← Back to Portal

AZ-104 Exam Crash Course

Intensive domain-by-domain review for the Azure Administrator Associate exam.

🚀 AZ-104 INTENSIVE CRASH COURSE

Every Domain, Every Admin Task — Pass on First Attempt

Exam: AZ-104 — Microsoft Azure Administrator Associate

Duration: 100 minutes | Questions: 40–60 (scenario + labs) | Pass: 700/1000 | Cost: $165 USD

Delivery: Pearson VUE | Skills measured: April 17, 2026

Focus: Implement, manage, and monitor Azure — NOT architecture design

THE NORTH STAR: AZURE ADMINISTRATOR MINDSET

Every AZ-104 answer tests whether you can configure, deploy, secure, and troubleshoot Azure resources. You are the operator, not the architect.

Administrator Question	Exam Trigger Words
------------------------	-------------------
"How do I deploy this?"	"configure", "implement", "create", "deploy"
"Who can access this?"	"RBAC", "Entra ID", "managed identity", "PIM"
"How do I connect networks?"	"VNet", "peering", "VPN", "NSG", "Bastion"
"How do I protect data?"	"encryption", "backup", "replication", "soft delete"
"How do I know it's healthy?"	"Monitor", "alerts", "diagnostics", "Network Watcher"

Admin vs Architect (AZ-104 vs AZ-305)

AZ-104 Administrator	AZ-305 Architect
---------------------	------------------
Configure RBAC on a resource group	Design RBAC model across 50 subscriptions
Create storage account with GZRS	Choose replication tier for DR requirements
Deploy VM with availability zone	Design multi-region HA topology
Set up site-to-site VPN	Choose VPN vs ExpressRoute vs vWAN
Enable diagnostic settings	Design centralised monitoring platform

Admin Decision Framework (Use on Every Question)

1. READ the requirement — what resource needs configuring?
2. IDENTIFY the Azure service and scope (RG, subscription, tenant)
3. CHECK prerequisites (VNet before VM, storage before blob, identity before MI)
4. SELECT the correct tool (Portal, CLI, PowerShell, ARM/Bicep)
5. VERIFY security defaults (HTTPS, encryption, least privilege, NSG)
6. CONFIRM monitoring/backup is included

DOMAIN 1 — MANAGE MICROSOFT ENTRA IDENTITIES AND GOVERNANCE (20–25%)

1.1 Microsoft Entra ID Fundamentals

Naming: Microsoft Entra ID replaced "Azure Active Directory" — exam uses Entra ID terminology.

Core Concepts

Tenant = dedicated Entra ID directory for an organisation (*.onmicrosoft.com + custom domains)
One tenant can link to many subscriptions; each subscription trusts exactly one tenant
User types: Member (internal), Guest (B2B external), External (B2C — separate product)
Default domain: contoso.onmicrosoft.com — add and verify custom domains via DNS TXT/MX records

Entra ID Licence Tiers — EXAM CRITICAL

Feature	Free	P1	P2
---------	:----:	:--:	:--:
Basic identity & SSO	✅	✅	✅
Self-service password reset (SSPR)	Limited	✅	✅
Conditional Access	❌	✅	✅
Dynamic groups	❌	✅	✅
Hybrid identity (Entra Connect)	❌	✅	✅
Group-based licensing	❌	✅	✅
PIM (Privileged Identity Management)	❌	❌	✅
Identity Protection	❌	❌	✅
Access Reviews	❌	❌	✅
Entitlement Management	❌	❌	✅

🔑 Golden Rule: PIM, Identity Protection, Access Reviews → Entra ID P2 required

User and Group Management

Group Type	Membership	Use Case
------------	------------	----------
Security	Manual or dynamic	RBAC, Conditional Access, app access
Microsoft 365	Manual or dynamic	Email, SharePoint, Teams
Dynamic	Rule-based (attributes)	Auto-add users by department, location
Assigned	Admin adds/removes	Small static teams

Dynamic group rule examples:

user.department -eq "Finance"
user.country -eq "United Kingdom"
(user.department -eq "Sales") and (user.city -eq "London")

🔑 Exam trap: Dynamic groups require Entra ID P1. Cannot add members manually to dynamic groups.

Administrative Units (AUs)

Delegate admin permissions to a subset of users/groups within the tenant
Example: Helpdesk admin can reset passwords only for users in "EMEA" AU
Requires Entra ID P1 or P2

1.2 Hybrid Identity

Sync Methods Comparison

Method	Tool	Password in Cloud	Auth Location	Best For
--------	------	:-----------------:	:-------------:	----------
Cloud-only	N/A	Yes	Cloud	New organisations, cloud-native
Password Hash Sync (PHS)	Entra Connect	Hash only	Cloud	Default hybrid; simplest
Pass-Through Auth (PTA)	Connect + PTA agents	No	On-premises AD	Validate passwords on-prem
Federation (AD FS)	AD FS + Connect	No	On-premises	Legacy; custom claims
Entra Cloud Sync	Lightweight agent	Hash	Cloud	Multi-forest; minimal footprint

🔑 Golden Rule: PHS is the default recommended sync method. PTA validates against on-prem DC in real time.

