[NEW] AZ-104: Microsoft Azure Administrator - Oct 2023

Explain why cloud computing replaces traditional data centers by offering pay-as-you-go resources, maintenance-free infrastructure, and scalable performance, using the electricity analogy to illustrate cloud benefits.

Explore cloud computing as internet-based computing that rents resources such as virtual machines, servers, databases, and storage from providers, accessed over the internet, with examples such as Gmail and Netflix.

Create your azure free subscription and explore what’s free for 12 months and always free, plus a $200 credit for 30 days, with credit card verification and no charges.

Learn how students can obtain a free Azure subscription without a credit card by verifying a student email with a Microsoft account, unlocking monthly credits and always-free and 12-month services.

Explore the Azure portal's unified graphical interface, navigate all services by category, search, favorites, and dashboards, and learn to create resources and manage storage accounts with Cloud Shell.

learn to manage costs by deleting unused resources and setting a monthly budget with alerts; monitor cost analysis, enable email alerts at 80%, and use the dashboard to track spend.

Cloud computing replaces capital expenses with a pay-as-you-go model, enabling rapid provisioning, scalable in minutes, and no initial investment for global expansion.

Explore IaaS, PaaS, and SaaS and how responsibilities are shared between customer and cloud provider, illustrated by on premises, rental, taxi, and bus analogies.

Explore deployment models—public cloud, private cloud, and hybrid cloud—and weigh their advantages and disadvantages for fast website deployment, security, and compliance scenarios.

Explore how cloud pricing differs from on premises, driven by storage, operations, data transfer, and region, and how serverless, free tier, and pay-as-you-go models shape your bill.

Activate the Microsoft Learn sandbox to continue learning Azure for free, providing a 2-hour environment to create resources and explore services.

Explore how Azure data centers create regions and region pairs for a global footprint. Learn to choose regions by compliance, proximity, service availability, and pricing, with automatic replication and failover.

Explore availability zones as discrete data centers within a region. Enable independent power, cooling, and networking, and implement fast encrypted replication across zones to reduce latency and isolate failures.

Create resource groups to logically organize resources across regions and environments. Apply access policies, locks, and tags at the group level, and note that deleting a group deletes its resources.

Discover how Azure Resource Manager authenticates and creates resources via portal, PowerShell, CLI, or SDK, using JSON templates to deploy resources, manage dependencies, and automate scalable deployments.

Understand how subscriptions attach to your account and enable billing, access control, and environment separation across dev and production resources, with budgets, quotas, policies, and multiple subscriptions.

Manage thousands of subscriptions with Azure management groups in a hierarchical structure, enforcing inherited policies and centralized security across all subscriptions and resources.

Explore Azure Active Directory, the identity and access management service that manages users, groups, devices, and apps, enabling single sign-on and tenant isolation for organizations.

Compare Windows Server Active Directory and Azure Active Directory to understand on premises versus cloud identity and access management, including Kerberos and SAML authentication and synchronization.

Create a new user in Azure AD via Active Directory: choose create or invite, set the default domain, assign groups or roles, and enforce password changes with future RBAC access.

Invite external users as guest identities in Azure AD to enable B2B collaboration. Explore cloud, directory-synced, and on-premises identity options and grant access after invitation acceptance.

Understand Azure Active Directory B2B vs B2C: B2B invites specific external users to access resources, while B2C lets anyone sign in with existing social accounts.

Learn to create hundreds of users efficiently using bulk operations in the portal or PowerShell, including bulk template handling, optional fields, and reviewing bulk operation results.

Learn how to activate Azure Active Directory premium, compare free, P1, and P2 licensing, and see which features like conditional access, identity protection, and dynamic groups require premium.

Learn how Azure AD groups streamline permissions by assigning them at the group level for all members. Explore security groups, Microsoft 365 groups, and dynamic membership rules to manage users.

Create Azure AD dynamic groups and define membership rules, such as country equals India, to automatically add current and future users. Requires Azure AD premium license and supports case-insensitive rules.

