AZ-104 Master Guide 2026

What AZ-104 measures

AZ-104 tests whether you can administer an Azure environment using the tasks and decisions in Microsoft’s current skills outline. It is an associate-level, role-based credential for people who work with Azure resources. The exam expects more than recognition of product names: a scenario may ask you to choose a permission scope, protect stored data, configure a virtual network, or interpret an operational signal. The strongest answer fits the stated requirement and avoids granting unnecessary access, adding unneeded complexity, or disrupting a running service.

The current English study guide is marked skills measured as of April 17, 2026. It organizes the work into five domains: Manage identities and governance (20-25%); Implement and manage storage (15-20%); Deploy and manage compute resources (20-25%); Implement and manage virtual networking (15-20%); and Monitor and maintain Azure resources (10-15%). The ranges are approximate blueprint weights, not a promise about the number of questions in each section. The published percentages should not be added as if every range reaches its upper bound.

This is an administrator exam, so learn the relationships between services and the operational consequences of a choice. For example, a managed identity can let an application access a resource without embedding a password; a role assignment combines a principal, a role definition, and a scope; a private endpoint changes how a service is reached; and a storage redundancy choice affects durability and availability. Memorizing terms helps only when you can apply them to the requirements in a scenario.

Eligibility and experience

Microsoft does not publish a formal prerequisite or required work history for sitting AZ-104. A candidate can register without proving an Azure job title or submitting an experience portfolio. That is permission to take the exam, not a guarantee that the material will feel accessible. Practical familiarity with the Azure portal, identities, storage, virtual machines, networking, and monitoring makes the tasks easier to understand.

A person who has only used Azure Fundamentals material should expect a meaningful step up. Fundamentals asks what a service is for; AZ-104 asks how an administrator configures and governs resources. Someone who has administered another cloud can transfer ideas such as least privilege, network segmentation, and monitoring, but should still learn Azure-specific resource hierarchy, service names, command behavior, and portal paths. A person who has only studied documentation can prepare, but should use a controlled lab or guided exercise to turn procedures into operational understanding.

Format, timing, and score

Microsoft’s general guidance says exams typically contain 40-60 questions, but the exact count varies and is not fixed for AZ-104. Microsoft does not publish an exam-specific question mix or tell candidates in advance which exams include labs. Role-based exams can include case studies and may include performance tasks. The exam may therefore require candidates to reason across a case or complete an interactive task as well as answer selected-response items. Treat descriptions of a guaranteed number of labs, cases, or questions as unsupported.

Microsoft gives 100 minutes of exam time and 120 minutes of seat time for a role-based exam without labs. If labs may be present, the policy provides 120 minutes of exam time and 140 minutes of seat time. The published policy does not identify AZ-104 as always having or never having a lab. Use the time shown for your booked appointment and launch instructions. Seat time includes administrative steps and is not all available for answering questions.

The passing score is 700 on a 1,000-point scaled system. This is not a raw 70% rule. Microsoft does not publish a fixed number of correct answers that corresponds to 700, and item scoring can vary. A score report gives an overall result and domain performance feedback; it does not provide a reliable conversion from a domain bar to a raw percentage. Use feedback to direct study rather than reverse-engineer an unofficial cutoff.

Microsoft allows restricted Learn access during eligible associate and expert role-based exams. The permitted experience has limits and does not provide ordinary searching, practice assessments, Q&A, or profile access. It does not add exam time. Learn access is a limited reference aid, not a replacement for knowing how to administer Azure. Because interface policies can change, read the current exam instructions before relying on any in-exam tool.

How to prepare across the outline

Begin with a diagnostic that samples each domain. For every missed item, label the underlying task rather than just the service name. Examples include assigning an Azure role at the right scope, choosing storage redundancy, deploying a virtual machine from an image, connecting networks, or using Azure Monitor and backup tools. Mark whether the gap is conceptual, procedural, or a terminology confusion. Then use the official study guide as a checklist and the relevant Microsoft Learn documentation as a reference for tasks you cannot explain.

Use hands-on work for procedures that are hard to picture. In a controlled subscription, create a resource group, inspect inherited permissions, assign a narrowly scoped role, deploy a small test resource, review its network settings, configure a diagnostic signal, and remove resources when finished. Keep an eye on cost and avoid experimenting with production data. A lab should teach cause and effect: what setting changes access, what scope carries an assignment, what a monitoring alert observes, and which cleanup action actually removes the resource.

