AZ-104: Microsoft Azure Administrator - Full Course -2026

Discover a broad, practical overview of the most commonly used Azure services, with hands-on practice via the Azure portal and Azure CLI, using a free trial account.

Explore Azure compute, storage, and networking options—from VMs and app services to containers and serverless functions. Learn about databases, data storage tiers, and secure connectivity with VNET and Express Route.

Learn to create and configure a virtual machine in the Azure portal, from subscription and resource group selection to image, disk, networking, and monitoring.

Navigate the Azure portal, customize dashboards, and quickly access resources like virtual machines and Active Directory; learn to use Azure Shell and PowerShell for resource management.

Learn to provision and manage Azure resources faster with the Azure CLI, switching between PowerShell and Bash, and deploy a web app to App Service using az commands.

Explore Azure service categories from migration with Azure Migrate and identity with Azure Active Directory to Azure Pipelines, analytics, and AI capabilities like Logic Apps.

Design a scalable e-commerce architecture on Azure by integrating Azure App Service, Azure SQL Database, Azure Cognitive Search, Azure AD B2C, queues, Azure Functions, blob storage, CDN, and Application Insights.

Learn to monitor, back up, secure, and govern Azure resources using Azure Monitor, Log Analytics, metrics and alerts, service health, security center, policy, and automation with ARM templates and blueprints.

On-premises Active Directory stores devices and users, verifies credentials, and enforces access controls, but faces scalability, maintenance, and disaster recovery challenges as remote work grows; Microsoft Entra modernizes identity.

Discover how Entra ID synchronizes on-premises identities to cloud SaaS apps with Entra Connect on a separate member server. Utilize MFA and conditional access; explore PIM and PAM licensing.

Discover Azure Active Directory as a cloud-based directory service that provisions identities in the cloud and enables single sign-on for cloud and on-premise applications via an application proxy. Explore how it supports devices, identity protection, and self-service features to reduce security costs while safeguarding access for Office 365, Salesforce, and Dynamic CRM.

Compare on-premises ADDS with cloud-based Azure Active Directory and explore how modern identities migrate to the cloud, using SAML, OpenID, or OAuth for authentication and authorization.

Explore Azure Active Directory basics, including default directory naming, custom domains, and user creation with verification, plus branding and location binding for secure sign-ins.

Explore managing Azure Active Directory with PowerShell through a hands-on lab. Create and manage users, connect to Azure AD, install the AzureAD module, and use Get-AzureADUser and New-AzureADUser.

Explore Azure Active Directory groups, including security and Office 365 groups, and learn assignment methods (direct, group, and rule-based), ownership, self-service management, expiration, naming policies, and welcome notifications.

Create and manage Azure AD groups with PowerShell, including connecting to Azure, creating a security group named AppDevelopers, adding members, and verifying with get-AZADGroupMember.

Learn how multi-factor authentication combines something you know, something you are, and something you have to secure Azure applications against unauthorized access.

Explore authentication methods for MFA, including call verification, one-way SMS, push notifications, and Microsoft Authenticator app codes, and how admins re-register MFA when needed.

Learn about three Azure AD user types: cloud identities, directory sync identities, and guests, and how to grant access to external accounts.

Discover Azure Active Directory licensing, learn what is free versus paid, and how features like conditional access, multi-factor authentication, and privilege identity management map to P1 and P2 licenses.

Understand how Azure AD Join enables single sign-on and enterprise roaming across devices, with Windows Hello and Windows Store for Business, and Intune integration for cloud and on-premise resources.

Deploy AD Connect to synchronize on-premise Active Directory identities to Azure Active Directory for SaaS access. This one-way sync supports password writeback and health monitoring via the Azure portal.

Explore Azure AD Connect Health to monitor hybrid identity synchronization, diagnose sync errors, set up notifications, and manage agents and licenses for AD DS, AD FS, and federation services.

Azure Active Directory B2B enables inviting external partners as guest users to access your apps and resources, with federated identities, terms of use, and security through MFA and conditional access.

Explore Azure AD B2C, a tenant for managing external user identities. Learn to configure identity providers, user flows, and link the B2C tenant to your subscription for app authentication.

Monitor azure active directory, tracking risky users and risky sign-ins with p1/p2 licenses, privileged identity management, azure identity protection; review security reports, audit logs, activity reports, azure monitor logs.

