AZ-104 Microsoft Azure Administrator: Operating Identity, Storage, Compute, Networks, and Monitoring

AZ-104, Microsoft Azure Administrator, is the current Microsoft exam for the Microsoft Certified: Azure Administrator Associate credential. It validates the ability to implement, manage, and monitor an organization’s Azure environment across identity and governance, storage, compute, virtual networking, and operational monitoring. The role sits at the center of cloud operations because administrators connect business requirements to day-to-day resource configuration and service reliability.

Microsoft’s April 17, 2026 blueprint continues to expect practical familiarity with operating systems, networking, servers, virtualization, PowerShell, Azure CLI, the Azure portal, ARM templates or Bicep, and Microsoft Entra ID. AZ-104 is therefore not a “learn the portal” exam. Candidates need to understand how resources relate, how permissions are applied, how workloads communicate, and how administrators diagnose problems when an environment does not behave as expected.

As of October 3, 2026, AZ-104 remains current and schedulable. Because Azure features evolve continuously, candidates should use the live study guide and current service documentation for final preparation. The stable core of the role is operational reasoning: apply governance, choose and configure resources, enforce access, connect networks, monitor health, and recover from failure with the least unnecessary complexity.

Identity and governance determine who can change the Azure environment

Azure administration begins with Microsoft Entra ID identities, groups, role assignments, subscriptions, resource groups, and governance controls. Authentication answers who an identity is; Azure role-based access control determines what that identity can do at a particular scope. Candidates should understand inheritance because a role assigned at a subscription can affect many resources below it.

Least privilege should guide role assignment. Giving every operator broad owner rights may solve short-term access problems while creating long-term security and audit risk. Administrators should choose built-in roles carefully, scope them as narrowly as practical, and review access when responsibilities change. Locks and Azure Policy address different needs: locks protect resources from certain changes, while policy evaluates or enforces configuration standards.

The identity focus overlaps with the security thinking described in Azure identity and access management. AZ-104 candidates do not need to become security engineers, but they must be able to operate an environment where access, governance, and administrative responsibility are explicit rather than improvised.

Storage design depends on durability, access, performance, and lifecycle

Azure storage includes object, file, queue, and other service patterns. Administrators should understand when Blob Storage fits unstructured objects, when Azure Files is appropriate for managed file shares, and how account configuration affects redundancy, network access, encryption, and performance. The exam expects practical configuration rather than only service recognition.

Access can be controlled through Entra-based authorization, shared access signatures, keys, network restrictions, and other mechanisms depending on the service. Administrators should prefer scoped, temporary access when possible and avoid distributing powerful account keys without necessity. Private endpoints and firewall rules can reduce public exposure for workloads with stronger network requirements.

Lifecycle management helps control cost by moving or deleting objects according to age and usage. Redundancy choices affect resilience across hardware, zones, or regions. Candidates should reason from the workload’s recovery and availability requirements rather than choosing the most expensive redundancy option by default.

Virtual machines require operating-system thinking as well as Azure configuration

Creating a VM is only the start. Administrators need to choose size, disks, network interfaces, availability approach, identity, extensions, and access methods, then monitor the machine after deployment. A VM may be healthy from Azure’s control plane while the guest operating system still has application, patching, disk, or service problems.

Scale sets provide a way to manage groups of similar virtual machines with scaling and availability behavior. Availability zones and other resilience options help reduce the impact of infrastructure failures. The correct design depends on application architecture; placing a single stateful VM in a scale set does not automatically make the application highly available.

Automation reduces repetitive administration. PowerShell scripting, Azure CLI, templates, and Bicep allow administrators to create repeatable changes and document intent. Candidates should practice performing common tasks through more than one interface so they understand the Azure resource model beneath the portal.

Containers and App Service change what administrators manage directly

Platform services reduce some operating-system responsibility while creating new configuration concerns. App Service administrators may configure plans, deployment slots, networking, certificates, identity, and scaling without maintaining the underlying servers. Azure Container Instances and Container Apps can run containerized workloads with different operational trade-offs.

The administrator’s job is to understand the boundary. A managed platform can patch infrastructure, but the customer still owns application configuration, identities, data, access, and many network decisions. Candidates should avoid assuming that “platform as a service” means “no administration.”

Container workloads also interact with registries, secrets, networking, and monitoring. Even when developers own the image, administrators may be responsible for the Azure environment that allows the workload to pull that image, reach dependent services, and scale safely.

