Microsoft · AZ-104
Validates the ability to implement, manage, and monitor an organization's Microsoft Azure environment, including virtual networks, storage, compute, identity, security, and governance.
Practice Questions
757
≈ 15 practice exams
Duration
120 minutes
Passing Score
700/1000
Difficulty
AssociateLast Updated
Jan 2025
AZ-104 measures five skill areas: managing Azure identities and governance, implementing and managing storage, deploying and managing compute resources, implementing and managing virtual networking, and monitoring and maintaining Azure resources. Microsoft last updated the skills-measured outline on April 17, 2026, so the 757 questions in this bank are checked against the current version rather than an older revision that might test retired features.
You get 100 minutes on exam day, with a mix of multiple-choice, drag-and-drop, and scenario-based questions, sometimes including interactive tasks where you complete an action directly in a simulated Azure portal rather than picking from a list. You need 700 out of a scaled 1,000 to pass. Because several questions involve hands-on portal or CLI tasks rather than pure recall, practicing the underlying commands matters as much as recognizing the right answer choice.
There is no formal prerequisite, but Microsoft expects familiarity with operating systems, networking, and virtualization, plus hands-on experience with PowerShell, the Azure CLI, the Azure portal, and Resource Manager templates or Bicep. The certification renews every 12 months through a free assessment on Microsoft Learn, so there is no need to retake the full exam. Start with the free preview, then work through the full 757-question bank until your accuracy holds steady across all five skill areas.
The Microsoft Certified: Azure Administrator Associate (AZ-104) validates subject matter expertise in implementing, managing, and monitoring an organization's Microsoft Azure environment. The certification covers a broad range of Azure services and capabilities, including virtual networks, storage, compute, identity, security, and governance. Exam content was last updated on April 18, 2025, reflecting the current skills required for the Azure administrator role.
Certified administrators are expected to work proficiently across the Azure portal, Azure CLI, PowerShell, Azure Resource Manager (ARM) templates and Bicep files, and Microsoft Entra ID. The role requires a solid understanding of foundational IT concepts — operating systems, networking, servers, and virtualization — applied to cloud-based infrastructure management. Azure administrators often collaborate with teams responsible for database, application development, DevOps, and security, making this a highly cross-functional credential.
This certification is designed for IT professionals who actively administer Azure cloud environments, typically with a minimum of six months of hands-on Azure experience. Target job roles include Azure Administrator, Cloud Engineer, Azure Systems Administrator, Cloud Support Engineer, and Cloud Operations Analyst. It is particularly suited to professionals transitioning from on-premises infrastructure roles (sysadmins, network admins) into cloud-focused positions, as well as those already working in Azure who want to formalize and validate their skills.
Candidates pursuing advancement into cloud security (AZ-500), DevOps (AZ-400), or Solutions Architect (AZ-305) roles will also find AZ-104 a required or strongly recommended stepping stone, as it establishes the administrative foundation those advanced certifications build upon.
There are no mandatory prerequisite certifications for AZ-104 — it does not require passing AZ-900 (Azure Fundamentals) first, though completing that exam is helpful for those new to Azure concepts. Microsoft recommends at least six months of practical experience administering Azure resources before attempting the exam.
Candidates should have hands-on familiarity with the Azure portal, Azure CLI, and PowerShell for managing resources, as well as working knowledge of Azure Resource Manager templates and Bicep files. A background in traditional IT infrastructure — including networking concepts (DNS, routing, NSGs, load balancing), server administration, operating systems, and virtualization — is strongly recommended, as many exam scenarios assume this foundational knowledge. Experience with Microsoft Entra ID (formerly Azure Active Directory) for identity and access management is also expected.
The AZ-104 exam is proctored and delivered through Pearson VUE, either at a testing center or via online proctoring. Candidates are given 100 minutes to complete the assessment. The exam may include interactive lab-based components (e.g., tasks performed in a live or simulated Azure environment) in addition to standard multiple-choice, case study, drag-and-drop, and scenario-based questions; the exact number of questions varies per administration and is not published by Microsoft.
A score of 700 out of 1000 is required to pass. Scoring is scaled, meaning it does not correspond directly to a raw percentage of correct answers. If a candidate fails on the first attempt, a retake is permitted after 24 hours; subsequent retake waiting periods vary per Microsoft's retake policy. The certification is valid for one year and can be renewed at no cost by passing an online renewal assessment on Microsoft Learn.
Earning the AZ-104 certification opens access to a strong and growing job market, with Azure administrator roles reporting U.S. salaries generally in the range of $88,000–$161,000 annually depending on experience, location, and employer. Certified professionals typically see a 15–20% salary premium over non-certified peers in equivalent roles. Common job titles held by AZ-104 holders include Azure Administrator, Cloud Engineer, Azure Systems Administrator, and Cloud Operations Analyst, with experienced professionals moving into hybrid roles such as Cloud Security Analyst or progressing toward Solutions Architect and DevOps Engineer tracks.
Microsoft Azure holds approximately 20% of the global cloud market and is the dominant platform in enterprise, government, healthcare, and financial services sectors, creating consistent demand for certified administrators. The AZ-104 also serves as a direct prerequisite or recommended foundation for higher-level Microsoft certifications including AZ-500 (Azure Security Engineer Associate), AZ-400 (DevOps Engineer Expert), and AZ-305 (Azure Solutions Architect Expert). Compared to AWS Certified SysOps Administrator and Google Associate Cloud Engineer, AZ-104 is particularly competitive in enterprise-heavy industries where Microsoft's ecosystem — including Microsoft 365, Active Directory, and hybrid cloud via Azure Arc — is deeply embedded.
