AZ-104: The Scenario Trap That Catches Azure Administrators

The short version#

• Networking is the hardest domain despite not being the heaviest. Identity/governance and compute each weigh 20-25%. Networking weighs 15-20%. Networking still fails the most people.
• The exam is scenario-based with no live labs. Multiple choice, drag-and-drop, hotspot, drop-down, and 1-2 case studies. You will not touch the Azure portal during the exam.
• You get split-pane access to Microsoft Learn during the exam, but there's no search function and the clock keeps running. It helps for a handful of targeted lookups. It won't save you.
• Community estimates suggest a first-attempt pass rate of roughly 40-55%. Microsoft publishes no official figure.
• Candidates consistently report that 15-20 hours of targeted hands-on lab practice (in a free Azure account, not on the exam) builds the mental model that reading alone cannot.
• Passing score is 700/1000 on a scaled system. 700 is not 70% correct. Harder questions are weighted more.
• The cert expires in 12 months but renews free via an online assessment on Microsoft Learn.

What the AZ-104 is really testing#

The AZ-104 validates whether you can make sound administrative decisions across Azure's core services. Not whether you can recite PowerShell syntax. Not whether you know the portal click path to create a storage account.

The exam rewards a particular kind of judgment: given a scenario with constraints (budget, security posture, compliance requirement, existing architecture), which Azure-native configuration solves the problem with the least overhead? Most questions aren't "What is X?" They're "A company needs Y. What should you configure?" Two options will be technically valid. One will be the answer Microsoft wants because it follows least privilege, uses the managed service, or costs less. The exam is testing whether you've internalized Azure's opinionated defaults, not just its feature list.

Exam at a glance#

Time-pressure math#

You get roughly 100 minutes of answering time once the intro survey and NDA are done. With ~50-53 questions, that's about 1.8-2 minutes per question. Case study sections eat 15-20 minutes for 5-6 questions because you need to read and digest the scenario before any of them. Once you leave a case study section, you cannot return. That leaves roughly 80 minutes for 45+ general questions, or about 1.7 minutes each.

This isn't generous. Candidates who get stuck parsing ARM template JSON for 5 minutes on a single question find themselves rushing through the last 10. The flag-and-return strategy matters here: flag anything that takes more than 2 minutes and come back after you've banked the questions you know.

The exam includes unique question types beyond standard multiple choice. Hotspot questions ask you to click the correct area of a diagram or configuration. Drag-and-drop ordering questions require you to sequence four or five actions correctly. Drop-down questions embed selection menus in a scenario. Encountering these for the first time on exam day is a bad idea. The official exam sandbox shows you every format before you sit for the real thing.

One more detail: the exam is open book. A split-pane to Microsoft Learn opens alongside your questions. There is no Ctrl+F search. Navigating to the right page while the clock runs is slow enough that it only works for two or three targeted verifications. Don't count on it as a safety net.

Who this exam is for (and who should wait)#

The AZ-104 targets working IT professionals who manage Azure subscriptions, configure virtual networks, provision compute resources, and handle identity and storage. Microsoft's stated assumption: about six months of hands-on Azure administration experience.

If you're in a systems administrator, network administrator, or cloud support role that touches Azure regularly, this is the right next step. If you're a DevOps engineer looking to formalize your Azure knowledge, the AZ-104 provides the administrative foundation that the AZ-400 (DevOps Engineer) builds on. Help desk analysts moving into cloud infrastructure will find this cert opens doors to Azure Administrator and Cloud Systems Administrator roles.

If you have no cloud experience at all, start with the AZ-900 (Azure Fundamentals). The AZ-104 doesn't list AZ-900 as a prerequisite, but candidates who skip it and have no Azure background consistently report feeling lost in the identity and networking domains.

The five domains#

The current official weightings, as of the April 17, 2026 update:

Domain 1 — Manage Azure Identities and Governance (20-25%)#

This is tied for the heaviest domain on the exam, and it's where the "two right answers" pattern hits hardest. The domain covers Microsoft Entra ID (formerly Azure Active Directory), RBAC, Azure Policy, management groups, and subscription governance.

