AZ-104: Microsoft Azure Administrator

Master the core foundations of identity management in Microsoft Azure! In this comprehensive module, Microsoft Certified Trainer Navneet Kumar breaks down Microsoft Entra ID (formerly Azure AD), from architectural concepts and tier comparisons to step-by-step hands-on demos in the Azure Portal.

Learn how to create users, configure group-based licensing, manage custom domains, and set up your lab environment to gain real-world enterprise identity administration skills.

What You’ll Learn in This Video

• Microsoft Entra ID Fundamentals: Core functions including SSO, user provisioning, and Multi-Factor Authentication (MFA).

• Entra ID vs. Active Directory Domain Services (AD DS): Key structural, protocol, and architectural differences.

• Licensing Tiers: Feature comparison between Free, Premium P1, Premium P2, and Governance tiers.

• Identity Administration: Managing user attributes, usage locations, administrative units, and Self-Service Password Reset (SSPR).

• Group Management & Licensing: Security vs. Microsoft 365 groups, dynamic assignment, and group-based license allocation.

• Hands-on Portal Demos: Adding custom domains, bulk user creation via CSV, license assignment, and lab scenario walkthroughs.

Take control of your Azure enterprise footprint! In this deep-dive module, i've covered core governance, organizational hierarchies, and resource management strategies every Azure Administrator needs to know.

Learn how to structure resource groups, implement tags and resource locks, configure region pairs for high availability, manage service quotas, and control costs using Azure Budgets and Advisor.

What You’ll Learn in This Video

• Azure Hierarchy & Management Groups: Organizing subscriptions, management groups, and resource groups for multi-tenant or enterprise scale.

• Regions & Region Pairing: Selecting optimal locations and understanding high availability (HA) and disaster recovery (DR) architectures.

• Resource Protection & Organization: Implementing Resource Locks to prevent accidental deletion and applying Tags for cost tracking.

• Cost Management & Quotas: Setting up budget alerts, leveraging Azure Advisor, and requesting soft/hard service quota limit increases.

• Subscriptions & Entra ID Security: Understanding billing boundaries, tenant relationships, and security principals (Users, Service Principals, Managed Identities).

• Hands-On Portal Walkthrough: Navigating quota settings and submitting a live quota increase request in the Azure Portal.

Take full control of your enterprise Azure spend and organizational structure! Learn how to request quota increases, build multi-level Management Group hierarchies, apply metadata tags for billing, and leverage Azure Cost Management, Hybrid Benefit, Reserved Instances, and Azure Advisor.

What You’ll Learn in This Video

• Quota & Capacity Planning: Filtering usage blades and requesting soft limit quota increases for specific VM sizes and regions.

• Management Group Architecture: Structuring root groups, organizing multi-level hierarchies, and inheriting policy scopes.

• Resource Tagging & Metadata: Implementing key-value tags for cost allocation, environmental grouping, and resource filtering.

• Cost Optimization Strategies: Navigating regional pricing differences, inbound vs. outbound data transfer costs, Azure Reserved Instances, and Azure Hybrid Benefit (BYOL).

• Budgeting & Machine Learning Insights: Setting cost alerts, defining budgets, and using Azure Advisor for cost, security, and performance recommendations.

Enforce strict compliance and security guardrails across your enterprise Azure environment! Learn how to control allowed deployment regions, restrict expensive VM SKUs, align with regulatory frameworks like NIST, ISO, and CIS, and remediate non-compliant infrastructure automatically.

What You’ll Learn in This Video

• Azure Policy Fundamentals: Purpose, components, evaluation cycles, and scope hierarchy (Management Groups, Subscriptions, Resource Groups).

• Policy Initiatives: Bundling individual policies into comprehensive governance baselines for compliance and auditing.

• Compliance Frameworks: Exploring built-in regulatory standards including ISO 27001, NIST, CIS, PCI-DSS, and HIPAA.

• JSON Structure & Custom Rules: Reading policy definitions, setting parameters, and configuring non-compliance messages.

• Live Deployment Testing: Demonstrating real-world enforcement by blocking restricted regions (e.g., Central India) while permitting authorized locations (e.g., East US).

Master the principle of least privilege in Microsoft Azure! Learn how to assign built-in roles, create custom RBAC roles from scratch or JSON templates, clone existing roles, and properly enforce access controls across Management Groups, Subscriptions, and Resource Groups.

What You’ll Learn in This Video

• Entra ID Roles vs. Azure RBAC: Understanding the fundamental boundary between directory control (identity) and control plane operations (resources).

• Built-in RBAC Hierarchy: Working with foundational roles—Owner, Contributor, Reader—and service-specific roles.

• Custom Role Creation: Defining fine-grained permissions down to the resource provider and action levels.