Organize subscriptions into management groups to apply governance policies, enable policy inheritance across hierarchies, and drive compliance and cost reporting for business units and teams.

Learn to create management groups in Azure via the Azure Portal, PowerShell, or Azure CLI, manage IDs and display names, and create child groups, while templates cannot create management groups.

Learn how Azure subscriptions act as logical units linked to your Azure account, enabling per-subscription billing, access control via IAM, and organization by department, project, region.

Learn how to obtain an Azure subscription through enterprise agreements, resellers, partners, or a personal free account, and explore free, pay-as-you-go, enterprise, and Azure student options.

Explore Azure subscription options, including free, pay-as-you-go, enterprise agreement, and student plans, with introductory credits and always-free products.

Identify the three Azure roles—account administrator, service administrator, and co-administrator—and explain their access, role changes, and directory association rules.

Explore Azure resource limits and usage quotas within a subscription, view per-resource limits across providers, and learn how to request quota increases for storage and network resources.

Tag Azure resources to organize by environment, cost center, and business unit, enabling billing; apply up to 15 tags per resource or group, and manage via PowerShell, CLI, or APIs.

Use the Azure pricing calculator to estimate compute, networking, storage, web applications, and databases, choose region and billing options, and export results.

Monitor and manage Azure billing by setting up cost alerts and budgets, threshold-based notifications via action groups, and emailed or SMS alerts every four hours with monthly resets.

Azure reservations lets you pre-pay for resources like virtual machines, SQL databases, and Cosmos DB for one or three years to secure significant discounts.

Explore role-based access control in Azure, learning to grant access to users, groups, and services, configure rules, and scope roles to subscriptions or resource groups.

Explore RBAC roles in Azure, including owner, contributor, and reader, and learn to assign permissions via the Azure portal IAM for storage accounts with Azure AD users.

Learn how Azure AD roles and administrators grant permissions, with the global administrator as the top role, and how role-based access control propagates from management groups to subscriptions and resources.

Explore how role definitions in Azure Active Directory specify permissions through actions and not actions, and how assignable scopes define where a role can operate.

Explore Azure role definitions with PowerShell by running get-AZroledefinition to view roles as JSON. Filter to show name and description or actions.

Learn to create and manage Azure Active Directory users and groups with PowerShell, including native cloud identities, guest account invitations, and bulk imports via CSV.

Explore how Azure policy enforces compliance by creating and assigning policy definitions and initiatives to govern resources, such as restricting virtual machines to West Europe and blocking deployments elsewhere.

Create and assign an Azure policy initiative to restrict virtual machines to Western Europe. Learn to configure policy definitions and test enforcement by simulating VM creation failures and successes.

Discover how to use Azure policy to audit, enforce, and prevent noncompliant resources, manage tags and values, and monitor compliance across resource groups and subscriptions.

Azure portal provides a unified web interface to build, manage, and monitor resources, offering customized dashboards, favorites, Cloud Shell access, and direct access to documentation.

Manage Azure resources on the go with the Azure mobile app, including subscriptions, resource groups, and resources. Use Cloud Shell with PowerShell or Bash for scripting, secured by MFA.

Explore the Azure portal through a hands-on demo, learning to customize dashboards, manage resources, and navigate services, subscriptions, and Cloud Shell for day-to-day administration.

Access a browser-based interactive shell to manage Azure resources, with Bash on Linux, PowerShell on Windows, an integrated Monaco Editor, automatic authentication, and per-session hosting with a 20-minute timeout.

Explore how PowerShell cmdlets use verb-noun names to retrieve and modify resources, and learn to discover available verbs with Get-Verb for first steps.

Explore PowerShell verb-noun usage, tab-completion, and Get-verb examples for restarting computers and managing services. Recognize that PowerShell is a framework, not a scripting language, designed to be extended with modules.

Identify how PowerShell cmdlets reside in modules and verify module availability with Get-Module -ListAvailable. Explore Azure modules and vendor modules, install them, and access commands like Connect-MsolService and Resolve-DnsName.

Install Azure-specific PowerShell modules (AZ) and learn to manage Azure resources, use Get-Module and Install-Module, login to your subscription, and verify with Get-AzSubscription.

Learn to manage Azure resource groups with PowerShell: log in, create a resource group with New-AzResourceGroup in East US, view details with Get-AzResourceGroup, and remove it with Remove-AzResourceGroup.

