Manage Azure identities and governance (20–25%)
- Microsoft Entra ID objects: users (member vs. guest), groups (security vs. Microsoft 365; assigned vs. dynamic membership), and licensing. Self-service password reset (SSPR) is configured per group or for all users.
- Azure RBAC: built-in roles (Owner, Contributor, Reader, User Access Administrator) assigned at four scopes — management group, subscription, resource group, resource. Assignments inherit downward; the effective permission is the union of all assignments.
- Governance: Azure Policy (audit or enforce rules, remediate non-compliant resources), resource locks (CanNotDelete, ReadOnly), tags (for organisation and cost reporting), management groups (organise many subscriptions), and cost control with budgets, cost alerts, and Azure Advisor.
Implement and manage storage (15–20%)
- Storage account redundancy: LRS (3 copies, one datacentre), ZRS (across zones in one region), GRS (LRS + async copy to a paired region), RA-GRS (GRS + read access to the secondary), GZRS / RA-GZRS (ZRS + geo).
- Access control: access keys (two, rotate one at a time), shared access signature (SAS) tokens (account / service / user-delegation; scope and expiry), stored access policies (revoke SAS without rotating keys), and Entra identity-based access for Azure Files.
- Blob tiers: Hot, Cool, Cold, Archive — cost drops and retrieval latency/cost rise as you go colder; lifecycle management rules move or delete blobs automatically. Soft delete, versioning, and snapshots protect against accidental change.
- Tools: AzCopy and Azure Storage Explorer for bulk data movement; Azure Files for SMB/NFS shares; object replication for async blob copy between accounts.
Deploy and manage Azure compute resources (20–25%)
- ARM templates / Bicep: declarative deployment; you should be able to read one, change a parameter or resource, and redeploy, and to export an existing resource group as a template.
- Virtual machines: sizing (resize when stopped-deallocated), managed disks, availability sets (fault + update domains, single datacentre) vs. availability zones (separate datacentres) vs. Virtual Machine Scale Sets (autoscaling identical VMs).
- Containers: Azure Container Registry (private images), Azure Container Instances (single fast container), Azure Container Apps (serverless microservices with scaling).
- App Service: an App Service plan sets the pricing tier and compute; scale up = bigger plan, scale out = more instances (manual or autoscale rules); deployment slots for staged releases and swap.
Implement and manage virtual networking (15–20%)
- VNets and subnets; address spaces cannot overlap when peered. VNet peering is non-transitive. User-defined routes override system routes to force traffic through an appliance.
- Network security groups (NSGs): stateful allow/deny rules by priority, applied to a subnet or a NIC; "effective security rules" shows the combined result. Application security groups group VMs so rules reference the group, not IPs.
- Private connectivity: service endpoints keep traffic to a PaaS service on the Azure backbone (service stays public); private endpoints give the service a private IP inside your VNet. Azure Bastion gives browser RDP/SSH with no public IP on the VM.
- Name resolution and load balancing: Azure DNS (public and private zones), Azure Load Balancer (layer 4, internal or public), and health probes that decide which backends receive traffic.
Monitor and maintain Azure resources (10–15%)
- Azure Monitor: metrics (near-real-time numeric, platform or custom) and logs (queried with KQL in a Log Analytics workspace). Diagnostic settings route resource logs to a workspace, storage account, or event hub.
- Alerts: alert rules on a metric or log condition, grouped by severity, firing action groups (email, SMS, webhook, Logic App, Automation runbook); alert processing rules suppress or route at scale.
- Network Watcher: connection troubleshoot, next hop, IP flow verify, NSG diagnostics, and Connection Monitor for ongoing reachability checks.
- Backup and recovery: Recovery Services vault for Azure Backup (VMs, files, SQL in VM) with backup policies; Azure Site Recovery replicates workloads to a secondary region and orchestrates failover.
Test yourself on AZ-104
Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.
Also free: 15 AZ-104 sample questions with answers and the AZ-104 study guide.