Entra Connect Configuration

Setting	Description	Exam Note
---------	-------------	-----------
Staging mode	Connect server receives sync but does NOT export changes	DR for Connect server
Password writeback	Cloud password changes sync back to on-prem AD	Requires PHS + P1
Device writeback	Register hybrid Entra joined devices in on-prem AD	Hybrid join scenarios
Group writeback	M365 groups written to on-prem AD	Selective scenarios
Filtering	OU-based, group-based, attribute-based	Limit what syncs

Entra Connect sync cycle: Default every 30 minutes. Force sync:

# PowerShell on Connect server
Start-ADSyncSyncCycle -PolicyType Delta   # Incremental
Start-ADSyncSyncCycle -PolicyType Initial # Full

Seamless SSO

Users on domain-joined machines auto-authenticate to cloud apps
Requires PHS or PTA (not federation-only)
Works with Entra joined and hybrid Entra joined devices

1.3 Authentication and Authorization

Multi-Factor Authentication (MFA)

Method	Description
--------	-------------
Microsoft Authenticator app	Push notification or OTP — recommended
SMS/Voice	Less secure; still accepted
FIDO2 security key	Passwordless hardware key
Windows Hello for Business	Biometric/PIN on Entra joined devices
Certificate-based	Smart card authentication

MFA enforcement options:

1. Security defaults — free tier; MFA for all users (limited customisation)
2. Conditional Access — P1; granular policies
3. Per-user MFA — legacy; avoid in favour of CA

🔑 Exam trap: "Enforce MFA for admins only with granular app control" → Conditional Access, NOT security defaults.

Conditional Access Policy Structure

IF (Assignments)
   Users/Groups, Cloud apps, Conditions (location, device, risk)
THEN (Access controls)
   Grant: MFA, compliant device, hybrid join, approved app
   Session: sign-in frequency, persistent browser
   Block access

Policy states: On, Off, Report-only (what-if / pilot)

Named locations: Trusted (skip MFA) vs Untrusted (require MFA)

Self-Service Password Reset (SSPR)

Requires 2 authentication methods for reset
Methods: phone, email, security questions, authenticator app
Writeback to on-prem requires PHS + P1 licence
Admin can enable for all users or selected groups

1.4 Role-Based Access Control (RBAC)

Scope Hierarchy (inheritance flows DOWN)

Tenant Root Group
  └── Management Group
        └── Subscription
              └── Resource Group
                    └── Resource

🔑 Golden Rule: RBAC assigned at parent scope applies to all children. Most specific assignment wins for a given user.

Key Built-in Roles — MEMORISE THESE

Role	Permissions	Exam Scenario
------	-------------	---------------
Owner	Full access + manage RBAC	Project lead needs everything
Contributor	Create/manage resources, NO RBAC	Developer deploys resources
Reader	View only	Auditor, monitoring
User Access Administrator	Manage RBAC only	Security team grants access
Virtual Machine Contributor	Manage VMs, not the VNet	VM admin without network access
Network Contributor	Manage networks, not VMs inside	Network team
Storage Account Contributor	Manage storage, not data plane blobs	Infra admin
Storage Blob Data Contributor	Read/write blob data	App accessing blobs
Key Vault Administrator	Manage Key Vault, not secrets usage	Platform admin
Key Vault Secrets User	Read secret values	Application identity

🔑 Exam trap: "User needs to upload blobs but NOT manage the storage account" → Storage Blob Data Contributor, NOT Storage Account Contributor.

Custom Roles

Define when built-in roles are too broad
JSON definition: Actions, NotActions, DataActions, NotDataActions, AssignableScopes
Can assign at management group, subscription, RG, or resource level

# List role definitions
az role definition list --query "[?roleName=='Contributor']"

# Create role assignment
az role assignment create \
  --assignee "user@contoso.com" \
  --role "Virtual Machine Contributor" \
  --scope "/subscriptions/<sub-id>/resourceGroups/rg-prod"

Azure RBAC vs Entra ID Roles

Azure RBAC	Entra ID Directory Roles
------------	-------------------------
Controls Azure resources	Controls Entra ID directory
Owner, Contributor, Reader	Global Admin, User Admin, Exchange Admin
Assigned on subscriptions/RGs	Assigned in Entra ID portal
Global Admin does NOT automatically have Owner on subscriptions	Must be explicitly assigned

1.5 Privileged Identity Management (PIM)

Requires Entra ID P2
Eligible assignment = user must activate role (JIT access)
Active assignment = permanent until removed
Activation options: MFA, approval workflow, justification, time limit (max hours)
Access Reviews: Periodic recertification of role assignments

🔑 Golden Rule: "Just-in-time admin with approval and time limit" → PIM eligible assignment

# Check PIM eligible assignments (Microsoft Graph)
Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -Filter "principalId eq '<user-id>'"