Compare AzureRM and AZ modules, explain backward compatibility, and guide you to transition to AZ commands for future Azure administration.

Install the Azure CLI locally, verify the version with az --version, and log in with az login to manage resources and resource groups using az commands.

Manage and monitor resources as a group with resource manager, deploying consistently using declarative templates, defining dependencies, and applying tagging for cost visibility and role-based access control.

Explore Azure resource providers and their types using the Resource Explorer in the Azure console. See how JSON describes features under providers like Compute and Devices.

Move resources between subscriptions or resource groups; source and target groups lock during the move, blocking writes, but resources stay active and users experience no downtime.

Create a resource group with PowerShell, apply a cannot-delete lock, try deleting it and see the error, then remove the lock and delete the resource group to demonstrate PowerShell scripting.

Arm templates speed deployments and ensure repeatable, consistent infrastructure across dev, test, and prod environments by codifying the entire stack in json, reducing manual steps and errors.

Explain how azure resource manager templates use json to define resources with key-value pairs and how to call the json with powershell to build resources.

Learn how parameters enable configurable inputs during deployment, such as adminUsername and adminPassword, and how variables reuse values like storage account name and networking features (NetworkName, addressPrefix, subnetName, subnetPrefix, publicIPName).

Explore Azure resource manager templates using the Azure quickstart templates repository to learn, test, and deploy infrastructure via json templates, variables, parameters, and schema.

Learn how Azure Resource Manager templates use JSON with parameters and variables to deploy resources, such as a simple Windows virtual machine, via PowerShell or CLI.

Demonstrates deploying a Windows VM with an ARM template using PowerShell, editing the JSON locally, and troubleshooting deployments to provision full Azure infrastructure.

Learn how to manage Azure virtual machines with PowerShell, including connecting to Azure, retrieving VMs, and resizing from standard_A2 to standard_A3 or higher using Update-AzVM.

Clean up Azure resources with PowerShell by shutting down and removing a virtual machine and its resource group, using Remove-AzVM and Remove-AzResourceGroup to minimize costs.

Visualize your Azure Resource Manager JSON templates with armviz.io to quickly understand deployed resources, including a Windows virtual machine, network components, public IP, and storage accounts.

Explore why moving server resources to Azure reduces costs and simplifies operations, and learn how Azure networking components provide isolation options like DMZs to design cloud infrastructure.

Azure virtual networks (vnets) represent your private cloud network, host resources in isolation, and securely connect on-premises with optional vnet-to-vnet links using CIDR blocks.

Create a virtual network with two subnets and deploy two Windows servers in each subnet, then use security groups to enable inbound traffic (RDP) and verify connectivity between servers.

Master provisioning an Azure virtual network and subnets with PowerShell, discovering commands via Get-Command, creating with New-AzVirtualNetwork, adding subnets with Add-AzVirtualNetworkSubnetConfig, and validating with Get-AzVirtualSubnetConfig.

Understand how subnets segment a virtual network with unique cidr blocks, reserving first three and last addresses, while Azure routes by default and supports routing via a network virtual appliance.

Attach multiple network interface cards to a single Azure virtual machine, assigning IPs from two subnets in the same VNet, with required downtime and dynamic or static IP options.

Assign private and public IPs to Azure resources for VNet communication and on-premise or Internet connectivity, and manage IPs for DNS, SSL, and security-sensitive services via Azure portal or PowerShell.

Explore how private IP addresses attach to virtual machines, internal load balancers, and Application Gateway, and compare dynamic vs static assignment in Azure subnets.

Explore public IP addresses in Azure: dynamic vs static, basic vs standard SKUs, IPv4/IPv6, and how to associate them with VMs, NICs, load balancers, VPN gateways, or application gateways.

Retrieve and manage a virtual machine's static private IP address using PowerShell, discovering IP configurations with Get-AzNetworkInterface and converting allocation from dynamic to static with Set-AzNetworkInterface.

Azure service endpoints provide private connectivity from virtual networks to Azure SQL and storage, making them act as part of the network and using private IPs instead of public endpoints.

Learn how service endpoints connect virtual machines to platform as a service-based services in Azure, enhancing security by extending VNET identity, enabling direct backbone routing, and simplifying subnet setup.

Demonstrate enabling Azure Storage service endpoints on the Corp subnet and applying firewall rules to restrict access to the storage account from the VNet, verified via Azure Storage Explorer.