If you cannot access an Azure subscription, use a detailed procedural walkthrough and reason through the sequence before checking the explanation. Draw a resource hierarchy; list the principal, role, and scope; sketch the network path; or predict which backup policy applies. This is weaker than operating a live environment, but it is more active than watching a demonstration. Never assume that a prose question bank reproduces a Microsoft lab. Practice should be identified as original teaching material, not a replica of secure exam content.

A worked administrator decision

Suppose a developer must read one storage account from an application running in Azure. The application currently uses a connection string stored in a configuration file, and the security team wants to remove long-lived credentials. A reasonable first design is to enable an appropriate managed identity for the compute resource and grant that identity only the data role required at the narrowest practical scope. The administrator should check whether the workload needs blob data access or management-plane access; a broad Contributor role is not a substitute for a data role. The administrator should then verify the application can authenticate and read only the intended data.

This scenario connects identity, role scope, and storage. A candidate who remembers only that ‘RBAC grants access’ may choose a role with too much authority. A stronger answer asks who needs access, which operation is required, which plane is involved, and how narrowly the permission can be scoped. The same method transfers to a human operator who must restart a virtual machine but must not change subscription billing or network policy.

Registration, cost, and retakes

Candidates register through Microsoft’s certification experience and schedule with the delivery provider shown for their market. Pearson VUE delivers Microsoft exams in many locations, but available languages, centers, and remote-proctoring appointments depend on location and schedule. Confirm that the name on the Microsoft Learn profile matches the identification required by the provider. Use a personal Microsoft account for the certification profile so exam results remain accessible if an employer account is disabled.

The exam price varies by the country or region in which the exam is proctored. Microsoft does not publish one universal USD price that applies everywhere. The current checkout is the useful price for your appointment. Budget separately for a retake if you want one, travel or equipment costs, and any optional learning resources. A first-attempt voucher or employer benefit may change what you pay, but it does not change the exam standard.

Under Microsoft’s retake policy, a first failed attempt requires a 24-hour wait. Later failed attempts require a 14-day wait, and a candidate may take a particular exam at most five times in a 12-month period measured from the first attempt. Retakes are paid where applicable; a first purchase does not automatically include them. A passed exam cannot be retaken unless the certification has expired. Before scheduling again, use the score report to identify which tasks need repair and leave enough time to practice those tasks rather than repeating the same study routine.

Certification and renewal

Passing AZ-104 earns the Azure Administrator Associate certification. Microsoft’s role-based credentials require periodic renewal through a free online assessment during the eligibility window shown in the certification profile. The assessment is distinct from retaking AZ-104 and is intended to confirm current knowledge. The exam itself does not require a college degree or a verified job history, and passing should not be described as proof of a specific number of years of professional administration.

The credential can help communicate familiarity with common Azure administration tasks. Employers still need evidence of operational judgment, troubleshooting, communication, and the ability to work within security and change-control requirements. A useful portfolio example explains the problem, constraints, role and scope decisions, validation steps, monitoring, and cleanup. Do not expose tenant identifiers, secrets, or customer data when describing work.

A practical readiness check

You are close to ready when you can explain the major tasks in all five domains and complete or reason through representative workflows without following a memorized click path. Given a scenario, you should identify the relevant identity and scope, choose storage protection that meets the requirement, select a compute option, trace the network path, and explain how you would monitor or recover the workload. You should also be able to state what your choice does not solve. For example, a network security group filters network traffic but does not grant an identity permission to manage a resource.

Use a timed mixed set near the end of preparation, but preserve time to review explanations. A high score on one provider’s quiz is not a Microsoft pass prediction. If you repeatedly miss the same objective, pause broad practice and study that task. If your misses are scattered, revisit the whole outline and practice switching between domains. The purpose of readiness work is to find a stable command of the skills, not to guess a raw cutoff Microsoft has not published.

How to connect the five domains in real work

The outline separates skills for study, but administrators rarely work in only one domain. A storage account has identity, network, protection, governance, and monitoring decisions. A virtual machine depends on compute, network, identity, storage, backup, and operational procedures. The ability to recognize those connections helps with longer scenarios and with real work. When you see a workload question, sketch the components and identify which team or control owns each boundary.

For example, a web service runs on a VM, reads from storage, and must be reached privately. The workload identity needs the right data permission. The service needs an appropriate storage configuration and private connectivity. DNS must resolve the name as intended, and network rules must permit the needed path. Monitoring should detect relevant failures, while backup and recovery should match the business objective. A strong administrator does not treat the VM deployment as the whole solution.