1.6 Governance

Management Groups

Organise subscriptions hierarchically (up to 6 levels deep)
Apply Policy and RBAC at MG level — cascades to all child subscriptions
Tenant Root Group = top level; every subscription must be in exactly one MG tree

az account management-group create --name mg-prod --display-name "Production"
az account management-group subscription add --name mg-prod --subscription "<sub-id>"

Azure Policy

Effect	Action	Exam Scenario
--------	--------	---------------
Audit	Log non-compliance; allow creation	Visibility only
AuditIfNotExists	Audit if related resource missing	Check diagnostic settings exist
Deny	Block non-compliant creation	Prevent non-HTTPS storage
Append	Add field to resource (e.g., tag)	Force tag on creation
DeployIfNotExists	Auto-deploy missing resource	Auto-deploy diagnostic settings
Modify	Change tags/properties on create/update	Enforce tag values
Disabled	Policy exists but not evaluated	Testing

🔑 Golden Rule: Policy controls WHAT can be created. RBAC controls WHO can create. Use Deny effect to prevent, not RBAC.

Initiative = bundle of policies assigned together

# Assign built-in policy
az policy assignment create \
  --name "require-tags" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/871b6d14-10aa-478d-b590-943f16f122d3" \
  --scope "/subscriptions/<sub-id>" \
  --params '{"tagName":{"value":"Environment"}}'

Resource Locks

Lock Type	Can Modify?	Can Delete?	Exam Use
-----------	:-----------:	:-----------:	----------
CanNotDelete	✅	❌	Protect production RG from accidental deletion
ReadOnly	❌	❌	Freeze configuration during audit

🔑 Exam trap: Locks apply to all users including Owner. Owner must remove lock first.

ARM, Bicep, and Templates

Tool	Description	Admin Use
------	-------------	-----------
ARM JSON	Native Azure deployment language	Export template from portal
Bicep	DSL that compiles to ARM	Preferred for new IaC
Terraform	Third-party; state file management	Multi-cloud shops
Azure CLI / PowerShell	Imperative commands	One-off admin tasks

// Bicep example — storage account with HTTPS enforced
param location string = resourceGroup().location
param storageAccountName string

resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  sku: { name: 'Standard_GZRS' }
  kind: 'StorageV2'
  properties: {
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
  }
}

# Deploy Bicep
az deployment group create \
  --resource-group rg-prod \
  --template-file main.bicep \
  --parameters storageAccountName=stcontoso001

Blueprints (Deprecated → Template Specs)

Azure Blueprints retired; use Template Specs + Policy for governed deployments
Exam may still reference blueprint concepts → equivalent: ARM/Bicep + Policy assignment

1.7 Subscription and Resource Management

Subscription Limits and Quotas

Check quotas: Portal → Subscriptions → Usage + quotas
Request increase via support ticket
Azure CLI: az vm list-usage --location westeurope -o table

Move Resources Between RGs/Subscriptions

Not all resources can move — check documentation
VMs must be stopped; dependent resources may need to move together
RBAC does NOT move automatically — reassign after move

az resource move --destination-group rg-new --ids <resource-id-1> <resource-id-2>

Cost Management Basics

Cost analysis: Filter by tag, RG, service
Budgets: Alert at 50%, 80%, 100% of budget
Advisor: Right-size VMs, delete unused resources
Reservations: 1-3 year commit for VMs, SQL, etc.

DOMAIN 2 — IMPLEMENT AND MANAGE STORAGE (15–20%)

2.1 Storage Account Fundamentals

Storage Account Types

Type	Supported Services	Exam Note
------	-------------------	-----------
General-purpose v2 (StorageV2)	Blob, File, Queue, Table	Default choice
BlockBlobStorage	Premium block blobs only	High-performance blobs
FileStorage	Premium file shares only	High IOPS file shares
BlobStorage	Legacy blob-only	Avoid for new deployments

Performance Tiers

Tier	Media	Use Case
------	-------	----------
Standard	HDD	General purpose, cost-effective
Premium	SSD	Low latency, high IOPS (disks, page blobs)

Replication Options — EXAM CRITICAL

SKU	Zone Redundant	Geo Redundant	Read from Secondary	SLA
-----	:--------------:	:-------------:	:-------------------:	-----
LRS	❌	❌	❌	11 nines
ZRS	✅	❌	❌	12 nines
GRS	❌	✅	❌	16 nines
GZRS	✅	✅	❌	16 nines
RA-GRS	❌	✅	✅	16 nines
RA-GZRS	✅	✅	✅	16 nines

🔑 Golden Rules:

- Zone failure only (single region) → ZRS

- Regional disaster (no zone requirement) → GRS

- Zone + regional disaster → GZRS

- Read from secondary during outage → RA-GRS or RA-GZRS

Redundancy Decision Tree

Need cross-region DR?
├── NO → Need zone protection?
│   ├── YES → ZRS
│   └── NO → LRS (dev/test only for prod)
└── YES → Need zone protection?
    ├── YES → Need read access to secondary?
    │   ├── YES → RA-GZRS
    │   └── NO → GZRS
    └── NO → Need read access to secondary?
        ├── YES → RA-GRS
        └── NO → GRS

