Azure Administrator Associate (AZ-104)
This course's certifications hub covers Google Cloud's Professional Cloud DevOps Engineer, the vendor-neutral SRE Foundation, and AWS's CloudOps Engineer Associate — and stops there. If your production runs on Azure, none of those three teach you the console, the CLI, or the resource model you actually operate against every day. Microsoft Certified: Azure Administrator Associate (AZ-104) is the exam that closes that gap: Microsoft's role-based, associate-level credential for people who run Azure day to day — identities and governance, storage, compute, networking, and monitoring. It doesn't call itself an SRE exam any more than AWS's CloudOps exam does, but an SRE who owns production on Azure spends real hours inside exactly this territory. This page covers what it tests, what it costs and requires, how its five domains connect to what this course already teaches, and who should — or shouldn't — bother.
Imagine a huge rental building with apartments, a parking garage, elevators, and a front desk that checks IDs. AZ-104 is the badge for the building superintendent — not the architect who designed it, not the security guard who only watches cameras, the person who actually has the master keys: who's allowed into which floor, how much storage each tenant gets and how many backup copies, which apartments share one big generator versus their own, how the hallways are wired so packages find the right door, and a dashboard that pages the superintendent the moment something breaks. It's a real, practical badge about running the building — not about deciding whether the building should exist in the first place.
What AZ-104 is, and who it's for
☺ Like you're 10: A real, practical test on running Azure day to day — not a design exam, and not a quiz about SRE ideas like error budgets.
AZ-104 is issued by Microsoft as part of its role-based certification family, and it sits at the Associate level — above the entry-level AZ-900 (Azure Fundamentals), which tests vocabulary and pricing concepts with no hands-on requirement, and adjacent to the Expert-level exams that assume an associate credential as groundwork. The role it certifies is the Azure administrator: the person who provisions and maintains identities, storage, compute, and networking, and keeps an eye on all of it once it's running. It is explicitly an operations exam, not a design exam — that distinction matters enough that Microsoft sells a separate credential, AZ-305 (Azure Solutions Architect Expert), for the person who decides what to build; AZ-104 certifies the person who builds and runs what was decided.
Format-wise, it's a mix of multiple-choice and multiple-answer questions, drag-and-drop, and case-study question sets — a block of scenario detail you read once, then answer several questions against without being able to revisit it later. Microsoft has also been folding interactive, hands-on lab tasks into several of its role-based exams, AZ-104 included in recent iterations — a live Azure sandbox where you actually configure a resource rather than answer a question describing one. Whether labs appear in your specific attempt, and how many, isn't something Microsoft commits to in writing; treat it as a real possibility to prepare for, not a guarantee.
AZ-104 tests whether you can operate Azure — provision it correctly, secure access to it, keep it running, notice when it breaks. It does not test SLIs, SLOs, error budgets, toil, blameless postmortems, or any other mechanism this course is built around. Passing it proves you can run the building; it says nothing about how much reliability you've promised the tenants, or what happens when that promise gets broken. That's the same line this course draws around the CKA and CKS — a substrate credential, not a reliability-practice one.
The official skill areas and weights
☺ Like you're 10: Five topics, and Microsoft publishes them as ranges, not exact numbers — because the exact mix of questions varies slightly from one candidate's exam to the next.
Microsoft publishes AZ-104's content as five skill areas, each given as a percentage range rather than a fixed number — a deliberate choice, since exam forms vary slightly and Microsoft doesn't commit to an exact question-by-question weighting the way the CNCF does for the CKA. The shape below reflects Microsoft's own "Skills measured" outline; Microsoft revises the exact wording and ranges on a rolling basis (typically every six to twelve months, with an effective date printed at the top of the current PDF), so treat this as the shape of the exam, not a frozen quote — pull the live outline from the official exam page before you build a study plan around it.
Two things worth noticing in that shape. First, identity and governance carries as much weight as compute — Microsoft treats "who can touch what" as core administrator territory, not a side concern, which lines up with how much of a real Azure incident review spends on RBAC and policy rather than the workload itself. Second, monitoring is the smallest single domain, which surprises people coming from this course: Azure Monitor competency here is deliberately narrow — configure it, read it, alert on it — while the deeper reliability judgment of what to alert on and why lives entirely in this course's own monitoring & observability page, not in Microsoft's syllabus.
