AZ-104: How to Prioritise When Two Domains Own Half the Exam

Quick Facts#

How Are the AZ-104 Domains Weighted?#

Domains 1 and 3 together can account for up to half the exam. Monitoring and maintenance is the smallest domain, at roughly half the weight of either of those two. Allocate your time in proportion: most to identities and compute, a solid middle block to storage and networking, and the least to monitoring.

What Does Each Domain Ask You to Do?#

Microsoft's study guide lists the objectives under each domain. Treat them as your checklist.

Manage Azure identities and governance (20-25%)#

• Manage Microsoft Entra users and groups: create users and groups, manage their properties, manage licenses, manage external users, and configure self-service password reset
• Manage access to Azure resources: manage built-in Azure roles, assign roles at different scopes, and interpret access assignments
• Manage Azure subscriptions and governance: implement and manage Azure Policy, configure resource locks, apply and manage tags, manage resource groups and subscriptions, manage costs with alerts, budgets and Azure Advisor recommendations, and configure management groups

Implement and manage storage (15-20%)#

• Configure access to storage: storage firewalls and virtual networks, shared access signature (SAS) tokens, stored access policies, access keys, and identity-based access for Azure Files
• Configure and manage storage accounts: create and configure accounts, redundancy, object replication, encryption, and managing data with Azure Storage Explorer and AzCopy
• Configure Azure Files and Azure Blob Storage: file shares, containers, storage tiers, soft delete, snapshots, blob lifecycle management, and blob versioning

Deploy and manage Azure compute resources (20-25%)#

• Automate deployment with ARM templates or Bicep files: interpret, modify, and deploy templates and Bicep files, and export a deployment as a template or convert a template to Bicep
• Create and configure virtual machines: create a VM, configure encryption at host, move a VM, manage sizes and disks, deploy to availability zones and sets, and deploy and configure Virtual Machine Scale Sets
• Provision and manage containers: Azure Container Registry, Azure Container Instances, Azure Container Apps, and sizing and scaling for containers
• Create and configure Azure App Service: App Service plans and scaling, certificates and TLS, custom DNS names, backup, networking settings, and deployment slots

Implement and manage virtual networking (15-20%)#

• Configure and manage virtual networks: virtual networks and subnets, peering, public IP addresses, user-defined routes, and troubleshooting connectivity
• Configure secure access to virtual networks: network security groups and application security groups, evaluating effective security rules in NSGs, Azure Bastion, and service endpoints and private endpoints for PaaS
• Configure name resolution and load balancing: Azure DNS, internal and public load balancers, and troubleshooting load balancing

Monitor and maintain Azure resources (10-15%)#

• Monitor resources: interpret metrics, configure log settings, query and analyze logs, set up alert rules and action groups, use Azure Monitor Insights, and use Network Watcher and Connection monitor
• Implement backup and recovery: Recovery Services vaults and Backup vaults, backup policies, backup and restore operations, Azure Site Recovery, failover to a secondary region, and backup reports and alerts

What Changed in the April 2026 Update?#

Microsoft's change log for 17 April 2026 lists the domain weights as unchanged. The updates are minor changes within the sub-areas for storage (Azure Files and Azure Blob Storage), compute (virtual machines and containers), virtual networking (virtual networks), and monitoring (monitoring resources), plus a small update to the audience profile. If you are working from material written before that date, compare it with the current objectives and fill any gaps.

What Should My Study Plan Look Like?#

Plan in phases, not fixed weeks, so it fits the time you have. Count back from your exam date, give each phase a block of time, and make the blocks proportional to the weights.

Phase 1: Identities and governance (20-25%). It's the foundation, start here because it gives you the mental model for how Azure resources relate to each other. Work through Entra users and groups, role assignments at different scopes, Azure Policy, locks, tags, management groups, and cost management with budgets and alerts. Practise in your own subscription: assign a role at a resource group, add a policy, and see what it blocks.

Phase 2: Compute (20-25%). Deploy a virtual machine, resize it, attach a disk, and put it in an availability set or zone. Read an ARM template and a Bicep file, modify one, and deploy it. Then provision a container in Container Instances and in Container Apps, and create an App Service with a deployment slot.

Phase 3: Virtual networking (15-20%). Create two virtual networks and peer them. Add a network security group and check the effective security rules on a network interface. Configure a load balancer, Azure DNS, and a private endpoint. Networking has its own vocabulary in Azure, so time spent building here pays off.

Phase 4: Storage (15-20%). Create a storage account and try the access options side by side: access keys, a SAS token, a stored access policy, and identity-based access for Azure Files. Configure redundancy, a lifecycle rule, soft delete, and versioning, and move data with AzCopy.

Phase 5: Monitoring and maintenance (10-15%). Set up Azure Monitor alerts and an action group, query logs, and look at VM insights. Create a Recovery Services vault, configure a backup policy, restore an item, and review how a Site Recovery failover works.

Phase 6: Practice and review. Take timed practice sets across all domains, review the explanation for every option, and go back to the objectives you missed. Run Microsoft's free practice assessment, and walk through the exam sandbox so the interface is familiar.

Rebuild the main labs from memory without the walkthrough. If you can create a peered network, a VM with a policy assignment, and a backup policy without looking anything up, you understand the objective.