# Create storage account
az storage account create \
  -g rg-storage -n stcontoso001 -l westeurope \
  --sku Standard_GZRS \
  --kind StorageV2 \
  --https-only true \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false

2.2 Blob Storage

Blob Types

Type	Size	Use Case
------	------	----------
Block blobs	Up to 190.7 TiB	Images, videos, documents, backups
Append blobs	Up to 195 GiB	Logging, streaming
Page blobs	Up to 8 TiB	VHD disks (legacy; prefer managed disks)

Access Tiers

Tier	Min Storage Duration	Retrieval Cost	Use Case
------	:--------------------:	:--------------:	----------
Hot	None	Lowest	Frequently accessed
Cool	30 days	Medium	Infrequent (30+ days)
Cold	90 days	Higher	Rarely accessed (90+ days)
Archive	180 days	Highest (rehydrate hours)	Long-term retention

🔑 Exam trap: Moving to Archive requires rehydration (hours). Cannot read Archive blobs directly.

Blob Features

Feature	Purpose
---------	---------
Soft delete	Recover deleted blobs (1–365 days retention)
Blob versioning	Keep previous versions on overwrite
Change feed	Ordered log of blob changes
Immutable storage	WORM — legal hold or time-based retention
Object replication	Async copy blobs between storage accounts/regions
Static website	Host static content from `$web` container

Shared Access Signatures (SAS)

SAS Type	Scope	Best Practice
----------	-------	---------------
Account SAS	Entire storage account	Avoid — too broad
Service SAS	Single service (blob, file, etc.)	Specific container
User delegation SAS	Blob only, secured by Entra ID	Preferred for blobs

SAS parameters: sp (permissions), st (start), se (expiry), sr (resource)

🔑 Golden Rule: Use stored access policies for revocable SAS. Shortest expiry possible.

Storage Access Methods

Method	When to Use
--------	-------------
Storage account key	Legacy; rotate regularly; avoid in apps
SAS token	Temporary delegated access
Entra ID (Azure AD)	User/group access to data plane
Managed Identity	App-to-storage without credentials
Anonymous public	Static websites only — disable public access otherwise

2.3 Azure Files

Feature	Azure Files	Blob Storage
---------	:-----------:	:------------:
Protocol	SMB, NFS	REST API
Mount as drive	✅ `\\server\share`	❌
Random read/write	✅	❌ (block-based)
Lift-and-shift file shares	✅	❌

File Share Tiers

Transaction optimised (premium): High IOPS metadata
Hot / Cool: Standard tier cost optimisation
Large file shares: Up to 100 TiB

Azure File Sync

Cache on-premises file server; cloud is source of truth
Multi-site sync; cloud tiering (hot files local, cold in cloud)
Requires Windows Server with File Sync agent

# Create file share
New-AzStorageContext -StorageAccountName stcontoso001 -UseConnectedAccount
New-AzStorageShare -Name "data" -Context $ctx -QuotaGiB 100

2.4 Storage Security

Control	Configuration
---------	---------------
Secure transfer required	HTTPS only — enable by default
Minimum TLS 1.2	Block older TLS versions
Firewall	Selected networks or private endpoint
Private Endpoint	Private IP in VNet for storage access
Service Endpoint	Route traffic over Azure backbone from VNet
Encryption at rest	Microsoft-managed keys (default) or customer-managed (CMK in Key Vault)
Infrastructure encryption	Double encryption at hardware layer

🔑 Exam trap: Private Endpoint = private IP, works from on-prem via VPN/ER. Service Endpoint = VNet only, no private IP.

Storage Account Keys

Two keys (key1, key2) for rotation without downtime
Regenerate one key while apps use the other
Prefer managed identity over keys in production

2.5 Azure Backup and Data Protection

Service	Protects	Vault Type
---------	----------	------------
Azure Backup	VMs, files, SQL in VM, Azure Files	Recovery Services vault
Azure Site Recovery	VM/physical replication for DR	Recovery Services vault
Blob soft delete	Accidental blob deletion	Storage account setting
File share backup	Azure Files	Recovery Services vault

Backup Policy Concepts

Recovery Point Objective (RPO): Max acceptable data loss → backup frequency
Retention: Daily, weekly, monthly, yearly rules
Instant restore snapshots: Quick recovery from local snapshot

# Enable VM backup
az backup protection enable-for-vm \
  --resource-group rg-backup \
  --vault-name rsv-backup \
  --vm vm-web-01 \
  --policy-name DailyPolicy

2.6 Storage Monitoring

Metrics: Capacity, transactions, availability (Platform metrics)
Diagnostic settings: Send logs to Log Analytics
Storage Analytics logs: Read, write, delete operations (via diagnostics)
Microsoft Defender for Storage: Malware scanning, anomalous access

DOMAIN 3 — DEPLOY AND MANAGE AZURE COMPUTE RESOURCES (20–25%)

3.1 Virtual Machines

VM Sizing and Disks

Disk Type	IOPS	Use Case
-----------	------	----------
Standard HDD	Low	Dev/test, backup
Standard SSD	Medium	Web servers, light production
Premium SSD	High	Production databases, high IOPS
Premium SSD v2	Configurable IOPS/throughput	Flexible performance
Ultra Disk	Highest	SAP HANA, top-tier databases

Disk Option	Description
-------------	-------------
OS disk	Boot volume; max 4 TiB
Data disk	Additional storage; up to 32 disks
Temporary disk	Local SSD; ephemeral — lost on stop/deallocate

🔑 Golden Rule: Stop (deallocate) VM = lose temp disk data, release public IP (unless static), stop billing for compute. Stop (stay allocated) = keep resources, still billed.