What you actually need to be able to do
☺ Like you're 10: Here's the real substance under each heading — the commands and settings your fingers need to know, not just the vocabulary.
Identity and governance
Microsoft Entra ID (the renamed Azure Active Directory) users, groups, and dynamic group membership; Azure RBAC — built-in roles like Owner, Contributor, and Reader versus custom roles, assigned at management-group, subscription, resource-group, or resource scope; the governance hierarchy itself (tenant → management groups → subscriptions → resource groups → resources); resource locks (CanNotDelete and ReadOnly); tags for cost allocation and ownership; and Azure Policy to enforce a rule declaratively rather than by asking nicely.
# scope an RBAC assignment as tightly as the task allows — resource-group scope here, not subscription az role assignment create --assignee alice@contoso.com \ --role "Virtual Machine Contributor" \ --scope /subscriptions/<sub-id>/resourceGroups/rg-prod-eastus # a resource lock survives an RBAC mistake that a role assignment alone won't stop az lock create --name prevent-delete --resource-group rg-prod-eastus \ --lock-type CanNotDelete # deny, don't just recommend — Azure Policy enforces at admission, same idea as a Kubernetes admission controller az policy assignment create --name require-tag-costcenter \ --policy "1e30110a-5ceb-460c-a204-c1c3969c6d62" \ --scope /subscriptions/<sub-id>/resourceGroups/rg-prod-eastus
Storage
Storage account creation and the redundancy tier that determines your actual blast radius — LRS (three copies, one datacenter), ZRS (spread across availability zones in one region), GRS and RA-GRS (asynchronously replicated to a paired region, the latter with read access to the secondary), and GZRS combining zone and geo redundancy; access tiers (Hot, Cool, Archive) and lifecycle-management policies that move blobs between them automatically; Azure Files for SMB/NFS shares; and access control via SAS tokens, storage account keys, or — the option Microsoft's own guidance now pushes — Entra ID-based access instead of a shared key at all.
# RA-GRS: async-replicated to the paired region, with read access to the secondary if the primary is down az storage account create --name stprodeastus01 --resource-group rg-prod-eastus \ --sku Standard_RAGRS --kind StorageV2 --access-tier Hot \ --min-tls-version TLS1_2 --allow-blob-public-access false
Compute
Virtual machines and the two mechanisms Azure offers for spreading them across failure domains — availability sets (fault and update domains within one datacenter) and availability zones (physically separate datacenters within a region, each with independent power and cooling); virtual machine scale sets with autoscale rules driven by a metric; ARM templates and Bicep (Microsoft's newer DSL that compiles down to ARM JSON) for repeatable deployment; and the basics of App Service and Azure Container Instances as PaaS alternatives to running your own VMs. Bicep here is Azure-native and JSON-shaped underneath — it complements, rather than replaces, the cloud-agnostic Terraform skills this course covers separately on its HashiCorp Terraform Associate profile; plenty of Azure shops use Bicep for pure infrastructure and Terraform where multi-cloud portability actually matters.
az group create --name rg-prod-eastus --location eastus # a scale set spread across three zones, not just three VMs in one datacenter az vmss create --resource-group rg-prod-eastus --name vmss-web \ --image Ubuntu2204 --zones 1 2 3 --instance-count 3 \ --vm-sku Standard_D2s_v5 --admin-username azureuser --generate-ssh-keys az monitor autoscale create --resource-group rg-prod-eastus \ --resource vmss-web --resource-type Microsoft.Compute/virtualMachineScaleSets \ --min-count 3 --max-count 10 --count 3 az monitor autoscale rule create --resource-group rg-prod-eastus \ --autoscale-name vmss-web-autoscale --condition "Percentage CPU > 70 avg 5m" \ --scale out 2
Networking
Virtual networks and subnets, VNet peering, and name resolution with Azure DNS and private DNS zones; Network Security Groups (NSGs) — Azure's stateful, priority-ordered allow/deny rules attached to a subnet or NIC — and Application Security Groups for grouping NICs logically instead of by IP range; the difference between Load Balancer (Layer 4, fast, protocol-agnostic) and Application Gateway (Layer 7, HTTP-aware, does path-based routing and terminates TLS); VPN Gateway and ExpressRoute for hybrid connectivity; Private Link and Private Endpoints to keep PaaS traffic off the public internet entirely; and Network Watcher for diagnosing connectivity — its "IP flow verify" and "next hop" tools answer, respectively, "would this specific packet be allowed?" and "where does Azure's routing table actually send this?"