Enable service endpoints to extend your virtual network to Azure Storage, SQL Database, Cosmos DB, Key Vault, Service Bus, Event Hubs, and Data Lake, with subnet access controls.

Learn how a default azure ad domain with a .onmicrosoft.com suffix is created and how to add a custom domain by creating a txt or MX record at your registrar.

Host Azure DNS zones and manage record sets in Azure DNS for externally facing domains, including A records like www to public IP addresses.

Delegate your domain to Azure DNS by updating the registrar’s NS records to Azure's four name servers ns1, ns2, ns3, and ns4, then verify the zone with Get-AzureRmDnsZone in PowerShell.

Learn how private zones enable internal name resolution within a virtual network by auto-registering virtual machines into contoso.com and creating private A and PTR records, without internet access.

explore dns private zones for cross-vnet name resolution, where forward and reverse queries traverse a registration vnet and a resolution vnet sharing a common zone, with split-horizon nxdomain behavior.

Create a private dns zone, link VNet1 and VNet2, and enable automatic A and PTR record registration for internal forward and reverse lookups with no external access.

Learn how network security groups protect resources in a virtual network by controlling inbound and outbound traffic and enabling port-level access control, including their scope.

Link network security groups to subnets for reuse, and avoid applying them to both subnet and NICs; inbound and outbound rules are evaluated first at the subnet, then at the NIC.

Learn how Azure network security groups apply default inbound and outbound rules, filter traffic, configure rules, set priorities, and attach groups to subnets or interfaces.

Explore intersite connectivity in Azure, covering VNet peering, VNet-to-VNet connections, and ExpressRoute, with practical labs to implement network connectivity.

Connect Azure virtual networks with VNet peering to view them as one for connectivity, using regional peering for same-region networks and global peering for different regions.

Explore benefits of local and global VNet peering, where private traffic stays on Microsoft backbone with no public internet, encryption not required, delivering low latency, high bandwidth and no downtime.

Create a VNet peering between two VNets, configure bidirectional traffic, forwarded traffic, and gateway transit options to enable seamless cross region connectivity.

Enable gateway transit to allow peer virtual networks to share a single virtual network gateway, connecting to on-premises via site-to-site VPN and other networks.

Explore how service chaining enables transitive routing in Azure VNet networks by using hub-and-spoke architectures with network appliances and VPN gateways to overcome VNet peering limits.

Establish VNet-to-VNet and site-to-site VPN connections with Azure VNet gateways to securely route traffic between virtual networks or between on-premises infrastructure and Azure via IPsec IKE.

Configure a virtual network gateway by selecting a vnet, creating a gateway subnet, and selecting vpn type and sku, with route-based routing and active-active high availability in the lab.

Create a point-to-site VPN from a laptop to an Azure VNet, configure a /24 address pool, generate self-signed certificates, install the VPN client, and verify private IP connectivity.

Discover how ExpressRoute connects on-premises to Azure regions with dual BGP sessions, enabling access to Azure services, Office 365, Dynamics 365, and bandwidth from 50 Mbps to 10 Gbps.

Explore ExpressRoute as a direct private connection from your WAN to Microsoft services, with site-to-site VPN as encrypted failover, using two gateways and PowerShell for coexisting connections.

Learn how hybrid cloud connectivity links on-premise data centers to Azure using VPN and ExpressRoute, comparing point-to-site, site-to-site, and VNet-to-VNet solutions for secure, scalable access.

Master azure networking by hands-on practice with virtual networks. Build something simple, then increase complexity and share feedback to shape future content via LinkedIn and community forums.

Azure uses system routes to direct traffic between subnets and the internet; route tables define destinations and allow custom routes to override default system routes, including VPN connections.

Configure user-defined routes (UDRs) to steer Azure traffic from 192.168.30.0/24 through a virtual appliance, then attach the route table to the Mysite-vnet subnet.

Explore how Azure Load Balancer distributes internet and intranet traffic across multiple web servers behind a backend pool to ensure high availability.

Explore how azure load balancer uses front-end ip configuration, a backend pool, health probes, and load balancing rules to deliver high availability and scale for tcp and udp traffic.

Distribute incoming traffic across multiple virtual machines using a public load balancer that maps the public IP and port to each virtual machine's private IP and port.

Explore how an internal load balancer directs traffic within a virtual network, supports vpn access, and balances backend sql servers on port 1443 for azure and on-premise resources.