Availability Options

Feature	Protects Against	SLA	Cost
---------	-----------------	-----	------
Availability Set	Rack failure within DC	99.95% (2+ VMs)	Free
Availability Zone	Entire datacenter failure	99.99% (zone-redundant)	Zone IP cost
Proximity Placement Group	Physical proximity for low latency	N/A	Co-locate VMs
VM Scale Set	Auto-scale identical VMs	Combines with AZ/AS	Standard VM pricing

Availability Set
├── Fault Domain 0 (rack A)
├── Fault Domain 1 (rack B)
└── Fault Domain 2 (rack C)

Update Domain: reboot groups for maintenance

🔑 Exam trap: Availability Set and Availability Zone are mutually exclusive for a single VM — choose one approach.

VM Extensions

Custom Script Extension: Run scripts on provisioning
Azure Monitor Agent: Collect logs and metrics
Dependency Agent: Map dependencies for monitoring
Guest Configuration: Audit VM settings via Policy

# Create Linux VM with SSH key
az vm create \
  -g rg-compute -n vm-web-01 \
  --image Ubuntu2204 \
  --size Standard_D2s_v5 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --vnet-name vnet-prod --subnet snet-web \
  --public-ip-address "" \
  --nsg-rule SSH \
  --zone 1

# Create Windows VM
az vm create \
  -g rg-compute -n vm-app-01 \
  --image Win2022Datacenter \
  --size Standard_D4s_v5 \
  --admin-username azureadmin \
  --admin-password '<ComplexP@ssw0rd!>' \
  --vnet-name vnet-prod --subnet snet-app

3.2 VM Scale Sets (VMSS)

Deploy and manage identical VMs as a group
Autoscale rules: CPU, memory, custom metrics, schedule
Upgrade modes: Manual, rolling, automatic (OS)
Orchestration modes: Uniform (same config) vs Flexible (individual VM management)

az vmss create \
  -g rg-compute -n vmss-web \
  --image Ubuntu2204 \
  --upgrade-policy-mode automatic \
  --instance-count 2 \
  --load-balancer lb-web \
  --vnet-name vnet-prod --subnet snet-web

3.3 Azure App Service

App Service Plans (ASP)

Tier	Features	Use Case
------	----------	----------
Free/Shared	No custom domain SSL, limited	Dev/test
Basic	Manual scale, custom domains	Small production
Standard	Autoscale, staging slots, backups	Production
Premium	More instances, zone redundancy	High-traffic production
Isolated	VNet integration, App Service Environment	Enterprise isolation

Deployment Slots

Staging slot for blue-green deployments
Swap with production (instant traffic switch)
Slot settings: Stick to slot (connection strings) vs swap with app

az webapp deployment slot create -g rg-app -n app-contoso --slot staging
az webapp deployment slot swap -g rg-app -n app-contoso --slot staging

App Service Features

VNet integration: Outbound to VNet resources (regional VNet integration)
Private Endpoint: Inbound private access
Managed identity: Access Key Vault, SQL without credentials
Custom domains + managed certificates: Free SSL for custom domains
Authentication: Built-in Entra ID, social, SAML integration

3.4 Containers

Azure Container Instances (ACI)

Fastest way to run a container — no orchestration
Per-second billing; good for simple jobs, CI/CD agents
Limitations: No auto-scale, no load balancer integration, single host

az container create \
  -g rg-containers -n aci-hello \
  --image mcr.microsoft.com/azuredocs/aci-helloworld \
  --dns-name-label aci-demo-$RANDOM \
  --ports 80

Azure Container Apps (ACA) — EXAM FOCUS

Feature	Container Apps	ACI	AKS
---------	:--------------:	:---:	:---:
Orchestration	Managed (KEDA)	None	Self-managed K8s
Scale to zero	✅	❌	✅ (with config)
Dapr integration	✅ Built-in	❌	Manual
Complexity	Low	Lowest	High
Use case	Microservices, event-driven	Simple tasks	Full K8s control

ACA concepts:

Environment: Shared boundary for apps (VNet injection, Log Analytics)
Container App: One or more containers with scaling rules
Revisions: Version management, traffic splitting
KEDA scalers: HTTP, queue, cron, custom metrics

az containerapp env create -g rg-aca -n aca-env -l westeurope
az containerapp create \
  -g rg-aca -n app-api \
  --environment aca-env \
  --image mcr.microsoft.com/k8se/quickstart:latest \
  --target-port 80 \
  --ingress external \
  --min-replicas 0 --max-replicas 5