• Cloning & JSON Workflows: Modifying existing roles (e.g., ACR Push), exporting custom role definitions as JSON, and deploying via script/portal.

• Scope & Inheritance: Applying role assignments across different administrative scopes to eliminate privilege creep.

Master the core toolset required to manage, automate, and deploy Azure infrastructure at scale! In this practical, hands-on module. Learn how to build custom monitoring dashboards, configure Cloud Shell storage persistence, switch active subscription contexts on the fly, and deploy resources using both command-line interfaces and declarative ARM templates.

What You’ll Learn in This Video

• Management Tool Landscape: Understanding how the REST API powers the Azure Portal, CLI, PowerShell, and Cloud Shell behind the scenes.

• Custom Dashboards & Navigation: Designing, exporting, and sharing operational dashboards for fast monitoring and management.

• Cloud Shell Architecture: Setting up persistent storage mounts, uploading scripts, and choosing between Bash and PowerShell environments.

• Azure CLI Administration: Navigating CLI commands, managing resource groups, and switching target subscription contexts.

• Infrastructure as Code (IaC) Basics: Understanding ARM template structures and executing your first template-based Virtual Machine deployment.

Automate your Azure infrastructure deployments with confidence! Learn JSON schema structures, build multi-resource templates, deploy via Azure PowerShell in Cloud Shell, and master the critical differences between Incremental and Complete deployment modes.

What You’ll Learn in This Video

• Core Benefits of IaC: Ensuring deployment consistency, repeatability, and environment orchestration across teams.

• ARM Template Architecture: Deconstructing JSON schemas, parameters, variables, resources, and linked templates.

• Introduction to Azure Bicep: How Bicep compiles into ARM templates to offer cleaner syntax and easier code management.

• Deployment Modes (Crucial Exam Concept): Understanding why Incremental Mode preserves unmanaged resources while Complete Mode deletes resources not specified in your template.

• Hands-On Scripting: Deploying templates via PowerShell using New-AzResourceGroupDeployment directly from Cloud Shell.

Build a rock-solid network foundation in Microsoft Azure! Learn RFC 1918 private address planning, micro-segmentation strategies, public IP allocation methods, instance-level public IPs, and step-by-step portal workflows for provisioning secure VNets and virtual machines.

What You’ll Learn in This Video

• Virtual Network (VNet) Planning: Designing address spaces, understanding RFC 1918 private IP ranges, and avoiding overlapping networks.

• Subnet Architecture & Micro-Segmentation: Dividing VNets into functional subnets (Workloads, DMZ, Azure Bastion, Databases) to enforce Network Security Group (NSG) isolation.

• IP Addressing (Public vs. Private): Managing static and dynamic private IP assignments on Network Interfaces (NICs).

• Public IP SKUs & Allocation: Comparing static vs. dynamic allocation, zone redundancy, and understanding modern Standard SKU mandates.

• Hands-On Portal Walkthrough: Creating a custom VNet, configuring subnets, buying Public IP Prefixes, and attaching static IP configurations to VMs.

Lock down your Azure virtual networks! Learn how the 5-tuple rule structure works, the difference between default and custom rules, how to dynamically group servers using ASGs, and the critical exam concept of how Azure evaluates traffic when NSGs are applied to both the Subnet and the Network Interface (NIC) simultaneously.

What You’ll Learn in This Video

• NSG Fundamentals & Architecture: Understanding NSGs as Access Control Lists (ACLs) and how they fit into a broader defense-in-depth strategy.

• Rule Priorities & Structure: Decoding the 5-tuple rule evaluation (Source, Destination, Port, Protocol, Action) and default allow/deny rules.

• Effective Routes & Troubleshooting: Using Network Watcher to view "Effective Rules" when dealing with overlapping security policies.

• Application Security Groups (ASGs): Simplifying rule management by grouping VMs logically (e.g., "Web Servers") instead of relying on static IP addresses.

• Subnet vs. NIC NSG Evaluation: Mastering the dual-NSG behavior—understanding why an allow rule on a NIC fails if the Subnet NSG blocks the traffic.

• Hands-on Portal Demos: Creating custom HTTP/RDP rules, attaching NSGs to subnets, and testing live web server connectivity.

Manage, delegate, and resolve domains directly within Microsoft Azure! Learn how Azure assigns authoritative name servers, how domain delegation works with third-party registrars, how to construct Alias and A records, and how to verify resolution using command-line diagnostic tools like nslookup.

What You’ll Learn in This Video

• Public vs. Private DNS Zones: Understanding when to use Azure DNS for public domain hosting versus Private DNS Zones for internal VNet resolution.

• Domain Delegation: How to link your domain registrar (e.g., GoDaddy, Namecheap) to Azure's 4 auto-assigned authoritative name servers.