The critical distinction here: RBAC roles and Entra ID roles are different systems with different scopes. RBAC controls what you can do with Azure resources (VMs, storage, networking). Entra ID roles control what you can do with identity objects (users, groups, app registrations). The exam presents scenarios where both role types could theoretically apply, and you need to pick the right one for the scope of the problem. A question about managing VMs in a specific resource group is an RBAC question, even if it mentions users and groups. A question about configuring conditional access policies is an Entra ID question.

Azure Policy shows up more than you might expect. Know the difference between policy definitions and initiatives. Know what happens when a policy is assigned in audit mode versus deny mode. Know how remediation tasks work for existing non-compliant resources. The exam tests whether you can design a governance strategy, not just define one.

Management groups, subscription hierarchies, and resource locks round out this domain. If you can't explain how policy inheritance flows from management group to subscription to resource group, spend more time here.

Domain 2 — Implement and Manage Storage (15-20%)#

Storage is reportedly over-represented on the exam relative to its listed weight. Candidates consistently report that storage questions appeared in higher volume than expected. One test-taker noted that Microsoft placed extra focus on this topic.

The trap questions live in the distinctions between storage account types and access tiers. BlobStorage vs. BlockBlobStorage. Hot, cool, cold, and archive tiers and when each makes sense. Premium storage accounts and their constraints. These feel like trivia when you're studying, and then three questions on exam day hinge on them.

Storage security is the other half. SAS tokens versus stored access policies versus access keys versus identity-based access. A common reported scenario: a storage account returning 403 errors, and you need to identify what's misconfigured. Know how storage firewalls and VNet service rules interact with SAS tokens. Know that Azure Files supports identity-based authentication through Entra ID Domain Services.

Soft delete for blobs and containers was added to the exam objectives in April 2025 and remains current. Blob versioning, snapshots, and lifecycle management policies are small bullets that generate real questions. The exam also tests Azure Backup vault versus Recovery Services vault, which is a distinction many candidates skip.

Domain 3 — Deploy and Manage Azure Compute Resources (20-25%)#

This domain is broad. VMs, VM scale sets, Azure Kubernetes Service, Azure Container Instances, Azure Container Apps, App Service, ARM templates, Bicep, PowerShell, and Azure CLI. The breadth is the challenge.

ARM templates and Bicep are where candidates lose points. The exam doesn't ask you to write a complete template from scratch. It asks you to read one and identify what it does, what's wrong with it, or what parameter needs to change. If you see a JSON block in a question, read the question first. Find out what they're asking about, then look at only the relevant section of the template. Parsing the entire JSON block wastes time.

The cmdlet scope trap is real and appears frequently. Deploying an ARM template that creates a resource group requires New-AzSubscriptionDeployment (subscription scope), not New-AzResourceGroupDeployment. This is a one-cmdlet distinction that catches many candidates. Know which scope each New-Az*Deployment cmdlet targets: tenant, management group, subscription, or resource group.

For containers, know when to use ACI (simple, single-container workloads), AKS (orchestrated multi-container), and App Service (managed web apps). The exam tests selection logic, not deep Kubernetes knowledge. Availability sets versus availability zones still appear despite availability sets being an older pattern. Know the difference and when each applies.

Domain 4 — Implement and Manage Virtual Networking (15-20%)#

This is the domain that fails the most people. Every candidate debrief, every community thread, every prep guide lands on the same conclusion: networking trips people up disproportionately to its weight.

NSG rule evaluation order is the single most important networking concept to nail. Lowest number equals highest priority. Custom rules are evaluated before default rules within the same priority range. NSGs are stateful, which means if inbound traffic is allowed, the return outbound traffic is automatically permitted without an explicit outbound rule. Getting this wrong cascades through multiple questions.

VNet peering is non-transitive. If VNet A peers with VNet B and VNet B peers with VNet C, VNet A cannot reach VNet C through B unless you add user-defined routes and a network virtual appliance or configure gateway transit. The exam loves this. Draw the topology. Trace the packet flow. If you can't do it on paper, you can't do it in 1.8 minutes under pressure.