# NSGs evaluate rules by priority, lowest number first — a lower-numbered deny short-circuits everything after it az network nsg rule create --resource-group rg-prod-eastus --nsg-name nsg-web \ --name allow-https-inbound --priority 100 --direction Inbound --access Allow \ --protocol Tcp --destination-port-ranges 443 --source-address-prefixes Internet
Monitor and maintain
Azure Monitor as the umbrella — metrics, the Log Analytics workspace that ingests logs and lets you query them in KQL (Kusto Query Language), and alert rules that fire from either; and the two pieces of Azure's backup-and-recovery story: Azure Backup for scheduled, policy-driven backups of VMs, files, and databases, and Azure Site Recovery for replicating whole VMs to a second region so a regional failure has somewhere to fail over to.
// a basic KQL query against Log Analytics — the shape you'll be reading, not writing from scratch, on the exam AzureMetrics | where ResourceProvider == "MICROSOFT.COMPUTE" and MetricName == "Percentage CPU" | where TimeGenerated > ago(1h) | summarize avg(Average) by bin(TimeGenerated, 5m), Resource | render timechart
On a free-tier or sandbox subscription: (1) create a resource group and a VM scale set spread across three availability zones; (2) attach an autoscale rule on CPU and confirm with az monitor autoscale rule list that it registered; (3) create a storage account on RA-GRS and check the secondary-region endpoint in the portal; (4) write one NSG rule that blocks everything except 443 inbound, then use Network Watcher's IP flow verify to prove a different port is actually blocked, not just assumed blocked; (5) create a Log Analytics workspace, point the scale set at it, and write the KQL query above against real data. That loop — provision, verify, query — is the whole exam in miniature.
Where this overlaps with SRE practice on Azure
☺ Like you're 10: AZ-104 hands you the levers. This course teaches you which lever to pull, how far, and how to know if you pulled the right one.
None of AZ-104's five domains are SRE practice by themselves, but every one of them is a lever this course's ideas get applied through when the production system in question happens to live on Azure.
Concretely: production readiness reviews for anything shipping onto Azure should be checking exactly the identity-and-governance mechanics AZ-104 drills — is the deploy identity scoped to least privilege, is there a resource lock on anything that would be catastrophic to delete by accident. Disaster recovery & business continuity is where a storage account's redundancy tier stops being an exam fact and becomes an actual RPO/RTO number you can defend in a review. Multi-region & multi-AZ architecture and capacity planning & performance both depend on knowing precisely what an availability zone buys you over an availability set, and what a scale set's autoscale rule will and won't catch in time. Reliability patterns and network reliability engineering cover the same territory as Application Gateway health probes and NSG design, at the level of "why," not just "how to configure." And monitoring & observability, alert design & alert fatigue, and incident management & on-call are what turn an Azure Monitor alert rule from a noisy pager trigger into a signal someone can actually act on.
Exam logistics — verify before you book
☺ Like you're 10: Here's roughly what it costs and takes, but Microsoft changes these details without much warning — check the real page before you pay.
The numbers below are what Microsoft generally publishes and what candidates consistently report as of this writing. As with every certification on this site, treat this as a planning aid, not a source of truth to quote back at anyone.