Azure Kubernetes Service (AKS) — Admin Essentials

Managed control plane; you manage nodes
Node pools: System (critical addons) + user pools
kubectl is primary admin tool
Azure CNI vs Kubenet networking
Entra Workload ID: Pod identity replacement

az aks create -g rg-aks -n aks-prod --node-count 3 --enable-managed-identity
az aks get-credentials -g rg-aks -n aks-prod
kubectl get nodes

3.5 Azure Functions

Plan	Scale	Cold Start	Use Case
------	-------	------------	----------
Consumption	Auto, scale to zero	Yes	Event-driven, variable load
Premium	Auto, pre-warmed	Minimal	Production, VNet integration
Dedicated (App Service)	Manual/auto	No	Existing ASP, predictable
Container Apps	KEDA-based	Minimal	Containerised functions

Triggers: HTTP, Timer, Blob, Queue, Event Hub, Service Bus, Cosmos DB, etc.

3.6 Disk Encryption

Feature	Encrypts	Key Management
---------	----------	----------------
SSE (platform)	OS + data disks at rest	Microsoft-managed or CMK
Azure Disk Encryption (ADE)	OS + data disks at guest level	BitLocker/DM-Crypt + Key Vault
Encryption at host	All disks on host	Platform-managed

🔑 Exam trap: ADE requires Key Vault. SSE is default and transparent.

DOMAIN 4 — IMPLEMENT AND MANAGE VIRTUAL NETWORKING (15–20%)

4.1 Virtual Network Fundamentals

VNet Concepts

Component	Description
-----------	-------------
Address space	CIDR blocks (e.g., 10.0.0.0/16) — plan for growth
Subnet	Segment within VNet; deploy resources here
NSG	Stateful firewall rules at subnet or NIC level
Route table (UDR)	Custom routing; override system routes
DNS	Azure-provided (168.63.129.16) or custom DNS servers

Reserved Subnet Names — MEMORISE

Subnet Name	Purpose	Min Size
-------------	---------	----------
AzureBastionSubnet	Azure Bastion	/26 or larger
GatewaySubnet	VPN/ExpressRoute gateway	/27 or larger
AzureFirewallSubnet	Azure Firewall	/26
AzureFirewallManagementSubnet	Firewall with management NIC	/26

🔑 Golden Rule: Subnet names are case-sensitive and exact for special subnets.

IP Addressing

Type	Scope	Billing
------	-------	---------
Public IP (Basic)	Open; no zone redundancy	Low
Public IP (Standard)	Zone-redundant; associate with resources	Standard
Static	Retained until deleted	Use for DNS, VPN, firewalls
Dynamic	Changes on stop/deallocate	Dev/test
Private IP	VNet internal	Free

4.2 Network Security Groups (NSG)

Rule Properties

Priority: 100–4096 (lower = higher priority); first match wins
Direction: Inbound or Outbound
Source/Destination: IP, service tag, application security group (ASG)
Action: Allow or Deny

Default Rules (cannot delete)

Priority	Direction	Action	Description
----------	-----------	--------	-------------
65000	Inbound	Allow	VNet to VNet
65001	Inbound	Allow	Azure Load Balancer
65500	Inbound	Deny	All other inbound
65000	Outbound	Allow	VNet outbound
65500	Outbound	Deny	All other outbound

Application Security Groups (ASG)

Group NICs logically; reference ASG in NSG rules instead of IP addresses
Example: "Allow web tier ASG to access database tier ASG on port 1433"

az network nsg rule create \
  -g rg-net -n Allow-HTTPS \
  --nsg-name nsg-web \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-ranges 443 \
  --source-address-prefixes Internet

🔑 Exam trap: NSG is stateful — return traffic automatically allowed. ACLs on storage are different.

4.3 VNet Connectivity

VNet Peering

Property	Value
----------	-------
Transitive	NO — peering is non-transitive
Cross-subscription	Yes, with proper permissions
Cross-region (Global)	Yes — Global VNet Peering
Bandwidth	Up to 10 Gbps+ (no gateway in path)
Gateway transit	Hub VNet can share VPN/ER gateway with spoke

az network vnet peering create \
  -g rg-net -n vnet-a-to-vnet-b \
  --vnet-name vnet-a \
  --remote-vnet vnet-b \
  --allow-vnet-access \
  --allow-forwarded-traffic

VPN Gateway

SKU	Bandwidth	Use Case
-----	-----------	----------
Basic	100 Mbps	Dev only (being retired)
VpnGw1–5	650 Mbps–10 Gbps	Production site-to-site and point-to-site

Connection types:

Site-to-site (S2S): On-premises network to VNet via IPsec
Point-to-site (P2S): Individual client VPN (OpenVPN, IKEv2, SSTP)
VNet-to-VNet: Connect two VNets via gateways

Required components: Local Network Gateway (on-prem) + Connection + VPN Gateway + Public IP

ExpressRoute (Admin Awareness)

Private dedicated connection via connectivity provider
Not encrypted by default — add MACsec or VPN over ER
Peering types: Private (VNet), Microsoft (PaaS), Public (deprecated)

