Earning this certification proves that you possess the hands-on technical proficiency required to manage, secure, scale, and monitor mission-critical cloud resources across an enterprise footprint. This guide covers Azure Administrator Certification the AZ-104 exam architecture, domain breakdowns, study strategies, and career impact.
Azure Administrator Certification
What Is the Azure Administrator Certification?
The Azure Administrator Associate certification validates your ability to implement, manage, and monitor an organization’s identity, governance, compute, storage, and virtual networking infrastructure within Microsoft Azure.
Unlike foundational certifications (such as AZ-900), which focus primarily on cloud terminology and basic billing models, the AZ-104 is an associate-level, role-based examination. It tests your operational competence.
Candidates are evaluated on how they handle administrative scenarios, diagnose network misconfigurations, enforce zero-trust role assignments, and optimize infrastructure costs.
AZ-104 Exam Specifications
| Exam Detail | Specification |
| Exam Code | AZ-104 |
| Official Title | Microsoft Certified: Azure Administrator Associate |
| Exam Duration | 100 minutes (120 minutes total seat time) |
| Number of Questions | 40–60 questions (varies by form) |
| Question Formats | Multiple-choice, Drag-and-drop, Hot Area, Case Studies |
| Passing Score | 700 / 1000 (scaled score) |
| Exam Cost (USA) | $165 USD |
| Prerequisites | None formally required; 6+ months hands-on experience recommended |
| Renewal Period | 1 year (free online renewal assessment via Microsoft Learn) |
The 5 Core Exam Domains Breakdown
The AZ-104 syllabus is divided into five core domains. Each domain covers a distinct pillar of cloud systems administration.
1. Manage Azure Identities and Governance (20–25%)
This domain focuses on tenant security, user directories, and compliance policies. Cloud administration begins with zero-trust access control and operational guardrails.
- Microsoft Entra ID (formerly Azure AD): Managing user accounts, security groups, enterprise administrative units, guest users, and external identities. You must understand how to configure Self-Service Password Reset (SSPR) and manage licensing at scale.
- Role-Based Access Control (RBAC): Defining custom roles, interpreting inheritance hierarchies, and applying built-in roles (such as Owner, Contributor, Reader, and User Access Administrator) across subscriptions, resource groups, and individual resources.
- Governance and Subscriptions: Implementing Azure Policy to enforce organizational compliance (e.g., restricting deployment regions or requiring specific tags). Configuring resource locks (
ReadOnlyvs.CanNotDelete), organizing Management Groups, and tracking operational budgets through Azure Cost Management.
2. Implement and Manage Storage (15–20%)
Enterprise data management demands deep knowledge of storage tiers, redundancy strategies, and access restrictions.
- Storage Accounts & Security: Provisioning general-purpose v2 storage accounts, configuring storage firewalls and virtual network service endpoints, managing shared access signature (SAS) tokens, and rotating storage access keys.
- Data Redundancy: Understanding the operational trade-offs between Locally Redundant Storage (LRS), Zone-Redundant Storage (ZRS), Geo-Redundant Storage (GRS), and Geo-Zone-Redundant Storage (GZRS).
- Azure Blob Storage & Azure Files: Setting up hot, cool, cold, and archive blob access tiers. Configuring blob lifecycle management rules, versioning, object replication, and immutable storage policies. For Azure Files, mastering SMB/NFS share setups, Azure File Sync orchestration, and soft-delete recovery windows.
3. Deploy and Manage Azure Compute Resources (20–25%)
Compute resources form the workload engine of your infrastructure. This section tests both traditional Infrastructure as a Service (IaaS) and containerized workloads.
- Virtual Machine (VM) Provisioning: Sizing virtual machines, configuring data disks, setting up encryption at host, and planning high availability using Availability Sets (fault domains and update domains) and Availability Zones.
- Virtual Machine Scale Sets (VMSS): Configuring horizontal auto-scaling rules based on CPU and memory thresholds to balance cost and availability.
- Containers and Serverless Platforms: Deploying and scaling applications across Azure Container Instances (ACI), managing images in Azure Container Registry (ACR), and hosting microservices within Azure Container Apps (ACA).
- Azure App Service: Configuring App Service plans, deployment slots, custom domain bindings, managed TLS/SSL certificates, and automated scale-up/scale-out triggers.
4. Configure and Manage Virtual Networking (15–20%)
In my experience evaluating technical exam performance, virtual networking is consistently where most candidates struggle. You must thoroughly understand routing logic and traffic isolation.
- Virtual Network Architecture: Creating Virtual Networks (VNets), designing CIDR subnets, and configuring private and public IP address assignments.