• DNS Record Types & Alias Records: Managing A, CNAME, MX, TXT, PTR, and SOA records with dynamic IP binding.

• Resolution Path & Diagnostics: Tracing the full lookup chain from local DNS to root servers and testing record propagation using nslookup.

• Enterprise Benefits: Leveraging ultra-fast response times, built-in security, role-based access control (RBAC), and REST API automation.

Azure Virtual Network (VNet) Peering connects two virtual networks over Microsoft's private backbone infrastructure, enabling high-bandwidth, low-latency communication without public internet exposure.

Key Concepts & Capabilities

• Regional vs. Global Peering: Regional peering links VNets within the same region, while Global peering links VNets across different Azure regions.

• Flexibility & Isolation: Works across different subscriptions, Microsoft Entra tenants, and resource groups without downtime.

• Non-Transitive Nature: Communication does not pass through intermediate networks automatically; VNet A connected to VNet B, and VNet B to VNet C, does not grant VNet A access to VNet C.

• Hub-and-Spoke & Gateway Transit: Allows spoke VNets to share central VPN/ExpressRoute gateways located in a hub VNet using Allow gateway transit and Use remote gateways settings.

• Routing Control: Supports Service Chaining (directing traffic through Network Virtual Appliances/firewalls using User-Defined Routes) and Forced Tunneling (routing internet-bound traffic back to on-premises firewalls for inspection).

This session covers User-Defined Routes (UDRs) and compares Service Endpoints versus Private Endpoints.

Custom Routing (UDRs)

• Default System Routes: Azure automatically routes traffic between subnets, to the internet (0.0.0.0/0), and across VNets.

• Route Tables: Override system defaults by attaching custom route tables to subnets.

• Next Hops: Virtual Network, Internet, Virtual Appliance (firewalls), Virtual Network Gateway, or None (drops traffic).

Azure provides four primary load balancing services that cater to different traffic types, scopes, and application needs:

• Azure Load Balancer: A Layer 4 (TCP/UDP) regional service ideal for high-throughput, non-HTTP/S workloads requiring 5-tuple traffic distribution.

• Application Gateway: A Layer 7 regional service tailored for web traffic, featuring SSL offloading, URL path-based routing, and Web Application Firewall (WAF) protection.

• Azure Front Door: A Layer 7 global service designed for site acceleration, global traffic routing, and CDN integration using the Microsoft backbone.

• Traffic Manager: A DNS-based global traffic director that routes users to regional endpoints based on performance, geography, or failover priority.

Azure Load Balancer itself is offered in public (internet-facing) and internal (private IP) modes across two primary performance tiers:

• Basic SKU: Offers entry-level capabilities without availability zone support, open-by-default network access, and lower SLA thresholds.

• Standard SKU: Delivers high availability (99.99% SLA), Availability Zone redundancy, large backend pool capacities, and a secure-by-default posture requiring explicit NSG rules.

• Core Components: Incoming requests map through a Frontend IP, get monitored by Health Probes (TCP/HTTP/HTTPS), and are distributed across a Backend Pool using explicit Load Balancing or Inbound NAT rules.

• Session Persistence: Configurable settings support default hash routing, 2-tuple (Source IP, Destination IP), or 3-tuple (Source IP, Destination IP, Protocol) sticky sessions.

This module provides a detailed walkthrough of Azure Application Gateway, focusing on its Layer 7 traffic routing capabilities, Web Application Firewall (WAF) integration, and deployment process.

• Layer 7 Capabilities: Provides advanced HTTP/HTTPS traffic management, including URL path-based routing, multi-site hosting, SSL offloading, and cookie-based session affinity.

• Supported Backends: Routes traffic dynamically to virtual machines, Virtual Machine Scale Sets (VMSS), Azure App Services, or on-premises servers.

• Web Application Firewall (WAF): Integrated security layer designed to detect and block common web vulnerabilities and OWASP Top 10 threats before they reach your backend servers.

• Deployment Workflow: Requires setting up a dedicated subnet, defining Frontend IPs (public or private), building Backend Pools with target servers, and attaching Routing Rules and Listeners.

• Backend Configurations: Includes settings for HTTP/HTTPS protocols, connection draining, and session stickiness across pool members.

• Testing & Verification: Load balances incoming requests round-robin style or based on configured path rules across backend instances.

This module introduces Azure Network Watcher, focusing on its regional monitoring, diagnostic, and traffic analysis capabilities for Azure virtual networks.

• Core Purpose: Provides central tools to monitor, diagnose, troubleshoot, and analyze performance across Azure networking resources.

• Network Topology: Automatically visualizes complex Azure virtual network structures, subnets, and resource connections.

• IP Flow Verify: Analyzes whether specific packet traffic (by source, destination, port, and protocol) is allowed or denied, identifying the exact matching Network Security Group (NSG) rule.

