← Back to Portal
AZ-104 Quick Reference Cheat Sheet
Golden rules, service comparisons, and critical numbers at a glance.
📋 AZ-104 QUICK REFERENCE CHEAT SHEET
Golden Rules, Critical Numbers, and Comparison Tables
Print this or keep it open during final review. One page per section recommended.
EXAM FACTS
| Item | Value |
|---|---|
| ------ | ------- |
| Code | AZ-104 |
| Title | Microsoft Azure Administrator Associate |
| Questions | ~40–60 |
| Time | 100 minutes |
| Pass | 700 / 1000 |
| Cost | $165 USD |
| Delivery | Pearson VUE |
| Skills measured | April 17, 2026 |
DOMAIN WEIGHTS
| Domain | Weight |
|---|---|
| -------- | :------: |
| 1. Entra ID & Governance | 20–25% |
| 2. Storage | 15–20% |
| 3. Compute | 20–25% |
| 4. Networking | 15–20% |
| 5. Monitor & Maintain | 10–15% |
DOMAIN 1: IDENTITY & GOVERNANCE
Entra ID Licences
| Feature | P1 | P2 |
|---|---|---|
| --------- | :--: | :--: |
| Conditional Access | ✅ | ✅ |
| Dynamic groups | ✅ | ✅ |
| Hybrid identity (Connect) | ✅ | ✅ |
| PIM | ❌ | ✅ |
| Identity Protection | ❌ | ✅ |
| Access Reviews | ❌ | ✅ |
Hybrid Identity
| Method | Password in Cloud | Validates On-Prem |
|---|---|---|
| -------- | :-----------------: | :-----------------: |
| PHS | Hash | No (cloud auth) |
| PTA | No | Yes (real-time) |
| Cloud Sync | Hash | No |
| Federation | No | Yes (AD FS) |
RBAC Key Roles
| Role | Can Do | Cannot Do |
|---|---|---|
| ------ | -------- | ----------- |
| Owner | Everything + RBAC | — |
| Contributor | Create/manage resources | Manage RBAC |
| Reader | View only | Modify anything |
| VM Contributor | Manage VMs | Manage VNet |
| Storage Blob Data Contributor | Read/write blobs | Manage account |
| Storage Account Contributor | Manage account | Access blob data |
Azure Policy Effects
| Effect | Action |
|---|---|
| -------- | -------- |
| Audit | Log non-compliance |
| Deny | Block creation |
| DeployIfNotExists | Auto-deploy missing resource |
| Modify | Change tags/properties |
| Append | Add field to resource |
Resource Locks
| Lock | Modify | Delete |
|---|---|---|
| ------ | :------: | :------: |
| CanNotDelete | ✅ | ❌ |
| ReadOnly | ❌ | ❌ |
DOMAIN 2: STORAGE
Replication SKUs
| SKU | Zone | Geo | Read 2nd |
|---|---|---|---|
| ----- | :---: | :---: | :--------: |
| LRS | ❌ | ❌ | ❌ |
| ZRS | ✅ | ❌ | ❌ |
| GRS | ❌ | ✅ | ❌ |
| GZRS | ✅ | ✅ | ❌ |
| RA-GRS | ❌ | ✅ | ✅ |
| RA-GZRS | ✅ | ✅ | ✅ |
Blob Tiers
| Tier | Min Days | Access Pattern |
|---|---|---|
| ------ | :--------: | ---------------- |
| Hot | 0 | Frequent |
| Cool | 30 | Infrequent |
| Cold | 90 | Rare |
| Archive | 180 | Long-term (rehydrate) |
Storage Access
| Method | Scope | Best Practice |
|---|---|---|
| -------- | ------- | --------------- |
| Account key | Full account | Rotate; avoid in apps |
| SAS | Delegated | Short expiry; stored policy |
| User delegation SAS | Blob | Preferred |
| Managed Identity | App-to-storage | Production default |
| Entra ID | User/group | Interactive access |
Azure Files vs Blob
| Files | Blob | |
|---|---|---|
| --- | :---: | :---: |
| SMB/NFS mount | ✅ | ❌ |
| REST API | ❌ | ✅ |
| Lift-and-shift shares | ✅ | ❌ |
DOMAIN 3: COMPUTE
VM Availability
| Feature | Protects | SLA |
|---|---|---|
| --------- | ---------- | :---: |
| Availability Set | Rack failure | 99.95% |
| Availability Zone | DC failure | 99.99% |
| VMSS | Auto-scale group | Varies |
VM Power States
| Action | Billed Compute | Temp Disk | Public IP |
|---|---|---|---|
| -------- | :--------------: | :---------: | :---------: |
| Running | ✅ | ✅ | Kept |
| Stopped (allocated) | ✅ | ✅ | Kept |
| Deallocated | ❌ | ❌ Lost | Released* |
*Unless static IP
Disk Types
| Type | Use |
|---|---|
| ------ | ----- |
| Standard HDD | Dev/test |
| Standard SSD | Web servers |
| Premium SSD | Production DB |
| Ultra Disk | Highest IOPS |
Compute Platform
| Workload | Service |
|---|---|
| ---------- | --------- |
| Web/API PaaS | App Service |
| Simple container | ACI |
| Scale-to-zero containers | Container Apps |
| Full Kubernetes | AKS |
| Legacy/custom OS | VMs / VMSS |