A scenario can also include constraints that rule out an otherwise functional design. If a company prohibits broad access, a subscription-wide role is not suitable even when it would make the task work. If a resource must remain available after a zone failure, local copies within one zone may not satisfy the stated goal. If a service must not be public, a public endpoint plus a strong password may not meet the network requirement. Identify constraints before selecting a feature.

A repeatable approach to scenario questions

1. Restate the required outcome in plain language, using the scenario’s verbs such as allow, prevent, detect, recover, or connect.
2. List the stated constraints: identity, scope, availability, recovery, network exposure, cost, or operational ownership.
3. Identify which Azure layer is involved: identity, resource configuration, data access, network path, monitoring, or recovery.
4. Choose the smallest set of controls that addresses the requirement. Avoid adding broad permissions or unrelated services.
5. Check dependencies and validation. A role needs a principal and scope; private connectivity needs network and name resolution; backup needs retention and a restore path.
6. Compare the closest alternative and explain why it does not satisfy the same requirement.

This sequence is useful when two options both sound plausible. Suppose the choices include RBAC, Policy, and a resource lock. If the requirement is to restrict who can restart a VM, examine RBAC. If the requirement is to reject deployments in a disallowed region, examine Policy. If the requirement is to reduce accidental deletion, consider a lock. The scenario’s action verb identifies the control layer.

Practice safely and learn from results

Hands-on study can create charges or affect real resources, so use a dedicated lab or sandbox and follow its rules. Set a spending alert where appropriate, deploy small resources, avoid sensitive data, and remove what you created. A lab task should have a clear learning question. For example, create an assignment at a narrow scope and test the permitted action; then inspect what changes when the scope is broader. Do not perform practice changes in a production subscription without explicit authorization.

Keep an error log that records why an answer was wrong. Useful categories include: misunderstood a requirement; confused two services; chose a scope that was too broad; missed a dependency; lacked a procedure; or ran short on time. The next study action should match the cause. A knowledge gap needs reference study. A scope error needs a role-assignment exercise. A timing problem needs controlled practice, not more reading.

When reviewing practice material, ensure it teaches rather than claims to reveal secure exam content. Microsoft does not publish the exact AZ-104 item mix, fixed question count, or exam-specific lab list. An original case can teach decision-making, but it cannot promise to mirror the live session. Use Microsoft’s official study guide to establish what is in scope and the practice explanation to improve how you reason.

Scheduling and test-day preparation

After your diagnostic and study plan, schedule through Microsoft’s certification route and the provider offered for your region. The exam fee varies by proctored market. Confirm the name on the booking matches accepted identification, the appointment time zone, language, and delivery mode. Review the cancellation and rescheduling terms displayed by the provider. For online delivery, validate the computer and room; for a test center, plan travel and check-in time.

Microsoft role-based timing depends on whether labs may be present. The published policy lists 100 minutes of exam time and 120 minutes of seat time without labs, or 120 minutes of exam time and 140 minutes of seat time when labs may be present. Microsoft does not identify exam-specific lab inclusion in advance. Use the appointment instructions for your session and do not assume seat time is all available to answer items.

Read the break and navigation instructions on screen. Microsoft states the timer continues during a break and that candidates cannot return to viewed questions after starting one. Some question sections may have their own review limits. Follow what the interface says rather than assuming you can revisit everything. The restricted Learn access available in role-based exams has no extra time and excludes several Learn features; prepare to solve tasks without relying on a search.

After the exam

Most Microsoft results appear within minutes. Check the pass or fail result and later retrieve the report from the correct Microsoft Learn profile. The score is scaled: at least 700 passes, and a practice-test percentage does not convert to it. Domain feedback can guide continued learning, but it is not a raw count of missed questions. A passing result earns the credential requirement; keep the profile accessible and note the role-based renewal date.

If you fail, the first retake wait is 24 hours; later failures require 14 days, with a maximum of five attempts in 12 months from the first attempt. A retake is paid where applicable. Use the score report to repair weak tasks and practice new scenarios before booking again. If a technical disruption occurred, retain the provider case number and follow the documented process; a policy exception is not automatic.

What the credential does not promise

AZ-104 is a certification exam, not an Azure account, a live environment, a guarantee of employment, or a complete course in every Azure service. It measures the tasks named in the current skills outline, which can change. The role-based exam may include interactive elements, and written practice cannot prove that a candidate can execute every live task. Candidates should treat the official outline as the boundary for exam preparation and build practical experience separately when their role requires it.