• Next Hop Diagnostics: Determines the effective traffic route and next-hop type (such as Internet, Virtual Network Gateway, Virtual Appliance, or drop) to pinpoint routing issues.

• Traffic & Diagnostic Tools: Includes tools like Packet Capture, VPN Troubleshooting, NSG Flow Logs, Connection Monitor, and Traffic Analytics for deep network visibility.

This module provides a comprehensive deep dive into Azure Storage Accounts, covering core storage services, redundancy options, security models, data protection, and hands-on management.

• Storage Services: Supports four primary non-relational services—Blobs (unstructured object data), Files (SMB/NFS cloud file shares), Queues (asynchronous messaging between application components), and Tables (NoSQL key-value store).

• Account Tiers & Blob Types: Offers Standard (HDD) and Premium (SSD) performance tiers across General Purpose v2 (GPv2) accounts. Blobs are categorized as Block, Page (for VM disks), or Append blobs.

• Access Tiers: Features Hot (frequently accessed data), Cool (infrequently accessed data stored for at least 30 days), and Archive (offline storage with higher retrieval latency).

• Replication & Durability: Offers varying levels of high availability and disaster recovery—LRS (Locally-Redundant, 11 9s), ZRS (Zone-Redundant, 12 9s), GRS (Geo-Redundant, 16 9s), and GZRS/RA-GRS (Geo-Zone Redundant with Read-Access options).

• Access Control & Security: Secured via Storage Account Access Keys, Shared Access Signatures (SAS) for granular delegated access, and Microsoft Entra ID authentication. Encryption at rest is enforced using Microsoft-managed or Customer-managed keys.

• Network & Endpoint Security: Restricts public exposure using IP whitelisting, VNet Service Endpoints, or Private Endpoints (Private Link) with mandatory HTTPS transfer.

• Data Protection & Lifecycle Rules: Includes soft delete, blob versioning, point-in-time restore, and automated lifecycle management policies for automated tier transitions and cleanup.

• Hands-on Portal Walkthrough: Demonstrates creating a storage account, configuring networking/encryption settings, provisioning containers, file shares, queues, and tables, and generating SAS tokens.

This module covers Azure Blob Storage architecture, access tier management, lifecycle automation, and cross-region object replication.

• Blob Storage Fundamentals: Designed for storing unstructured binary and text data (images, videos, backups, and analytics logs) organized within logical containers.

• Access Tiers: Features four distinct access tiers to balance cost and performance:

  • Hot: Optimized for frequently accessed data.

  • Cool: Ideal for data stored for at least 30 days (infrequent access).

  • Cold: Optimized for stored data accessed rarely (at least 90 days retention).

  • Archive: Offline tape-like storage with low storage costs but rehydration latency (retention minimum 180 days).

• Lifecycle Management: Automates object transitions using JSON-based if-then policy rules (e.g., auto-transitioning blobs from Hot $\rightarrow$ Cool after 30 days $\rightarrow$ Cold after 60 days $\rightarrow$ Archive after 180 days $\rightarrow$ Delete after 600+ days).

• Object Replication: Configures asynchronous, cross-region replication for specific containers or paths to support disaster recovery and compliance.

• Portal Walkthrough: Demonstrates creating containers, configuring public access levels (Private vs. Anonymous Blob Access), uploading blobs, managing object tiers, and setting up lifecycle policy rules.

This module covers Azure Storage Security, focusing on encryption standards, identity-based access controls, and fine-grained access using Shared Access Signatures (SAS).

• Encryption at Rest & In Transit: Uses always-on Storage Service Encryption (SSE) with Microsoft-managed or customer-managed keys (BYOK). Data in transit is secured via mandatory HTTPS, SMB 3.0 encryption, and Azure Disk Encryption.

• Identity & Access Control: Leverages Microsoft Entra ID and Role-Based Access Control (RBAC) to separate control plane management from data plane access.

• Storage Account Keys vs. SAS: Storage Account Keys grant full access and must be rotated regularly. Shared Access Signatures (SAS) provide time-bound, restricted access to storage resources via a signed URI without exposing account keys.

• Account SAS vs. Service SAS: Account SAS delegates access across multiple services (Blob, File, Queue, Table), while Service SAS restricts access to a specific resource (e.g., a single blob or container).

• SAS Token Parameters: Configures precise parameters, including allowed service types, detailed permissions (Read, Write, Delete, List), start/expiry timestamps, allowed IP addresses, and HTTP/HTTPS protocols.

• Portal Walkthrough: Demonstrates reviewing primary/secondary account keys, configuring SAS policy settings, generating signed URLs/tokens, and integrating them securely into client applications.

This module covers Azure Files, file share management features, data protection capabilities, and the Azure Storage Explorer desktop client.