| Item | What's generally published |
|---|---|
| Provider | Microsoft, delivered via Pearson VUE |
| Format | Multiple-choice/multiple-answer, drag-and-drop, and case studies; may include interactive hands-on lab tasks in a live Azure environment |
| Delivery | Online proctored from home/office, or in-person at a Pearson VUE test center |
| Duration | Generally listed around 120–150 minutes, including time for the pre-exam agreement and post-exam survey |
| Passing score | 700 out of 1000 — Microsoft's standard cut score across most role-based exams |
| Price | Around USD $165 list; varies by country and currency |
| Prerequisites | None formally enforced — Microsoft recommends 6+ months of hands-on Azure administration experience and familiarity with on-prem virtualization, networking, identity, and either PowerShell or the Azure CLI |
| Permitted resources | Closed-book — no documentation tab, no notes. This is a real difference from the CKA/CKS on this course, which permit a documentation allowlist inside the exam environment. |
| Validity | 1 year from the pass date — shorter than the CKA's or the SRE Foundation's multi-year validity |
| Renewal | A free, open-book online renewal assessment on Microsoft Learn, available starting ~6 months before expiration — no fee, no proctor, no full retake required, unlike most other vendors' expiring certifications |
If you've read this course's CKA or CKS pages, don't carry their assumptions over. AZ-104 is closed-book with no permitted documentation tab, its validity is one year rather than two, and — unusually generously — that year renews for free through an online assessment rather than a paid full retake. All of that is exactly the kind of detail Microsoft has changed before without much announcement. Confirm current format, price, duration, and renewal terms on the official AZ-104 exam page and the Azure Administrator certification page before you register.
↗ Microsoft's official Azure Administrator page ◆ AZ-104 exam page & skills outline
Who should sit it, who should skip it, and how it compares across clouds
☺ Like you're 10: If Azure tickets keep landing on your desk, this closes the gap. If you're deep in one narrow specialty already, or on a different cloud entirely, there's a better badge for you.
Sit it if you're an SRE, on-call engineer, or platform generalist whose production runs on Azure and who wants structured, verifiable proof of the operational fundamentals underneath it — RBAC that's actually least-privilege, storage redundancy that matches a real RPO, networking that fails closed instead of open. It's also a common hiring filter for Azure-heavy teams independent of what it personally teaches you.
Skip it, or deprioritize it, if any of these fit: your gap is design, not operations — that's AZ-305, not this; your gap is security specifically — that's AZ-500 (Azure Security Engineer Associate); your gap is networking specifically at depth beyond AZ-104's one domain — that's AZ-700 (Azure Network Engineer Associate); you're building CI/CD pipelines more than operating infrastructure — AZ-400 (DevOps Engineer Expert) is the better fit, and notably requires AZ-104 or AZ-204 (Azure Developer Associate) as a prerequisite before you can even sit it; or you're new to Azure entirely, in which case the knowledge-only AZ-900 is the gentler on-ramp — AZ-104 assumes real hands-on comfort, not vocabulary alone.
Microsoft has also started issuing narrower, no-exam-fee Applied Skills credentials — short, scenario-based, hands-on-lab assessments on Microsoft Learn covering a single slice of work like configuring Azure networking or implementing backup and recovery. They're worth knowing about as a lighter-weight way to prove one specific skill without committing to the full AZ-104 syllabus, though they don't currently replace it as a hiring signal the way the full associate credential does.
How AZ-104 compares to the generalist admin exams on the other two clouds
This course's certifications hub already profiles Google Cloud's Professional Cloud DevOps Engineer and AWS's CloudOps Engineer Associate — but neither is quite AZ-104's direct counterpart. AWS's CloudOps Engineer Associate is the closer match: both are generalist, operations-focused associate exams with no formal prerequisites. Google's closest equivalent to AZ-104's scope isn't the DevOps Engineer exam already covered on the hub — it's the Associate Cloud Engineer (ACE), Google's own generalist day-to-day operations credential, sitting alongside this page as a sibling profile on this course.
| AZ-104 (Azure) | CloudOps Engineer Assoc. (AWS) | Associate Cloud Engineer (GCP) | |
|---|---|---|---|
| Scope | Identity, storage, compute, networking, monitoring | Monitoring/remediation, reliability, deployment automation, security, networking, cost | Provisioning, deployment, monitoring, cost management |
| Format | MCQ, drag-and-drop, case studies, possible hands-on labs | MCQ / multiple-response only | MCQ / multiple-select only |
| Explicit SRE domain? | No — closest is "monitor and maintain" | No — closest is "reliability and business continuity" | No — this course's own gap-fill page covers it |
| Validity & renewal | 1 year, free online renewal | 3 years, paid retake | 3 years, paid retake (verify per your ACE profile) |
None of the three is "better" — pick based on which cloud your production actually runs on, the same advice this course's own certifications hub gives for choosing between the Google Cloud and AWS options.