Virtual networking is where many Azure administration problems converge

Virtual networks, subnets, route tables, network security groups, DNS, peering, public IPs, private endpoints, load balancing, and gateways determine how resources communicate. AZ-104 scenarios often become easier when candidates draw the traffic path: source, destination, name resolution, route, security rule, and service endpoint or private endpoint.

Peering connects virtual networks but does not erase their security boundaries. Network security groups filter traffic at supported scopes, while user-defined routes can change the next hop. DNS configuration can cause failures that look like application or firewall problems, so troubleshooting should verify name resolution before assuming packets are being blocked.

Candidates who want deeper specialist networking coverage can continue into AZ-700. AZ-104 does not require the same depth as a dedicated network-engineering exam, but administrators still need enough network understanding to deploy and diagnose ordinary Azure environments and to know when a problem needs specialist escalation.

Load balancing and application delivery require the right layer of control

Azure offers multiple traffic-distribution services because different workloads need different layers. A layer-4 load balancer handles network traffic differently from an application-aware gateway. Global routing and regional balancing solve different problems. Candidates should select a service based on protocol, scope, health-probe needs, TLS behavior, and application requirements.

Health probes are particularly important because a running VM is not necessarily a healthy application instance. Traffic should be directed toward endpoints that can actually serve the request. Administrators should understand how probe configuration and backend health influence availability and troubleshooting.

Private access patterns can also affect application delivery. A service exposed only through a private endpoint behaves differently from a public endpoint protected by a firewall. Architecture decisions should be documented so future operators know whether lack of public reachability is a defect or an intentional security boundary.

Monitoring should connect resource signals to actionable diagnosis

Azure Monitor, metrics, logs, alerts, activity logs, and diagnostic settings help administrators understand what resources are doing. Metrics are useful for numeric time-series behavior, while logs provide richer event and diagnostic detail. Activity logs show control-plane changes, which can reveal whether a problem began after a configuration modification.

Alerts should be actionable. An alert that fires constantly without a clear response path trains teams to ignore it. Thresholds, dimensions, action groups, and severity should reflect real operational conditions. Dashboards or workbooks can help visualize patterns, but they should support diagnosis rather than exist merely as decorative monitoring.

The practical responsibilities described in the Azure administrator role extend beyond creating resources. Administrators are accountable for keeping environments understandable and supportable, which requires enough telemetry to diagnose failures without guessing.

Backup and recovery are different from high availability

High availability aims to keep a service running through certain failures; backup preserves recoverable data or system state. An application can be highly available while still replicating accidental deletion or corruption. Administrators need both operational resilience and a recovery strategy matched to business requirements.

Recovery objectives should guide design. Recovery point objective describes acceptable data loss, while recovery time objective describes acceptable restoration time. These requirements influence backup frequency, replication, storage, and recovery architecture. More redundancy is not useful if it does not address the actual failure the organization needs to survive.

Testing recovery is essential. A backup that has never been restored is only an assumption. Administrators should know how to verify protection status, perform recovery, and document dependencies so a restored resource can reconnect to networks, identities, applications, and data services.

Cost and governance are part of administration, not finance-only concerns

Administrators influence cost through resource sizing, storage tiers, idle resources, reserved capacity decisions, scaling, and lifecycle configuration. Cost analysis and budgets can reveal trends, but technical context is needed to decide whether a resource is waste or necessary resilience. Deleting an apparently idle component without understanding dependencies can create a larger outage than the savings justify.

Tags and naming standards help organize resources for ownership, environment, application, or cost reporting. Policy can require or append certain configuration, while resource groups create management boundaries. Consistent structure reduces the time required to locate owners and understand why a resource exists.

The AZ-104 administration can reinforce the breadth of the role, but hands-on practice should connect cost and governance to daily operations. Candidates should be able to explain why a control exists and what problem it prevents.

Memorizing creation steps is not enough because real administration is dominated by exceptions. A user cannot access a resource, a VM cannot reach a database, a storage account rejects a request, an application fails after a route change, or an alert fires without an obvious cause. Candidates should practice tracing each scenario through identity, network, configuration, and telemetry.

Build a small environment and operate it through change. Create resource groups and policies, deploy storage and compute, configure a virtual network, assign roles, enable monitoring, then make controlled mistakes. Remove a permission, change an NSG rule, break DNS, exhaust a quota, or misconfigure a storage firewall and diagnose the effect.

AZ-104 remains one of Microsoft’s core Azure operations exams because the administrator role is broad and concrete. Candidates who can connect governance, identity, storage, compute, networking, monitoring, backup, and automation are preparing for the real job as well as for the certification assessment.