5 sample questions with answers and explanations. The full bank has 757 questions, enough for 15 full-length practice exams.
Preview — answers shown1. An administrator needs to back up specific folders ('C:\Data' and 'C:\Logs') on a Windows Server Azure VM. They want to use Azure Backup and minimize the amount of additional software or infrastructure required. What is the first component they should deploy to the VM?
Explanation
The first component to deploy is the Microsoft Azure Recovery Services (MARS) agent. The MARS agent is specifically designed for backing up files, folders, and system state from Windows machines directly to a Recovery Services vault in Azure. It is a lightweight agent that allows for granular file/folder level backups without needing a full-fledged Azure Backup Server or System Center Data Protection Manager (SCDPM). This is the most direct and simplest method for the stated requirement. Here is why the other options are incorrect: Azure Backup Server is a much heavier solution for more complex scenarios. The MMA is for collecting logs and performance data for Azure Monitor, not for backups. Windows Server Backup is a local backup tool and doesn't integrate directly with Azure Backup in this way.
2. An administrator needs to prevent a virtual machine, VM-A, from initiating any RDP connections to another virtual machine, VM-B, on the same subnet. What is the most targeted way to implement this using a Network Security Group (NSG)?
Explanation
Create an outbound rule on VM-A's NIC to deny traffic to VM-B. To control traffic leaving a VM, you use an outbound security rule. The most targeted approach is to create a new NSG (or use an existing one) and associate it with the network interface of VM-A. In that NSG, you would create an outbound rule with a high priority (e.g., 100) that denies traffic on destination port 3389 specifically to the destination IP address of VM-B. This blocks only the traffic you intend to block without affecting other communication.
3. A company is migrating its on-premises Hyper-V servers to Azure. They are using Azure Site Recovery for the replication. What are the three primary Azure-side components that must be created to facilitate the replication of an on-premises VM named 'VM-OnPrem'?
Explanation
The three essential components are a Hyper-V site, a Recovery Services vault, and a replication policy. 1. A Recovery Services vault is the central management hub for Site Recovery and Backup. 2. A Hyper-V site is a logical object created within the vault to represent your on-premises Hyper-V environment. 3. A replication policy defines the settings for the replication, such as the recovery point objective (RPO) and recovery point retention. These objects must be in place before you can begin replicating on-premises VMs.
4. An administrator is creating a blob inventory rule using an ARM template. The goal is to create a daily CSV inventory of all block blobs whose names begin with the prefix 'archive-'. The inventory report should be stored in a container named 'inventory-reports'. How should the blobTypes and prefixMatch filter properties be configured?
Explanation
The properties should be blobTypes: ['blockBlob'] and prefixMatch: ['archive-']. The blobTypes filter needs to be set to 'blockBlob' to target the correct type of blob. The prefixMatch filter is used to scope the inventory to blobs whose names start with a specific string. It should be set to 'archive-'. Note that the prefix match applies to the blob names themselves, not the container where the report is stored.
5. An administrator needs to enable an existing Azure user, User1, to create new Azure Policy definitions at the subscription level. User1 should not have any other administrative permissions. Which role should be assigned to User1 at the subscription scope?
Explanation
The Resource Policy Contributor role should be assigned. This built-in role is specifically designed for managing policies. It grants permissions to create and modify policy definitions, initiatives, and assignments. Crucially, it does not grant broad permissions to manage the actual resources themselves, unlike the Contributor or Owner roles. Assigning this at the subscription scope allows the user to create definitions that can be used anywhere in that subscription, adhering to the principle of least privilege.
Microsoft does not publish an exact count; expect roughly 40 to 60 questions in 100 minutes, mixing multiple-choice, drag-and-drop, and interactive lab-style tasks.
700 on a scaled score of 100 to 1,000.
Around $165 USD; the price varies by the country or region where you sit the exam.
Five, per Microsoft’s April 17, 2026 update: manage Azure identities and governance, implement and manage storage, deploy and manage Azure compute resources, implement and manage virtual networking, and monitor and maintain Azure resources.
It renews every 12 months, but you do not retake the full exam — Microsoft offers a free online renewal assessment through Microsoft Learn before the expiration date.
No formal prerequisite, but Microsoft expects familiarity with operating systems, networking, and virtualization, plus hands-on experience with PowerShell, the Azure CLI, the Azure portal, and Resource Manager templates or Bicep.
Microsoft rates it Intermediate. The interactive lab-style questions, where you perform a task in a simulated portal rather than choose from a list, trip up candidates who have only studied theory without hands-on Azure practice.
English, Chinese (Simplified and Traditional), Korean, Japanese, French, Spanish, German, and Portuguese (Brazil).
Administering Information Security in Microsoft 365 (SC-401)
SC-401 · 939 questions
Administering Windows Server Hybrid Core Infrastructure (AZ-800)
AZ-800 · 898 questions
Microsoft Certified: Agentic AI Business Solutions Architect (AB-100)
AB-100 · 700 questions
Microsoft Certified: Azure AI Engineer Associate (AI-102)
AI-102 · 1392 questions
Microsoft Certified: Azure AI Fundamentals (AI-900)
AI-900 · 464 questions
Microsoft Azure AI Fundamentals (AI-901)
AI-901 · 600 questions
$17.99
One-time access to this exam