• Azure Files vs. Blob Storage: Azure Files provides fully managed, cloud-based file shares accessible via standard network protocols (SMB and NFS), making it ideal for lift-and-shift application migrations, shared application data, and central file repositories.

• Storage Tiers & Redundancy: Supports Premium (SSD) and Standard performance tiers (Transaction Optimized, Hot, and Cool), paired with LRS, ZRS, GRS, or RA-GRS redundancy options.

• Protocol & Connectivity: Connects over SMB (requires outbound Port 445 open on firewalls) or NFS, with cross-platform mounting support across Windows, macOS, and Linux.

• Snapshots & Soft Delete:

  • File Share Snapshots: Creates point-in-time, read-only copies of file shares for quick restoration and rollback.

  • Soft Delete: Provides recycle bin-like protection against accidental deletion or ransomware, supporting retention periods from 1 to 365 days (default is 7 days).

• Azure Storage Explorer: A multi-platform GUI application (Windows, macOS, Linux) that allows administrators to upload, download, and manage storage resources across accounts using Access Keys, SAS tokens, or Microsoft Entra ID authentication.

This module covers Azure Files and Azure File Sync, detailing how to deploy managed cloud file shares, mount them across different operating systems, and establish a hybrid storage architecture with cloud tiering.

• Azure Files: Provides fully managed SMB and NFS file shares accessible from Windows, Linux, and macOS. Offers high availability, native Microsoft Entra ID / NTFS permissions, and integration with private endpoints.

• Azure File Sync: A hybrid storage solution that caches frequently accessed ("hot") files locally on Windows Servers while tiering cold data to Azure Files.

• Key Benefits:

  • Cloud Tiering: Frees up local storage capacity based on date or space-utilization thresholds.

  • Disaster Recovery: Serves as a fast recovery mechanism for branch offices—new servers can sync directly from the cloud endpoint.

  • Centralized Management: Synchronizes multiple branch office servers to a single Azure File Share.

• Architecture Components:

  • Storage Sync Service: The top-level Azure resource required to manage sync relationships.

  • Registered Server: An on-premises or cloud Windows Server with the Azure File Sync agent installed.

  • Sync Group: Defines the topology by binding a Cloud Endpoint (Azure File Share) to one or more Server Endpoints (local folder paths).

• Setup & Walkthrough Workflow:

  1. Deploy Azure File Share: Create the share, select tiers, and copy the PowerShell mounting script (which validates outbound Port 445 and mounts via SMB).

  2. Install Sync Agent: Download and install the Azure File Sync agent on the local Windows Server, then register it with the Storage Sync Service.

  3. Configure Sync Group: Create a Sync Group, assign the target Azure File Share as the Cloud Endpoint, add the local path as the Server Endpoint, and configure Cloud Tiering policies.

     
     

This module covers Azure Virtual Machines (VMs), sizing tiers, storage configurations, access mechanisms, and step-by-step VM deployment.

• Shared Responsibility Model: Under Infrastructure as a Service (IaaS), Microsoft manages physical hardware, datacenters, and hypervisors, while the customer manages the OS, software updates, networking configurations, applications, and identity/access.

• VM Sizing Tiers:

  • General Purpose: Balanced CPU-to-memory ratios (B, D-series).

  • Compute Optimized: High CPU-to-memory ratios for web servers and batch processing (F-series).

  • Memory Optimized: High memory-to-CPU ratios for relational databases and in-memory caches (E, M-series).

  • Storage Optimized: High disk throughput and IOPS for big data and NoSQL databases (L-series).

  • GPU & HPC: Specialized hardware for rendering, AI, and supercomputing (N, H-series).

• Disk Types & SLAs:

  • OS Disk & Temporary Disk: Created automatically with every VM (temporary disks store non-persistent data like swap files).

  • Managed Disks: Standard HDD, Standard SSD, Premium SSD, and Ultra Disk. Higher disk tiers deliver higher IOPS and qualify the VM for higher single-instance availability SLAs.

• Remote Access & Azure Bastion:

  • Traditional access uses RDP (Windows) or SSH (Linux), which often requires public IPs or VPNs.

  • Azure Bastion: Provides secure, browser-based RDP/SSH access over SSL directly through the Azure Portal without exposing private IP addresses to public internet threats.

• Deployment Workflow: Demonstrates creating a virtual network (VNet) with dedicated subnets, deploying Azure Bastion, provisioning a VM with managed disks/identity settings, and establishing a private connection via Bastion.

This module covers Azure VM High Availability, Scaling Strategies, and Virtual Machine Scale Sets (VMSS).

• Maintenance & Downtime Types:

  • Unplanned Hardware Failures: Unexpected hardware/rack outages.

