AZ-104: Administering Azure Under Real Operating Conditions

Azure administration is the discipline of making shared cloud resources available without losing control of identity, cost, security and recovery. A virtual machine that runs today might still be poorly administered if nobody knows who can change it, where its backups live or how its logs will identify the first sign of a problem. Exam AZ-104, Microsoft Azure Administrator, evaluates implementation and operational choices across Microsoft Entra identities, governance, storage, compute, networking and monitoring.

Microsoft's April 17, 2026 skills guide organizes the examination into five major areas: identity and governance, storage, compute, virtual networking, and monitoring/maintenance. AZ-104 is an active administrator exam, not a general cloud vocabulary quiz and not an architecture-only credential. Candidates should know the Azure portal and command-line interfaces and be able to reason about the effect of a configuration change on an existing environment.

Control identity, subscriptions and access scope

Azure resources inherit organizational structure from management groups, subscriptions and resource groups. A management group can influence policy across multiple subscriptions; a subscription forms a key governance and billing boundary; a resource group organizes the lifecycle of particular resources. Design those levels around ownership and security needs rather than trying to use resource groups as a substitute for every possible access decision. A resource's location in the hierarchy affects where assignments and policies may apply.

Microsoft Entra ID supplies identities for people and applications. Azure role-based access control grants permissions at scopes such as a subscription, resource group or individual resource. The principle of least privilege favors narrowly scoped assignments with clear owners. The practical handling of Azure RBAC is important because a user who can view a virtual machine is not necessarily authorized to edit it, and a permission at a parent scope may flow to children. Distinguish Azure management-plane roles from data-plane permissions on services such as Storage.

Governance includes resource locks, tags, Azure Policy and cost controls. A lock guards against certain management actions, but it is not a complete security boundary. Tags help group resources for reporting; they do not themselves block unauthorized operations. Policy can audit or constrain resource properties, while budgets and alerts help detect expenditure trends. The structure of resource groups, locks and management scope is more useful when each control is explained by the administrative failure it prevents.

Configure storage according to use and risk

Azure Storage offers different data abstractions and protection decisions. Blob storage suits objects and large unstructured datasets, while Azure Files presents managed file shares and may require identity integration for familiar access patterns. A storage account's redundancy configuration determines how data copies are placed, but it does not automatically protect against every accidental deletion, malicious overwrite or faulty application change. Recovery objectives must account for the difference between replicated data and restorable historical versions.

Azure Storage redundancy choices include local, zonal and geo-redundant patterns, with differences in durability, availability and cost. A region-wide outage is not the same as a single disk failure, and failover behavior should not be assumed identical between account types. Administrators should recognize what is protected by each option and which additional backup or versioning controls are necessary for a given dataset.

Data access also has multiple mechanisms. Account keys offer broad access and need strong protection, while shared access signatures can grant time- and scope-limited delegated access. Identity-based authorization is often preferable when supported and properly configured. The differences between SAS and Microsoft Entra access to Storage illustrate why an expiring token is not equivalent to a long-lived account key. Configure firewalls and private networking where required, then verify that applications still reach their intended endpoints.

Consider an administrator asked to migrate a lightly used departmental application from one VM to a scalable platform. The evaluation should establish whether the application writes to local disk, depends on fixed machine names, requires persistent sessions or can use an external data store. Moving it into containers without addressing local state could destroy user data when instances restart. App Service might handle the web tier efficiently, while a worker function could process asynchronous jobs; the correct split depends on measured traffic and the app's failure behavior. Record the identity, network and diagnostic dependencies before switching production traffic.

Use a staging deployment to prove that user requests work with ordinary permissions, and then rehearse a rollback that includes the database and configuration changes. This kind of operational test demonstrates why administrators need to understand application dependencies even when developers maintain the source code.

Deploy compute with maintainability in mind

Azure virtual machines require decisions about operating system, size, availability, managed disks, networking and maintenance. A VM image determines the starting software environment, but updates, identities and monitoring must be managed throughout its lifetime. Availability zones and availability sets address different failure concerns. VM scale sets can support scaled patterns, yet autoscaling works only when its signals, application state and limits match the workload's behavior.