Learn how Active Directory roles grant permissions to users and groups, focusing on the user administrator role and how to assign roles to groups.

Compare Azure AD administrator roles with role-based access control (RBAC) roles, highlighting how AD roles manage Active Directory resources while RBAC governs access to other services like virtual machines.

Explore how administrative units restrict a user administrator's scope to a local office, allowing management of only members within that unit rather than the entire tenant.

Create admin unit, assign a user administrator, and add direct users and a group; admin can edit direct users and the group but not its members; org admins manage all.

Learn to add and verify a custom domain in Azure Active Directory using a DNS TXT record, set it as primary, and create users under that domain.

Learn how to manage devices with Active Directory, register and join devices, and enforce security through conditional access, SSL, and device compliance for company portal access.

Join devices to Azure AD and Active Directory, monitor OS types such as Windows, Android, and iOS, track join types, and enforce multifactor authentication for registrations.

Register a personal laptop with Active Directory by connecting to access work or school and signing in with Azure Active Directory email to view join type and MDM compliant status.

Learn how employees reset their own passwords with self-service password reset (SSPR), including premium licensing, enabling reset policies, and configuring multiple authentication methods.

Learn how multi-factor authentication strengthens Azure Active Directory by requiring two or more elements—password, OTP on a mobile device, and biometric options like fingerprint or face recognition.

Learn how conditional access in Azure Active Directory uses identity signals—user type, location, device, and application—to grant, restrict, or prompt for additional authentication. Note this feature requires paid licenses.

Explore how to enforce multi-factor authentication with a conditional access policy in Azure Active Directory, including policy creation, user targeting, and testing MFA during sign-in.

Role based access control determines who can access resources and what they can do, using users, groups, service principals, managed identities, and roles such as reader, contributor, and owner.

Demonstrates how to assign Azure RBAC roles such as reader, contributor, and owner, and shows how permissions vary by resource group and individual resources like virtual machines.

Create Azure custom roles at resource group, subscription, or management group levels; not at resource level; tailor permissions for compute services with a role template or from-scratch rule.

Understand how Azure subscriptions govern billing and access, including choosing a subscription when creating resources, setting budgets and policies, and separating dev and production environments.

Create a new Azure subscription by selecting add, naming the subscription, choosing a billing profile, selecting a plan (free, pay-as-you-go, student, sponsorship), and linking an Active Directory and management group.

Learn how an azure subscription trusts a single azure active directory, enabling authentication of users and services, and how to attach, move, or change directories across subscriptions.

Learn how to use Azure tags and resource groups to organize resources, filter by owner, environment, or impact, and analyze costs with governance and policies.

Learn how to use Azure resource locks to prevent accidental deletion or modification of resources, including read-only and delete locks at the resource and resource group levels.

Move resources across resource groups, subscriptions, or regions while keeping their locations unchanged. Validation occurs before moving; locks on groups can block moves.

Enforce rules with Azure policy to restrict resources, manage non-compliant resources, apply policy definitions and initiatives, and enable remediation across subscriptions and resource groups.

Organize subscriptions with hierarchical management groups, starting from the route management group, creating admin, production, and dev groups; apply policies at the group level and inherit by all child subscriptions.

Explore Azure cost management and billing tools to analyze spending by service, location, and resource group, view forecasts, set budgets and alerts, and apply advisor recommendations to optimize cloud costs.

Explore Azure storage services with storage accounts, four storage types: blob, file, table, and Cosmos DB, and how durability, availability, encryption, and scalability meet data access and redundancy needs.

Learn to provision an Azure storage account by selecting subscription, resource group, a unique name, region, and redundancy, and explore blob, file, queue, and table storage.

Explore data redundancy options to protect data across failures and disasters by creating multiple copies; compare locally redundant storage, geo-redundant storage, and read-access variants for cost vs availability.

Explore blob storage, the binary large object system, its flat container structure, and blob types—block, page, and append—for streaming, analytics, logging, backup, and disaster recovery.

Learn how storage service endpoints create a unique namespace for each object, with endpoints for blob, file, queue, and table services tied to a storage account.