Azure Bastion — EXAM FOCUS

Feature	Value
---------	-------
Purpose	Secure RDP/SSH to VMs without public IP
Subnet	AzureBastionSubnet (/26 minimum)
SKU	Basic (RDP/SSH) vs Standard (+ native client, file copy, shareable links)
No agent	Browser-based or native client
NSG	Do NOT associate NSG with Bastion subnet

az network bastion create \
  -g rg-net -n bastion-prod \
  --public-ip-address pip-bastion \
  --vnet-name vnet-prod \
  --location westeurope \
  --sku Standard

🔑 Golden Rule: "RDP to VM without public IP or VPN client" → Azure Bastion

4.4 Load Balancing and Traffic Distribution

Service	Layer	Scope	Use Case
---------	-------	-------	----------
Azure Load Balancer	L4 (TCP/UDP)	Regional	Internal or public; millions of flows
Application Gateway	L7 (HTTP/S)	Regional	SSL termination, WAF, URL routing
Azure Front Door	L7	Global	Global load balancing, CDN, WAF
Traffic Manager	DNS	Global	DNS-based failover (not proxy)

Load Balancer SKUs

Public: External traffic to VMs
Internal: Private IP only; traffic within VNet
Health probes: TCP, HTTP, HTTPS — unhealthy backends removed

Application Gateway Features

WAF: OWASP rule sets; prevention or detection mode
Backend pools: VMs, VMSS, IP addresses, FQDNs
SSL termination: Offload at gateway
Autoscaling: Scale based on traffic

4.5 DNS

Service	Purpose
---------	---------
Azure-provided DNS	Default name resolution within VNet (168.63.129.16)
Azure DNS Private Zones	Custom DNS names within VNet
Private DNS for Private Link	`privatelink.*.core.windows.net` zones
DNS Private Resolver	Hybrid DNS — forward/conditional between on-prem and Azure

Private Endpoint DNS Flow

1. Create Private Endpoint for storage/SQL/etc.
2. Create Private DNS Zone (privatelink.blob.core.windows.net)
3. Link zone to VNet
4. Auto-registration creates A record → private IP

4.6 Network Watcher — EXAM FOCUS

Tool	Purpose
------	---------
Connection Monitor	End-to-end connectivity monitoring
NSG Flow Logs	Log allowed/denied traffic (send to Storage or LA)
Traffic Analytics	Visualise NSG flow log data
Packet Capture	Capture packets on VM NIC
IP Flow Verify	Check if traffic allowed/denied by NSG
Next Hop	Verify effective routing
VPN Troubleshoot	Diagnose VPN gateway issues
Connection Troubleshoot	Test connectivity between resources
Topology	Visual network diagram

# Enable Network Watcher (one per region)
az network watcher configure --locations westeurope --enabled true

# IP Flow Verify
az network watcher test-ip-flow \
  --direction Inbound \
  --protocol TCP \
  --local 10.0.1.4:80 \
  --remote 10.0.2.4:60000 \
  --vm resource-id <vm-nic-id> \
  --nic <nic-name> \
  --nsg <nsg-name>

🔑 Golden Rule: "Diagnose why VM cannot receive traffic on port 443" → IP Flow Verify + check NSG + UDR + effective routes.

DOMAIN 5 — MONITOR AND MAINTAIN AZURE RESOURCES (10–15%)

5.1 Azure Monitor Architecture

Azure Resources
    ├── Platform Metrics (automatic)
    ├── Resource Logs (via Diagnostic Settings)
    └── Guest OS Logs (via AMA agent)
            ↓
    Log Analytics Workspace
            ↓
    ├── Alerts (metric, log, activity)
    ├── Workbooks (visualisations)
    ├── Application Insights (APM)
    └── Microsoft Sentinel (SIEM — awareness)

Log Analytics Workspace

Central repository for logs and metrics
KQL (Kusto Query Language) for querying
Retention: 30–730 days (configurable; archive to storage)
Data ingestion cost — filter what you send

az monitor log-analytics workspace create \
  -g rg-monitor -n law-central \
  --location westeurope --retention-time 90

Diagnostic Settings

Route resource logs and metrics to Log Analytics, Storage, Event Hub, or Partner solution
Must be explicitly enabled — not on by default for all resources

az monitor diagnostic-settings create \
  --name vm-diagnostics \
  --resource <vm-resource-id> \
  --workspace law-central \
  --metrics '[{"category":"AllMetrics","enabled":true}]' \
  --logs '[{"category":"Syslog","enabled":true},{"category":"Audit","enabled":true}]'

5.2 Alerts

Alert Type	Source	Example
------------	--------	---------
Metric alert	Platform/guest metrics	CPU > 80% for 5 min
Log alert	KQL query on Log Analytics	Failed logins > 10 in 5 min
Activity log alert	ARM operations	Delete resource group
Smart detector	Application Insights	Failure anomalies

Action Groups

Define who gets notified: email, SMS, voice, webhook, Logic App, Automation runbook, ITSM
Reuse across multiple alert rules

az monitor metrics alert create \
  -g rg-monitor -n alert-cpu-high \
  --scopes <vm-resource-id> \
  --condition "avg Percentage CPU > 80" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --action <action-group-resource-id>