  • Planned Maintenance: Scheduled Microsoft updates to host hypervisors.

• Availability Sets:

  • Fault Domains (FD): Physical racks sharing a power source and network switch. Prevents single points of failure (up to 3 FDs per set).

  • Update Domains (UD): Logical groupings for planned updates. Azure updates one UD at a time with a 30-minute delay between resets (up to 20 UDs per set).

  • SLA: Increases availability to 99.95%. Requires matching managed disks and placing tiered workloads (e.g., Web vs. SQL) in separate availability sets.

• Availability Zones (AZ): Physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Delivers the highest single-region SLA of 99.99%.

• Scaling Strategies:

  • Vertical Scaling (Scale Up/Down): Changing the hardware size (CPU/RAM) of an existing VM; requires a reboot and planned downtime.

  • Horizontal Scaling (Scale Out/In): Adding or removing identical VM instances to handle changing workloads dynamically.

• Virtual Machine Scale Sets (VMSS):

  • Orchestration Modes: Flexible (supports heterogeneous VM types) vs. Uniform (homogenous VMs, optimized for large-scale stateless workloads).

  • Auto-Scaling Rules: Automatically scales instances based on metrics (e.g., scale out when average CPU > 70%, scale in when CPU < 20%).

  • Cooldown Period: Set duration to wait after a scaling action before evaluating rules again, preventing rapid scale-in/scale-out loops ("flapping").

  • Integration: Natively integrates with Azure Load Balancers, Proximity Placement Groups (for ultra-low latency), and Predictive Scaling.

This module covers Azure Compute Options, focusing on Azure App Service Plans, compute tiers, pricing models, and scaling capabilities.

• Compute Decision Framework: Compares core Azure compute options—Virtual Machines (IaaS), Azure App Service (PaaS), Azure Container Instances (ACI), and Azure Kubernetes Service (AKS)—highlighting the operational efficiency of containerized and managed PaaS offerings over traditional VMs.

• App Service Plan Fundamentals: Serves as the underlying compute resource allocation (region, OS, VM size, and instance count) that powers hosted Web Apps and API Apps.

• Pricing & Feature Tiers:

  • Shared Compute (Free & Shared): Shares CPU resources across multiple customer tenants; suitable for development and testing without SLAs.

  • Dedicated Compute (Basic, Standard, Premium): Runs on dedicated Azure VMs. Higher tiers unlock production features such as custom domains, SSL bindings, auto-scaling, deployment slots, and higher Compute Unit (ACU) capacities.

  • Isolated Tier (App Service Environment - ASE): Provides complete network and compute isolation running inside a customer’s private Virtual Network (VNet), designed for mission-critical, enterprise-grade workloads.

• Scaling Capabilities:

  • Scale Up (Vertical): Upgrades CPU, RAM, or disk space by changing the pricing tier.

  • Scale Out (Horizontal): Increases the number of VM instances running the application, configurable manually or automatically based on performance metrics (e.g., CPU percentage) and time-based schedules.

• Portal Walkthrough: Demonstrates creating an App Service Plan, selecting OS and region configurations, and evaluating pricing tiers based on Azure Compute Units (ACUs), memory, and SLA options.

This module covers Azure App Service, detailing web app creation, zero-downtime deployment strategies using deployment slots, custom domains, security configurations, and hands-on slot management.

• Azure App Service Fundamentals: A fully managed Platform as a Service (PaaS) for hosting web applications, REST APIs, and mobile backends with built-in high availability, auto-scaling, and multi-language runtime support (e.g., .NET, Java, Node.js, Python, PHP).

• Deployment Slots & Zero-Downtime Releases:

  • Staging Environments: Allows hosting isolated versions of an application (such as staging or QA) alongside production under unique URLs.

  • Seamless Slot Swapping: Swaps staging and production environments instantly without downtime, warming up backend instances before going live to eliminate cold starts.

  • Traffic Routing (Canary/A/B Testing): Supports partial traffic distribution between slots to test pre-release code with live users.

  • Instant Rollbacks: Enables quick swap-backs to the previous version if errors are detected post-deployment.

• Security, Monitoring & Management:

  • Security & Auth: Offers built-in authentication (Microsoft Entra ID, OAuth providers), IP access restrictions, mandatory SSL bindings, and native Azure Key Vault integration for managing secrets.

  • Diagnostics & Backups: Provides integrated Application Insights, diagnostic logs, and automated/scheduled backups covering both application files and connected databases.

• Custom Domains & DNS: Supports linking custom external domains or Azure-purchased domains with automated DNS record verification and SSL binding.

• Portal Walkthrough: Demonstrates creating a Web App, provisioning a staging slot, editing code directly via App Service Editor, testing the staging URL, performing traffic routing, executing a production slot swap, and verifying the live release.