Compare standard and premium Azure storage tiers, magnetic versus SSD drives, and learn when to use backups and migration; note you cannot change tier after creation, upgrading requires premium account.

Learn azure table storage as a key-value, semi-structured database with rows and fields, partitioning for scale, and fast insertions, while noting its non-relational nature and use for logging data.

Understand how queue storage acts as a buffer to decouple producers and consumers, storing millions of messages for asynchronous processing, with examples of creating and managing queues and messages.

Create cloud file shares accessible from cloud and on premises using SMB or NFS, with encrypted data at rest and in transit for centralized configuration and shared tools.

Create and access a demo file share, upload a file, and connect via a script on Windows, Linux, or Mac, while noting possible firewall issues blocking port four four five.

Explore how virtual machines use operating system and data disks, and attach or create disk storage. Compare managed and unmanaged disks and disk types like premium and standard SSD.

Upgrade general purpose storage accounts from v1 to v2, adjust default access, configure geo replication and failover, and manage at-rest encryption keys with a managed or self-managed option.

Install Storage Explorer to manage all storage accounts from one place, connect to subscriptions and active directories, and access data lake and Cosmos TV without using the portal or PowerShell.

Learn Azure storage authorization options, including anonymous public access, shared authorization with access keys, SAS tokens, and Active Directory RBAC for fine-grained control.

Understand how storage access keys grant full account control and why they must be safeguarded. Rotate keys regularly and use key vaults, avoiding hardcoding in application code.

Learn how to grant limited access to Azure storage using a shared access signature (SAS), generatable at account, container, or blob levels with time, IP ranges, and permission controls.

Explore how stored access policy addresses SAS key challenges by defining permissions and time intervals at the container level, enabling policy-based shared access signatures and revocation.

Authorize a user to access a storage account using Azure Active Directory and role-based access control, with reader, contributor, and owner roles at account or container level.

Learn to restrict access to a storage account using network layer controls. Configure selected networks, IP ranges, and service endpoints with virtual networks and subnets.

Learn how Azure Storage data protection uses soft delete for blobs and containers, versioning, and change feed, and how point-in-time restore recovers containers.

Discover hot, cool, and archive access tiers to save costs by access frequency, latency, and retention needs, with pricing based on volume, operations, and data transfer.

Configure storage account settings to manage blob access tiers, switching files between hot, cool, and archive at blob-level; archive requires rehydration, with standard or high-priority options affecting speed and cost.

Master blob lifecycle management by defining a lifecycle policy with rules that move data from hot to cool to archive and deletes old blobs in general purpose v2 storage.

Configure asynchronous blob replication with policies and rules to copy blob versions and metadata from a source to a destination across regions, excluding snapshots, and cost-aware hot or cold tiers.

Demonstrate implementing replication between a source storage and a destination storage, enabling versioning and change feed, and creating replication rules to copy blobs asynchronously.

Explore file storage in Azure, focusing on standard and premium file shares, performance and access tiers (hot, cool, transaction optimized), and configuring a file share within a storage account.

Mount an Azure file share as a local drive by mapping a network drive on Windows, configure credentials, and sync cloud files with your laptop.

Azure File Sync keeps cloud file shares and on-premises servers in sync across locations, enabling local caching and replication via a sync group.

Demonstrates setting up Azure file sync with Windows Server VMs, configuring storage sync service, creating a sync group with cloud and server endpoints, and syncing a file share across servers.

Explore the Azure import and export service for moving large data between on-premises and cloud storage, including blob and files, using Data Box and tools like Portal and Storage Explorer.

Prepare the disk and use the import export tool to copy data from on premises to blob or file storage, encrypt with BitLocker, create the import job.

Execute Azure export jobs to copy data from Azure storage to on-premises. Select storage account, blobs, and containers, then decrypt and copy back using the import export tool.

Explore the WAImportExport tool, a free, 64-bit command-line utility for Azure import and export, including data size estimation, data copy, BitLocker encryption, with separate versions for blob storage and files.

Explore Azure data box for transferring data sets more than 40 terabytes, using a Microsoft device and configure import or export in the portal with subscription, resource group, and regions.