Load balancer versus Application Gateway is another consistent pain point. Layer 4 (transport) versus Layer 7 (application). SKU constraints. Zone redundancy. Session persistence options. The deciding detail in exam scenarios is usually the protocol or the need for path-based routing, which only Application Gateway supports.

Service endpoints versus private endpoints for PaaS resources, and how private DNS zones integrate with private endpoints, round out the tricky material. Bastion and gateway subnet requirements (AzureBastionSubnet needs a /26 or larger) are the kind of small facts that generate questions. Spend disproportionate time on this domain relative to its weight. It deserves it.

Domain 5 — Monitor and Maintain Azure Resources (10-15%)#

This is the lightest domain by weight. Some community sources suggest it's the easiest. Don't over-invest here at the expense of the four heavier domains.

That said, you still need working knowledge of Azure Monitor, Log Analytics workspaces, alerts, and diagnostic settings. The exam tests whether you can configure monitoring for a specific scenario, not whether you can navigate the Monitor blade.

Azure Backup and Azure Site Recovery appear here. Know the difference: Backup handles data recovery (RPO/RTO for files, VMs, databases). Site Recovery handles disaster recovery (replicating entire workloads to a secondary region). The exam distinguishes between Recovery Services vaults and Backup vaults, which are not the same thing and support different workload types.

Treat this domain as quick wins. Two or three focused study sessions. Don't skip it entirely, but don't let it eat time away from networking or identity.

Where candidates lose points#

The failure reports are consistent on this point. Five patterns account for most failed attempts:

1. Theory without hands-on practice. The exam doesn't have live labs, but candidates without portal experience freeze on configuration scenarios. You need to have created VNet peerings, configured NSG rules, deployed ARM templates, and set up storage access policies at least once. Reading about it isn't the same.

2. Underestimating networking. At 15-20% weight, it looks manageable. The pattern across pass reports shows it's the domain with the steepest gap between "I studied this" and "I can answer scenario questions about this." NSG priority, non-transitive peering, and load balancer selection are where the points disappear.

3. Weak ARM template and Infrastructure-as-Code knowledge. Many candidates skip the template-reading exercises because they feel tedious. Then the exam shows them a 30-line JSON block and asks what changes. Build at least a few templates from scratch in your free Azure account so you can read them fluently.

4. Poor time management on case studies. Case study sections present a scenario with 5-6 questions. You cannot return once you leave. Candidates who spend too long on the case study rush through the remaining 45+ questions. Candidates who rush through the case study miss details that cascade across all its questions. Budget 15-20 minutes per case study and commit to it.

5. The "two right answers" trap. Those who failed and retook it say this consistently: the exam gives you two plausible answers. The differentiator is almost always least privilege, lowest cost, or the native managed service. If you're choosing between a custom solution and a built-in Azure feature that does the same thing, the built-in feature is almost always correct.

The preparation path#

Foundation: Microsoft Learn#

The Microsoft Learn AZ-104 learning paths are free, self-paced, and include interactive sandbox labs. Six modules, roughly 18 hours of content. They cover every exam objective. Their weakness: the exercises are easier than the exam. Completing all six modules doesn't mean you're ready. It means you've covered the material once.

The Exam Readiness Zone is a free 5-part video series from Microsoft that walks through each domain. Good for reinforcement, not as a primary resource.

Official study guide#

The official AZ-104 study guide lists every skill measured, updated as of April 17, 2026. Use it as your checklist. If you can't confidently explain every bullet point to someone else, you have gaps.

Practice questions#

Start with CertCompanion's AZ-104 practice exams to test your scenario reasoning under realistic conditions. Aim for consistent scores of 80-90% before booking your exam date. The exam's unique question types (hotspot, drag-and-drop, drop-down) need practice beyond standard multiple choice.

This is the distribution of CertCompanion's own practice bank, not the official exam weighting. It skews toward the hands-on, scenario-dense domains (compute, storage, networking) where drilling pays off most; the "Other" bucket holds cross-domain and governance items that span more than one objective. Use the official domain percentages above to plan coverage, and this bank to pressure-test it.

The official Microsoft Learn Practice Assessment is free, contains 50 questions, and gives you a baseline. Take it cold before you start studying to identify your weakest domains. Take it again before booking. Questions start repeating after a few attempts, so it's best for benchmarking, not for sustained drilling.