This module covers Container Concepts and Azure Container Instances (ACI), highlighting containerization benefits, image management via Azure Container Registry (ACR), and serverless container deployments.

• Containers vs. Virtual Machines: Virtual machines virtualize underlying hardware using hypervisors (Type-1 like Hyper-V or ESXi), with each VM running a full OS. Containers use OS-level virtualization to share the host kernel—making them lightweight, fast to start, and ideal for microservices.

• Docker & Azure Container Registry (ACR): Docker packages applications and dependencies into reusable container images. Azure Container Registry acts as a managed private image repository to securely store and manage Docker images within Azure.

• Azure Container Instances (ACI): A serverless PaaS solution that runs isolated containers on-demand without provisioning or managing underlying Virtual Machines or Kubernetes clusters.

• Container Groups: Multi-container deployments co-scheduled on the same host, sharing lifecycle, local network, storage volumes, and IP address (commonly used for sidecar patterns).

• Configuration Parameters:

  • Compute Resources: Explicitly allocates CPU cores, memory (RAM), and optional GPU acceleration.

  • Networking: Supports Public, Private (VNet integration), or No IP endpoints, along with custom DNS name labels and open TCP/UDP ports.

  • Restart Policies: Configurable behavior—Always (long-running apps), OnFailure (batch jobs), or Never.

• Portal Walkthrough & Management: Demonstrates provisioning an ACI instance from a public image, mapping ports and DNS labels, inspecting container logs, connecting via an interactive Bash shell, monitoring performance metrics, and verifying the web application over its public FQDN.

This module covers Azure Container Apps and Azure Kubernetes Service (AKS), detailing managed container orchestration options, cluster creation, and deployment via kubectl.

• Azure Container Apps vs. AKS:

  • Azure Container Apps: A serverless PaaS model for microservices and containerized apps with built-in scaling (including KEDA) and simple management without cluster overhead.

  • Azure Kubernetes Service (AKS): A fully managed Kubernetes cluster offering granular control over nodes, pods, network policies, ingress controllers, and custom YAML manifests.

• AKS Core Architecture:

  • Control Plane & Node Pools: Managed master nodes paired with customizable worker node pools running underlying Azure Virtual Machines.

  • Pods & Containers: Pods act as the smallest deployable units in Kubernetes, grouping co-located containers that share storage and network resources.

  • Networking (CNI) & Load Balancing: Integrates with Azure CNI or Kubenet, providing public or private API access, load balancing, and network security policies.

  • Integration Points: Seamless connection with Azure Container Registry (ACR), Microsoft Entra ID authentication, RBAC, and Azure Monitor Insights.

• Deployment & Management Walkthrough:

  1. Cluster Creation: Configure node pool sizes, OS upgrade options, network policies, and ACR integration in the Azure Portal.

  2. Cluster Authentication: Retrieve cluster credentials into Azure Cloud Shell using az aks get-credentials.

  3. Application Deployment: Deploy multi-container microservices (such as storefront, product, and order services) by applying declarative YAML manifests with kubectl apply -f.

  4. Verification & Access: Validate running nodes (kubectl get nodes) and active pods (kubectl get pods), then identify the external IP assigned via the Azure Load Balancer service (kubectl get services) to access the frontend application.

This module covers Azure Backup architecture, business continuity principles, Recovery Services Vault setup, and hands-on backup policy configuration.

• Core Features & Targets: Provides built-in protection and data retention across native Azure workloads (Azure VMs, SQL Server, Azure Files, SAP HANA) and on-premises servers via the Microsoft Azure Recovery Services (MARS) agent or Data Protection Manager (DPM).

• Recovery Services Vault: Acts as the primary management entity for storing backup data, supporting modern security features like immutability, multi-user authorization (MUA), and soft delete to prevent accidental or malicious deletion.

• Backup Targets & Tiers: Differentiates between fast local Snapshot Tier backups (for rapid point-in-time restores) and long-term Vault Standard Tier storage (for durable compliance retention).

• Backup Policies & Retention: Configures scheduled automated backups (daily, weekly, or hourly) aligned with tailored Retention Range rules—such as daily (e.g., 30 days), weekly (12 weeks), monthly (60 months), and yearly (10 years) options.

• Portal Walkthrough: Demonstrates provisioning a Recovery Services Vault, setting up encryption and immutability rules, defining custom backup schedules and time zones, binding an Azure File Share (e.g., CorpDocs) to the policy, and initiating protection.

This module covers Azure Backup concepts, exam alignment for AZ-104, Recovery Services Vault management, and automated backup policy execution.

• Core Objectives & Exam Alignment: Maps directly to the AZ-104 domain covering backup and recovery (10–15% of exam weight), focusing on maintaining low Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) for business continuity.