Containers and platform-managed compute can reduce some host-maintenance obligations. Azure Container Instances, Azure Container Apps and App Service serve different hosting patterns; a team should choose based on deployment model, networking, scale, observability and operational control rather than because containers sound more modern. An administrator needs to understand how to provision resources, check health and configure access even when developers own the application code.

Deployment repeatability is a practical security and recovery concern. Infrastructure templates and Bicep avoid differences that accumulate through undocumented portal clicks. Infrastructure as code in Azure is relevant because a reviewed deployment can be reproduced in a test subscription and compared against what actually runs. Keep secrets outside templates, use narrow service identities and control who can approve production changes.

Design virtual networks that can be diagnosed

A virtual network defines address spaces and subnets for Azure resources, while network security groups and route tables influence permitted and selected paths. An administrator should know how a subnet address plan affects growth and why overlapping networks make future integrations difficult. DNS resolution, private endpoints, hybrid connections and peering can all influence whether a service is reachable. Diagnosing connectivity means checking name resolution, route selection, access policy and service health separately rather than changing random firewall rules.

Azure virtual network peering connects networks with routing implications, but it is not automatically transitive. A design that works between two test VNets may fail when it grows into a hub-and-spoke environment with multiple trust boundaries. Check address-space overlap, traffic paths and permissions before adding spokes. NAT, public IPs and load balancing add another layer: outbound connectivity, public ingress and application routing are different requirements.

Private endpoints and private DNS illustrate why security controls can create troubleshooting complexity. The private IP record must resolve correctly for intended clients, including relevant hybrid networks. The presence of a private endpoint alone does not mean every public route or credential has been disabled. Validate the full request path from a representative client identity and log the result before concluding that a service has become private.

Monitor, back up and recover workloads

Azure Monitor collects or routes signals from services and hosts, while Log Analytics supports querying certain log data and alerting rules connect observations to operational responses. A metric indicating CPU utilization is not the same as an application log showing an authorization failure. Administrators need to identify which source best answers the current question, retain appropriate evidence and set thresholds that reflect business impact. The relationship between Azure Monitor, Log Analytics and alerting matters because sending every event to an alert channel creates noise rather than faster repair.

Backup design begins with recoverability: which resources require point-in-time restoration, what recovery-point objective is acceptable, and who can approve a restore? Azure Backup and Recovery Services vault configurations cover aspects of protection policy, retention and restore access. Azure Backup and vault design is relevant because a completed scheduled backup does not prove that dependencies or permissions allow a successful application recovery. Test restoration to an isolated environment using permitted data.

Operational records should capture changes, failures and recovery actions. Resource Health and service-health signals provide different information from VM guest metrics. Azure Advisor can highlight optimization opportunities, but recommendations should be evaluated against actual performance and risk constraints. Cost alerts detect spending patterns; they do not automatically provide a safe answer to a memory leak. An administrator who can correlate logs, metrics, configuration and ownership is better prepared than one who memorizes only interface locations.

Prepare for decisions rather than isolated commands

A good AZ-104 lab uses a small subscription with separated test identities, an RBAC design, a tagged resource group, a storage account with limited access, a virtual machine or container and a simple monitoring rule. Introduce a controlled configuration error. Observe whether the account has the correct management permission, whether private DNS resolves and whether relevant logs reveal the fault. Write down why the final correction works instead of only recording the sequence of portal clicks.

AZ-104 is related to but distinct from AZ-305, which evaluates selecting whole-solution architectures. In fact, Microsoft identifies Azure Administrator Associate as a prerequisite certification for Azure Solutions Architect Expert. An AZ-104 candidate performs administration and can explain the operational consequences of architecture choices, whereas an architect compares alternative solution designs to satisfy business requirements. Both need identity, networks and business continuity knowledge, but the decision perspective differs.

Microsoft's April 2026 skills guide remains the reference for the active English exam at this checkpoint date. Localized updates can lag. Training materials should be checked for stale screen names, role assignments and resource options, especially where Azure evolves more quickly than course screenshots. Strong preparation maps each official skill to a real task and a failure mode: who can access it, how it communicates, how it is monitored and how it can be restored.