| Event-driven | Functions |
App Service Tiers
| Tier | Slots | Autoscale |
|---|---|---|
| ------ | :-----: | :---------: |
| Free/Shared | ❌ | ❌ |
| Basic | ❌ | Manual |
| Standard | ✅ | ✅ |
| Premium | ✅ | ✅ + zones |
DOMAIN 4: NETWORKING
Reserved Subnet Names
| Name | Service |
|---|---|
| ------ | --------- |
AzureBastionSubnet | Bastion (/26+) |
GatewaySubnet | VPN/ER Gateway (/27+) |
AzureFirewallSubnet | Azure Firewall (/26) |
NSG Defaults
- Inbound: Allow VNet, Allow Azure LB, Deny all else (65500)
- Outbound: Allow VNet, Deny all else (65500)
- Lower priority number = evaluated first
Connectivity
| Method | Transitive | Use |
|---|---|---|
| -------- | :----------: | ----- |
| VNet Peering | ❌ | Same/cross-region VNet |
| VPN S2S | Via gateway | On-prem to Azure |
| VPN P2S | — | Individual clients |
| ExpressRoute | Via gateway | Dedicated circuit |
Load Balancing
| Service | Layer | Scope |
|---|---|---|
| --------- | ------- | ------- |
| Load Balancer | L4 | Regional |
| App Gateway | L7 | Regional |
| Front Door | L7 | Global |
| Traffic Manager | DNS | Global |
Private Access
| Feature | Private IP | Works On-Prem |
|---|---|---|
| --------- | :----------: | :-------------: |
| Service Endpoint | ❌ | ❌ (VNet only) |
| Private Endpoint | ✅ | ✅ (via VPN/ER) |
Network Watcher Tools
| Tool | Use |
|---|---|
| ------ | ----- |
| IP Flow Verify | NSG allow/deny check |
| Next Hop | Routing verification |
| Connection Troubleshoot | End-to-end connectivity |
| NSG Flow Logs | Traffic logging |
| Packet Capture | NIC-level capture |
DOMAIN 5: MONITOR & MAINTAIN
Monitoring Stack
Resources → Diagnostic Settings → Log Analytics → Alerts → Action Groups
Log Types
| Log | Content |
|---|---|
| ----- | --------- |
| Activity Log | ARM operations (who deleted what) |
| Resource Logs | Data plane (VM syslog, blob access) |
| Metrics | Numeric time-series (CPU, requests) |
Alert Types
| Type | Source |
|---|---|
| ------ | -------- |
| Metric | Platform/guest metrics |
| Log (scheduled query) | KQL on Log Analytics |
| Activity log | Control plane events |
Backup
| Service | Vault |
|---|---|
| --------- | ------- |
| VM Backup | Recovery Services |
| File Share Backup | Recovery Services |
| Blob soft delete | Storage account setting |
TOP 20 GOLDEN RULES
- 1. Entra ID P2 → PIM, Identity Protection, Access Reviews
- 2. Conditional Access for granular MFA (not per-user MFA)
- 3. Policy Deny prevents; RBAC permits
- 4. ZRS = zone; GRS = region; GZRS = both
- 5. Private Endpoint = private IP; Service Endpoint = VNet route only
- 6. Bastion →
AzureBastionSubnet, no public IP on VM - 7. Peering non-transitive — spoke-to-spoke via hub
- 8. NSG stateful — return traffic auto-allowed
- 9. Deallocate stops compute billing
- 10. Availability Set ≠ Zone per VM
- 11. Container Apps for microservices; ACI for simple tasks
- 12. Blob Data Contributor = data plane; Account Contributor = control plane
- 13. Managed Identity over keys in production
- 14. Diagnostic settings not enabled by default
- 15. IP Flow Verify for NSG troubleshooting
- 16. Recovery Services vault for Backup + ASR
- 17. PHS default hybrid; PTA on-prem validation
- 18. Locks block even Owner
- 19. User delegation SAS preferred for blobs
- 20. AMA replaces legacy Log Analytics agent
QUICK CLI REFERENCE
# Login and set subscription az login && az account set --subscription "<id>" # RBAC assignment az role assignment create --assignee <user> --role Contributor --resource-group <rg> # Storage account az storage account create -g <rg> -n <name> --sku Standard_GZRS --https-only true # VM create (no public IP) az vm create -g <rg> -n <name> --image Ubuntu2204 --public-ip-address "" # Bastion az network bastion create -g <rg> -n <name> --vnet-name <vnet> --public-ip-address <pip> # Diagnostic settings az monitor diagnostic-settings create --name <name> --resource <id> --workspace <law> # Policy assignment az policy assignment create --name <name> --policy <policy-id> --scope <scope>
*Skills measured: April 17, 2026*