5.3 Application Insights

APM for web applications
Auto-instrumentation for App Service, VMs with agent
Distributed tracing, live metrics, availability tests
Smart detection of performance anomalies
Linked to Log Analytics workspace (workspace-based)

5.4 VM Monitoring and Maintenance

Azure Monitor Agent (AMA)

Replaces legacy Log Analytics agent (MMA/OMS)
Data Collection Rules (DCR): Define what to collect and where to send
Install via extension, Policy, or Arc

Update Management

Azure Update Manager (replaces Update Management solution)
Assess and deploy patches to Azure VMs and Arc-enabled servers
Maintenance windows for controlled patching

Change Tracking

Monitor registry, files, software, services on VMs
Via Azure Automation or AMA

5.5 Backup Monitoring

Backup job status in Recovery Services vault
Alert on failed backups
Soft delete for backup data (14-day retention after delete)
Cross-region restore for GRS vaults

5.6 Service Health and Activity Log

Tool	Scope	Use
------	-------	-----
Azure Service Health	Azure platform issues	Planned maintenance, outages
Resource Health	Individual resource status	VM unavailable, storage throttling
Activity Log	Control plane operations	Who deleted what, when
Azure Advisor	Recommendations	Cost, security, reliability, performance

Activity Log vs Resource Logs

	Activity Log	Resource Logs
---	-------------	---------------
Content	ARM operations (create, delete, start)	Data plane (VM syslog, blob read)
Retention	90 days (free)	Requires diagnostic settings
Export	Log Analytics, Storage, Event Hub	Diagnostic settings

CROSS-DOMAIN QUICK REFERENCE

Managed Identities

Type	Lifecycle	Sharing
------	-----------	---------
System-assigned	Tied to resource; deleted with resource	1:1
User-assigned	Independent lifecycle	1:many resources

# Enable system-assigned MI on VM
az vm identity assign -g rg-compute -n vm-web-01

# Grant MI access to Key Vault
az keyvault set-policy -n kv-prod \
  --object-id <mi-principal-id> \
  --secret-permissions get list

Key Vault Admin Tasks

Soft delete: Enabled by default; 7–90 day retention
Purge protection: Cannot permanently delete until retention expires
RBAC vs Access Policies: RBAC is modern approach
Secrets, Keys, Certificates: Separate permission models

Entra ID vs Azure RBAC Quick Check

Task	Tool
------	------
Reset user password	Entra ID admin
Block legacy authentication	Conditional Access
Prevent public blob containers	Azure Policy (Deny)
Grant VM access to developer	Azure RBAC (VM Contributor)
JIT Global Admin access	PIM (Entra ID P2)

EXAM DAY GOLDEN RULES — TOP 25

1. Entra ID P2 for PIM, Identity Protection, Access Reviews
2. Conditional Access for granular MFA — not per-user MFA
3. Policy Deny prevents creation; RBAC controls who can create
4. ZRS = zone failure; GRS = regional disaster; GZRS = both
5. Private Endpoint for private IP access from VNet/on-prem; Service Endpoint = VNet only
6. Bastion for RDP/SSH without public IP — subnet name AzureBastionSubnet
7. Peering is non-transitive — traffic between spokes via hub
8. NSG is stateful; first matching rule wins (lowest priority number)
9. Stop (deallocate) releases compute billing and temp disk
10. Availability Set ≠ Availability Zone — pick one per VM
11. Container Apps for scale-to-zero microservices; ACI for simple single containers
12. Storage Blob Data Contributor for data plane; Storage Account Contributor for control plane
13. Managed Identity over storage keys and connection strings
14. Diagnostic settings must be explicitly enabled for resource logs
15. Network Watcher IP Flow Verify for NSG troubleshooting
16. Recovery Services vault for Backup and Site Recovery
17. SAS with stored access policy for revocable delegated access
18. Soft delete on blobs and Key Vault — recover accidental deletion
19. PHS is default hybrid sync; PTA validates on-premises
20. Resource locks block even Owner from delete/modify
21. Bicep/ARM for repeatable deployments; export from portal as starting point
22. App Service deployment slots for zero-downtime swaps
23. VPN Gateway in GatewaySubnet; Bastion in AzureBastionSubnet
24. Log Analytics + AMA replaces legacy MMA agent
25. Activity Log = control plane; Resource Logs = data plane

DOMAIN WEIGHT STUDY PRIORITY

Domain	Weight	Study Hours (estimate)
--------	:------:	:---------------------:
1. Identity & Governance	20–25%	8–10 hours
2. Storage	15–20%	6–8 hours
3. Compute	20–25%	8–10 hours
4. Networking	15–20%	6–8 hours
5. Monitor & Maintain	10–15%	4–6 hours

Recommended study order: Domain 1 → 4 → 3 → 2 → 5 (identity and networking underpin everything)

*Skills measured: April 17, 2026. Verify current exam outline at [Microsoft Learn](https://learn.microsoft.com/credentials/certifications/exams/az-104/).*