• Architecture & Vault Types:

  • Recovery Services Vault: Primary vault type used for protecting Azure VMs, Azure Files, SQL Server in Azure VMs, and SAP HANA.

  • Backup Vault: Used for operational backups across newer workloads like Azure Blobs, Azure Disks, and Azure PostgreSQL.

  • Centralized Management: Integrates with Azure Backup Center to govern policy enforcement, compliance monitoring, and restore operations across multiple vaults and subscriptions.

• Hybrid vs. Cloud Native Protection:

  • On-Premises Workloads: Protected via the Microsoft Azure Recovery Services (MARS) agent or System Center Data Protection Manager (DPM).

  • Cloud Workloads: Agentless, native protection for Azure VMs, File Shares, and databases.

• Policy & Retention Design: Configures multi-tiered retention schedules balancing instant snapshot recovery (Snapshot Tier) with long-term, cost-effective vaulted storage (Vault Standard Tier) across customizable daily, weekly, monthly, and yearly cycles.

• Portal Walkthrough: Demonstrates creating a Recovery Services Vault with specific redundancy and encryption settings, setting up custom backup policies (time zones, retention limits), selecting source workloads (such as Azure File Shares), and triggering backup tasks.

This module covers Azure Monitor, detailing data collection types, Activity Log auditing, visual dashboards, and automated alert response workflows using Action Groups.

• Core Scope & Capabilities: Maps to the "Monitor and Maintain Azure Resources" section of AZ-104 (10–15% of exam weight), providing end-to-end visibility across applications, guest OS layers, Azure resources, network infrastructure, and hybrid on-premises workloads.

• Metrics vs. Logs:

  • Metrics: Numerical values recorded at regular intervals that measure specific aspects of a system in real time (e.g., CPU utilization percentage). Ideal for high-frequency monitoring and low-latency alerting.

  • Logs: Structured or unstructured text data containing detailed event records, traces, and historical state changes, analyzed via Log Analytics and Kusto Query Language (KQL).

• Activity Logs: Tracks control-plane actions across subscriptions (such as resource creation, modifications, or deletions). Retained by default for 90 days, with options to export to Log Analytics workspaces, Storage Accounts, or Event Hubs.

• Alert Rules & Action Groups:

  • Alert Conditions: Triggered by specific signal logic or threshold breaches (e.g., CPU utilization greater than 80%).

  • Action Groups: Collections of notification channels and automation steps triggered when an alert fires.

  • Notification Channels: Supports direct alerts via Email, SMS, Azure app Push notifications, and voice calls.

  • Automated Remediation & ITSM Integration: Triggers automated remediation using Azure Automation Runbooks, Azure Functions, Logic Apps, or Webhooks, and integrates directly with ITSM ticketing platforms (such as ServiceNow or SCSM).

This module covers Log Analytics Workspaces and Kusto Query Language (KQL), focusing on centralized log ingestion, data retention management, query syntax, and visualization within Azure Monitor.

• Log Analytics Workspace Fundamentals: Serves as a centralized repository for collecting, analyzing, and querying log data gathered from control plane actions, data plane activity, Azure resources, virtual machines, and external agents. Supports single or multi-workspace architectures based on compliance and administrative requirements.

• Control Plane vs. Data Plane Logs:

  • Control Plane Logs: Track management operations performed on Azure resources (e.g., resource creation, configuration changes via Azure Resource Manager).

  • Data Plane Logs: Track internal application and resource operations (e.g., database queries, web server requests, inside-OS guest metrics).

• Workspace Settings & Cost Controls:

  • Data Retention: Configurable retention periods (with default free tiers up to custom long-term retention).

  • Daily Cap: Allows setting daily ingestion limits (in GB) to prevent unexpected costs while integrating with SIEM services like Microsoft Sentinel.

• Kusto Query Language (KQL) Basics: A tabular query language designed to analyze large telemetry datasets.

  • Table-First Syntax: Begins with the target log table name (e.g., AzureActivity, Heartbeat, SigninLogs) followed by piped operators (|).

  • Key Operators:

    • where: Filters rows based on specific conditions or time ranges.

    • project: Selects, renames, and formats specific columns to display.

    • summarize: Aggregates data using functions like count(), avg(), or sum() grouped by specific dimensions.

    • distinct: Deduplicates records to show unique values.

    • render: Visualizes query results directly in the portal using bar charts, pie charts, area graphs, or time-series plots.

• Export & Integration: Supports exporting query results and telemetry streams to Power BI, Excel, or third-party monitoring platforms (e.g., Splunk).

• Portal Walkthrough: Demonstrates creating a Log Analytics Workspace, configuring retention and daily cap boundaries, writing and running foundational KQL queries using where, project, summarize, and render, and converting raw log entries into visual dashboards.