security (AZ-500) or architecture (AZ-305) — and if you work across clouds, our AWS Solutions Architect study guide maps the equivalent path on the AWS side.

---

Find out where you stand. Cert Climb's free 30-question AZ-104 trial gives you realistic, scenario-style questions with full rationales explaining why each answer is right or wrong — no card required.