What Hands-On Tasks Prove You Know Each Objective?#

The audience profile says candidates should have experience with PowerShell, the Azure CLI, the Azure portal, ARM templates or Bicep files, and Microsoft Entra ID. The quickest way to build that experience is to turn each objective into a small task you can complete without help. Here is a starter list, one task per domain area:

• Identities and governance: create a user and a group, assign a built-in role to the group at a resource group scope, then assign a policy at the subscription and confirm what it blocks or audits. Add a resource lock and a tag, and set a budget with an alert.
• Storage: create a storage account, then create a container and a file share. Generate a SAS token, create a stored access policy, and compare both with identity-based access. Set a lifecycle rule and enable soft delete and versioning.
• Compute: deploy a VM from the portal, then deploy the same VM from an ARM template and from a Bicep file. Resize it, add a data disk, and place a second one in an availability zone. Provision a container in Container Instances and create an App Service with a deployment slot.
• Networking: create two virtual networks, peer them, and add a network security group. Use the effective security rules view on a network interface, then add a private endpoint and an Azure DNS record.
• Monitoring and maintenance: create an alert rule with an action group, run a log query, create a Recovery Services vault, and back up and restore a VM.

Do each task in the portal first, then repeat it with PowerShell or the Azure CLI, because the objectives expect familiarity with multiple working methods. Delete the resources afterwards so that you do not run up costs, and keep a short note of what you did and what surprised you. Those notes become a fast final review.

How Do I Use the Practice Assessment and the Sandbox?#

Microsoft offers a free practice assessment for AZ-104, and an exam sandbox where you can explore the exam environment. They serve different purposes.

The practice assessment is a diagnostic. Take it early, before you have studied much, to see which domains are weakest. Retake it later in your plan to check whether the gaps have closed. Look at each question you missed and find the matching objective in the study guide, then add that objective to your gap list.

The exam sandbox is for the interface. It lets you see the look and feel of the exam and try the question types in the same interface you will use on the day. Spend a short session there in the final week so that nothing about the format surprises you.

Neither replaces hands-on practice or a large bank of practice questions. Use them as checkpoints along the way: practice assessment first, practice question sets and labs through the middle of your plan, and the sandbox at the end.

How Do I Review in the Final Week?#

In the last week, stop adding new topics. Work through your gap list from the practice assessment and your practice sets, and for each item confirm that you can explain it in your own words and do it in the portal. Rank the objectives by weight and re-check the heaviest first: identities and governance, then compute, then storage and networking, then monitoring.

Take one timed practice set across all five domains, then review every explanation, including those for the questions you got right. If an objective is still weak, build it again from scratch rather than rereading about it.

On the day before the exam, do a light review of your notes and check your appointment details. Rest matters more than one more practice set.

Where Can I Practise with Realistic AZ-104 Questions?#

Microsoft provides a free practice assessment for AZ-104, and an exam sandbox for the interface. Use the practice assessment early to find your gaps and again near the end to check progress.

CertCompanion's AZ-104 practice questions give you scenario-based practice with explanations for every option. Start with the 30 free questions to see which domains need work, then drill the bank by domain.

How Does a Realistic AZ-104 Question Work?#

An Azure Policy is assigned to a resource group named 'RG-Production'. The policy effect is 'Deny' and it disallows the creation of any resource of the type 'Microsoft.Compute/virtualMachines'. An administrator now needs to deploy a new virtual machine named 'VM-New' and its associated network interface into this resource group. What must the administrator do first?

• A. Add the virtual machine's resource type to the policy's allowed list.
• B. Add a new subnet to the virtual network for the VM.
• C. Create a policy exemption just for the new VM.
• D. Remove the 'Microsoft.Compute/virtualMachines' resource type from the policy's Deny list or remove the policy assignment.

Show the answer and the reasoning

Correct answer: D. Remove the 'Microsoft.Compute/virtualMachines' resource type from the policy's Deny list or remove the policy assignment.

The administrator must remove the policy assignment from the resource group or modify the policy definition to remove 'Microsoft.Compute/virtualMachines' from the list of disallowed types. The 'Deny' effect in Azure Policy actively prevents the creation or update of resources that match the policy's condition. As long as this policy is in effect on the resource group, any attempt to create a virtual machine within it will be blocked by the Azure Resource Manager.

Here is why the other options are incorrect: A policy exemption could work, but modifying or removing the blocking policy is the more direct first action to consider. Adding a subnet is a networking task and does not resolve the policy-enforced deployment block.

How Do I Keep the Certification Active?#

Microsoft associate, expert, and specialty certifications expire annually. You renew by passing a free online assessment on Microsoft Learn, so you do not retake the full exam. Set a reminder before your certification expires so you have time to take the assessment.

For other Microsoft exams on CertCompanion, see the Microsoft certification practice exams page. The AZ-104 exam guide goes through each domain in more detail.

Frequently Asked Questions#

What is the passing score for AZ-104? 700. Microsoft's scoring documentation, linked from the study guide, explains how scores are reported.

How are the AZ-104 domains weighted? Identities and governance 20-25%, storage 15-20%, compute 20-25%, virtual networking 15-20%, and monitoring and maintenance 10-15%.

When were the skills measured last updated? On 17 April 2026. The change log lists minor updates in the storage, compute, networking, and monitoring sub-areas, and no change to the domain weights.

What experience does Microsoft expect? Experience with PowerShell, Azure CLI, the Azure portal, Azure Resource Manager templates or Bicep files, and Microsoft Entra ID, plus familiarity with operating systems, networking, servers, and virtualization.

Does the certification expire? Yes, annually. You renew by passing a free online assessment on Microsoft Learn.

Is there a free practice assessment? Yes. Microsoft offers one for AZ-104, and there is also an exam sandbox where you can explore the exam environment.

Ready to find your baseline? Start with free AZ-104 practice questions at CertCompanion.

Checked against official Microsoft AZ-104 exam documentation and current candidate reports. Last verified 2026-10-30.