Hands-on lab work#

The official AZ-104 GitHub lab repository has actively maintained exercises (2,755+ commits). Labs 01 (identity), 04 (networking), and 10 (data protection) are the most exam-relevant.

Create a free Azure account ($200 credit for 30 days) and build things. Specifically:

• Create two VNets, peer them, deploy a VM in each, and verify connectivity. Then break the peering and watch what happens.
• Configure NSG rules with conflicting priorities and trace which rule wins.
• Deploy an ARM template at subscription scope and then at resource group scope. Observe the different cmdlets required.
• Set up a storage account with a SAS token, then revoke access using a stored access policy.
• Configure Azure Backup for a VM and perform a test restore.

Delete resources after each practice session. Metered resources like VPN gateways, Application Gateways, and Bastion bill by the hour whether you use them or not, and they add up fast if you leave them running between sessions. Multiple experience threads say the same thing: unexpected Azure bills from forgotten lab resources are a common and entirely avoidable problem.

Official exam tools#

• Exam sandbox: Preview every question type before exam day
• Free Practice Assessment: 50 free official questions for benchmarking
• Microsoft Learn AZ-104 paths: ~18 hours of free content with sandbox labs
• Official GitHub labs: Self-hosted lab exercises

Discount and voucher programs#

Microsoft Virtual Training Days occasionally include a free certification voucher for associate-level exams. Check the Microsoft Events page for availability. Enterprise and academic programs may also offer discounted or free vouchers through organizational agreements.

Study timeline by background#

All ranges below are community estimates, not official Microsoft guidance. Individual results vary significantly.

Microsoft's stated audience assumption is approximately six months of hands-on Azure experience. People with that background who've been studying consistently report that 60-100 total hours covers the material. The widely-shared "15-day" pass report came from a DevOps engineer who worked in Azure daily. Don't benchmark against outliers.

On exam day#

Book early, reschedule if needed. You can reschedule up to 24 hours before your appointment without a fee. Booking creates urgency. Vague plans to "take it when I'm ready" often mean never taking it.

Case study lock-out is real. Once you leave a case study section, you cannot return to it. Read the entire scenario before answering any questions. All 5-6 questions share the same scenario, and details in the scenario description matter for multiple answers.

For ARM/JSON template questions, read the question first. Don't spend three minutes parsing the full template. The question tells you what to look for. Find the relevant parameter or resource block, answer, and move on.

Flag and return. Within the general section (not case studies), you can flag questions and come back. Use this aggressively. If a question takes more than 2 minutes, flag it. Bank the points you know, then spend remaining time on flagged items.

Aim for 800+ on practice exams, not 700. The passing score is 700/1000 scaled. Scaled scoring means harder questions carry more weight. A comfortable buffer matters because you won't know which questions were weighted heavily. The most upvoted advice over the last year: don't schedule until you're hitting 800+ consistently in practice.

Be prepared for the format variety. If you haven't used the exam sandbox, do it the night before. Hotspot questions and drag-and-drop ordering feel different from standard multiple choice, and fumbling with the interface wastes time you don't have.

Entra ID is Azure AD. The rename happened in July 2023. No features changed. If your study materials say "Azure AD," they map 1:1 to "Microsoft Entra ID" in exam questions. Don't let the naming throw you off.

What the cert does for you#

Career impact#

The AZ-104 is one of the most-requested Azure certifications in job postings. According to community salary data, Azure Administrator roles range from approximately $88,000 to $130,000, with Cloud Systems Administrators at $92,000-$140,000 and Azure Solutions Consultants reaching $110,000-$165,000. Senior-level positions and those in high-cost-of-living markets can exceed $145,000. These figures are estimates from career data aggregators and should be treated as directional, not precise.

Roles that commonly list AZ-104 as preferred or required include Azure Administrator, Cloud Systems Administrator, DevOps Engineer, Cloud Support Specialist, and Azure Solutions Consultant. Systems administrators and network administrators transitioning to cloud often find this cert accelerates the move. Community career data suggests the certification correlates with a $15,000-$25,000 annual salary increase, though individual outcomes depend heavily on location, experience, and the role itself.