How to prepare using this site — and beyond it
☺ Like you're 10: This course wasn't built as AZ-104 prep, but real chunks of it already overlap — here's the map, plus where to go for the Azure-specific mechanics this course doesn't teach.
| AZ-104 domain | Study here for the "why" |
|---|---|
| Identity & governance | Production readiness reviews for where governance gates belong in a release process |
| Storage | Disaster recovery & business continuity for turning a redundancy tier into an RPO/RTO commitment |
| Compute | Multi-region & multi-AZ architecture · Capacity planning & performance |
| Networking | Reliability patterns · Network reliability engineering |
| Monitor & maintain | Monitoring & observability · Alert design & alert fatigue · Incident management & on-call |
| The Azure-specific mechanics themselves | Microsoft Learn's free AZ-104 learning path, the official practice assessment, and the instructor-led AZ-104T00 course — this site teaches the reliability judgment, not the Azure Portal's menu structure |
If Kubernetes on Azure (AKS) is part of your remit, this course's own CKA and CKS profiles cover the cluster-operations and cluster-security layer that sits on top of whatever AZ-104 provisions underneath it — AZ-104 gets you the VNet, the node pool's VMs, and the storage class's backing disk; the CKA gets you the cluster running on top of them.
Benny the Beaver: I wrote a Bicep template that provisions our whole staging VNet in one apply. Feels very AZ-104 of me.
Timmy the Turtle: Did you set a resource lock on the production resource group before you got confident with it?
Benny the Beaver: ...it's on my list.
Ellie the Elephant: While you two argue about locks — I just watched three days of Log Analytics data and our RA-GRS secondary region has never actually been read from. Nobody's tested the failover.
Foxy: So we have redundancy Microsoft would certify on an exam, and a disaster-recovery plan we've never once verified works.
Professor Owl: Which is exactly the line this page keeps drawing. AZ-104 proves Benny can build the storage account correctly. It doesn't prove anyone's tested what happens the day the primary region actually goes down — that's still this course's job, not Microsoft's exam.
Pair this page with the certifications hub for the Google Cloud and AWS equivalents, and with Associate Cloud Engineer if your production spans more than one cloud. If you want the SRE-native equivalent of a practical skill check rather than a cloud vendor's operations exam, see this course's own SRE Practitioner profile.
1. What does AZ-104 test that a certification like the SRE Foundation doesn't, and what does it deliberately not test that this course is built around? 2. Name the five official AZ-104 skill areas and roughly which two carry the largest weight. 3. What's the practical difference between an availability set and an availability zone, and which one actually protects against a whole-datacenter failure? 4. Name one real difference between AZ-104's exam rules and the CKA's that this page specifically calls out. 5. If your actual gap is Azure networking depth rather than general administration, which Microsoft exam should you look at instead? 6. Why does AZ-104's monitor-and-maintain domain being narrow not mean monitoring is unimportant for an SRE running Azure?
Check your answers
- AZ-104 tests hands-on Azure operations — identity, storage, compute, networking, monitoring configuration. It does not test SLIs/SLOs, error budgets, toil, blameless postmortems, or any other SRE-practice mechanism; those are entirely this course's territory, applied on top of whatever AZ-104 certifies underneath.
- Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Implement and manage virtual networking, and Monitor and maintain Azure resources. Identity/governance and compute both carry the largest published range, 20–25% each.
- An availability set spreads VMs across fault and update domains within a single datacenter, protecting against a rack- or host-level failure. An availability zone places VMs in a physically separate datacenter within the region, each with independent power and cooling — only availability zones protect against a whole-datacenter failure.
- Any one of: AZ-104 is closed-book with no permitted documentation tab (unlike the CKA/CKS's allowlist); its certification validity is 1 year rather than the CKA's 2; or that year renews for free via an online assessment rather than a paid retake.
- AZ-700 (Azure Network Engineer Associate) — AZ-104's networking domain is one slice of a broad exam, not deep specialist coverage.
- Because AZ-104's domain only tests whether you can configure Azure Monitor and Log Analytics — turn it on, write a basic query, wire an alert rule. It says nothing about choosing the right SLIs, designing alerts that don't page people for noise, or building the incident response process around what those alerts trigger — all of which this course's own monitoring, alert-design, and incident-management pages cover in the depth AZ-104 doesn't attempt.