Learn how to use the easy copy tool (AzCopy) to move data between on-premises and storage (file, block, blob), with simple syntax, recursive options, and SAS authentication in cloud shell.

Demonstrate using the easy copy tool to download, authenticate with SAS tokens or Azure Active Directory, and copy files between storage accounts, containers, and local drives.

Learn to use Azure Storage Explorer to import and export data across storage accounts, manage subscriptions, configure access, including shared access signatures, copy and upload blobs, and manage snapshots.

Explore how a virtual machine delivers cloud infrastructure as a service with full OS, size, and security control for testing, development, fluctuating workloads, and lift-and-shift migrations.

Demonstrates how to quickly provision an Azure virtual machine in the portal, from subscription and resource group to region, image, size, credentials, and networking, with connection, disks, and cost considerations.

Explore Azure virtual machine sizes and images in the portal, compare entry-level, economy, compute-optimized, and memory options, select WordPress images, and compare pay-as-you-go and reserved pricing.

Resize a virtual machine by selecting a new size in settings, and follow best practice by stopping the virtual machine before resizing since the resize restarts it behind the scenes.

Move Azure virtual machines between resource groups or subscriptions, validate moves, and update dependent resources and resource IDs; learn about regional moves and key constraints.

Redeploy the virtual machine to a new node, then power it back on with the same configuration. Expect data loss on the temporary disk and a new IP address.

Learn to manage Azure virtual machine disks by creating and attaching data disks, configuring performance (IOPS and throughput), and registering disks in the operating system for persistent storage.

Explore disk types and performance metrics by examining latency, iops, and throughput, and determine suitable workloads for standard hdd, standard ssd, premium ssd, and ultra disk.

Create a snapshot to make a full read-only copy of a disk. Create disks from that snapshot and attach them to different virtual machines for backup or testing.

Enable shared disk to attach a disk to multiple virtual machines, with ultra disk or premium ssd. A cluster manager such as Windows Server Failover Cluster or Pacemaker handles locking.

Contrast unmanaged and managed disks in Azure, showing how managed disks are handled by Azure and unmanaged disks require you to manage your storage account with encryption, availability, and redundancy.

Explore the three Azure disk encryption types - server-side at-rest, operating-system disk encryption, and host-based end-to-end encryption - and their key management and performance implications.

Implement server-side encryption in Azure by moving from platform managed keys to customer managed keys using a key vault and disk encryption set for VM disks.

Enable Azure disk encryption on a running VM by configuring a key vault, creating a key, and applying OS and data disk encryption; verify encryption within the VM.

Learn how to enable encryption at host for a virtual machine by registering the feature with Cloud Shell and PowerShell, then enable and save the setting.

Learn core Azure virtual machine networking concepts, including virtual networks, subnets, network interface cards, network security groups, ip addressing (dynamic vs static), and load balancers, plus secure vm access.

Deploy a simple webpage on a Windows VM by installing IIS and creating a basic page, then allow HTTP via an inbound NSG rule.

Compare restarting a virtual machine versus stopping it; restart keeps the public IP and temporary storage data, while stop-start results in a new IP and potential data loss.

deploy a linux virtual machine in Azure using password authentication, select ubuntu server gen2, keep default networking with a public IP, and log in with the provided username and password.

Deploy a Linux virtual machine and authenticate with ssh keys instead of passwords. Generate a key pair, attach the public key, then log in with the private key.

Troubleshoot boot failures with boot diagnostics, view serial logs, and choose between Microsoft-managed or custom storage accounts, with settings changeable later.

Connect to a virtual machine using a public IP, then isolate it by removing that IP. Use bastion to access the private virtual machine without exposing its public IP.

Securely connect to a virtual machine without a public IP using Azure Bastion; deploy Bastion, create a dedicated subnet, and remove the VM's IP address.

Explore cost reduction strategies for cloud resources, including reserved instances, spot VMs, hybrid benefit, licensing savings, and advisor recommendations to optimize costs using the pricing calculator.