Renewal#

The AZ-104 expires 12 months after you earn it. Renewal is free via an online, unproctored assessment on Microsoft Learn. You can take it starting six months before expiration. It covers updated content and is shorter than the full exam. There's no reason to let it lapse.

Next certifications#

Three paths branch naturally from the AZ-104:

• AZ-305 (Azure Solutions Architect Expert): Requires AZ-104 as a prerequisite. Moves from administration to architecture and design decisions.
• AZ-500 (Azure Security Technologies): Deepens the security and identity concepts from AZ-104's Domain 1 into a dedicated security practice.
• AZ-700 (Azure Networking Solutions): Takes the networking domain that trips everyone up and makes an entire certification out of it. Best for network-focused roles.

Microsoft also offers free Applied Skills credentials (e.g., AZ-1002 for virtual networking, AZ-1003 for storage security, AZ-1004 for Azure Monitor) that are lab-based, unproctored, and narrow in scope. They complement the AZ-104 well as targeted reinforcement for weak domains, though they are separate credentials, not substitutes.

Recent candidate threads#

Real posts from people preparing for or recently sitting the AZ-104. Read these for the unfiltered version of what the exam felt like:

• Az104 Passed Today With 9291000 First Attempt — r/AzureCertification · 52 comments
• Work With Azure Every DAY AND Studied Hard — r/AzureCertification · 52 comments
• Passed Az104 AT First TRY — r/AzureCertification · 37 comments
• Well I DID IT I GOT Az104 — r/AzureCertification · 40 comments
• Passed Az104 Today — r/AzureCertification · 34 comments

Threads pulled from the Reddit communities most active for Microsoft certifications.

Frequently asked questions#

How hard is the AZ-104 compared to other Azure exams? The AZ-104 sits at the associate level, harder than the AZ-900 fundamentals exam and easier than the AZ-305 architect exam. The difficulty comes from breadth (five domains spanning identity, storage, compute, networking, and monitoring) and from the scenario-based question style that rewards judgment over memorization. Third-party estimates put the first-attempt pass rate around 40-55%, though Microsoft publishes no official figure.

How many hours should I study for the AZ-104? Candidates with a year or more of Azure experience typically report 40-80 hours. Those with general IT experience but limited Azure hands-on report 80-120 hours over 6-10 weeks. Complete beginners should plan for 120+ hours and consider taking AZ-900 first. These are community ranges, not official recommendations.

Does the AZ-104 expire? Yes. The certification is valid for 12 months. You can renew it for free through an online assessment on Microsoft Learn starting six months before expiration. The renewal assessment is shorter and unproctored.

Are there prerequisites for the AZ-104? No formal prerequisites. Microsoft recommends approximately six months of hands-on Azure administration experience. The AZ-900 is not required but provides useful foundational knowledge for candidates new to cloud concepts.

Does the AZ-104 have hands-on labs? No. As of 2026, the exam is entirely question-based: multiple choice, drag-and-drop, hotspot, drop-down, and case studies. There are no live portal interactions during the exam. Some older or third-party sources still mention performance-based labs. Verify against the official exam sandbox before your appointment.

What happens if I fail the AZ-104? You must wait 24 hours before your second attempt. After that, a 14-day waiting period applies between all subsequent attempts, with a maximum of five attempts per 12-month period. Pull your score report and target only the failed domains for your retake preparation.

Is the AZ-104 worth it for career advancement? The AZ-104 is consistently one of the most-requested Azure certifications in job postings, and demand for Azure administration skills has trended upward year over year. For IT professionals moving into cloud administration, it's one of the most direct signals to employers that you can manage Azure infrastructure. The return depends on your starting point, but the demand is well established.

Can I use reference materials during the exam? You can access Microsoft Learn documentation in a split pane during the exam. There is no search function within that pane, and the exam clock keeps running. Treat it as a last resort for verifying one or two specific facts, not as a study replacement.

The AZ-104 rewards candidates who've built things, broken things, and learned why Azure's defaults work the way they do. If you want to test where you stand before booking, start with CertCompanion's AZ-104 practice exams and see which domains need work.