Select the appropriate Azure load balancer type and sku, compare basic versus standard, and understand pricing, rules, and network scope with front ends and backend pools.

Set up a load balancer with backend pools, rules, persistence, and health probes, and deploy two linux web servers in the same vnet and availability set.

Set up a public load balancer in East US, add two web servers to the backend pool, and assign a dynamic IP. Understand internal vs public load balancers and SKUs.

Configure a Microsoft Azure load balancer by setting the frontend IP, the backend pool, health probes, and load balancing rules; understand session persistence and the 5-tuple hash.

Explore Azure Traffic Manager to distribute user requests across endpoints in different regions using DNS routing, health checks, and automatic failover, enabling high availability and faster loads.

Use priority routing in Azure Traffic Manager to route traffic to a primary endpoint from a prioritized list and failover to a secondary region when the primary is unavailable.

Understand how Traffic Manager uses performance routing to direct users to the nearest data center. Determine how the latency table and recursive DNS service select the endpoint.

Discover how Azure Traffic Manager geographic routing directs traffic by region, mapping locations to endpoints, delivering local content and lower latency through nested profiles and priority routing.

Configure Traffic Manager's weighted routing to distribute traffic across endpoints by assigning weights (1–1000); equal weights yield even distribution, higher weights prioritize endpoints, and absent weights default to one.

Configure Azure Traffic Manager profiles by connecting two App Services endpoints and applying routing methods like weighted, geographic, MultiValue, and subnet to manage traffic.

Learn Azure storage across three categories: disks and files for virtual machines, blobs and data lake store for unstructured data, and tables, Cosmos DB, and Azure SQL for structured data.

Explore Azure storage accounts and their services—blobs, files, queues, and tables—for storing unstructured data and media. Use cases include backups, disaster recovery, archiving, and scalable NoSQL tables via Cosmos DB.

choose between standard and premium storage accounts in Azure, premium uses SSDs for low-latency io-intensive workloads, and conversion isn't possible; you must create a new storage account and copy data.

Understand the three Azure storage types—general purpose v2, general purpose v1, and blob storage—and why v2 offers the best pricing, features, and upgrade path.

Learn to create a resource group and storage account with PowerShell, using variables and comments, troubleshoot common errors, and compare scripting with the graphical user interface.

Create a resource group and provision a storage account with the Azure CLI in westus, using local redundant storage. Follow lowercase, no special characters, and StorageV2.

Explore how Azure Storage Explorer, a standalone Microsoft app, connects to storage accounts and multiple subscriptions, enabling blob, table, queue, and file management across Azure Data Lake storage.

Learn how to create Azure blob storage by first creating a storage account, then a container inside it, and store unlimited blobs with naming rules in lowercase, numbers, and hyphens.

Learn how Azure hot, cool, and archive tiers match data usage and cost, with hot’s high IOPS for frequently accessed data. Choose right access tier to balance performance and latency.

Enable https traffic only on your Azure Storage Account to securely transfer confidential data, because http requests are rejected when secure transfer is required.

Learn to create and view file share snapshots, and restore data by mounting a snapshot as a file share on Windows, Linux, or Mac, including PowerShell options.

Learn Azure storage security basics, including shared access signatures, storage service encryption (SSE), and Azure AD-integrated access controls, plus protecting data in transit and disk encryption for VMs.

Explore authorization options for Azure storage resources, including Azure AD with role-based access, shared key signatures, and SAS. Learn when to enable anonymous read access for public containers.

Grant granular, time-limited access to Azure storage resources via shared access signatures. Define start and expiry times, permissions (read, write, delete), IP ranges, and HTTPS enforcement for secured access.

Configure shared access signatures to grant granular blob storage permissions, set start and expiry times, IP and protocol restrictions, and verify read and list access with Storage Explorer.

Configure customer managed keys to control encryption with your own keys stored in a key vault, enabling SSE on storage accounts with rotation and defined access controls.

Mitigate risks of shared access signatures by using https and stored access policies. Set short start and expiry times, grant least privileges, and monitor with storage analytics.

Learn how blob storage uses containers with private, blob, or container access levels to grant private access or anonymous public read and list access for web apps.

Explore Azure operating system images, including Windows and Linux variants, client and server editions, and how license pricing affects compute costs. Leverage Azure Marketplace images for ready stacks.

Avoid in-place upgrades on Azure Windows Server VMs; create a new VM with Windows Server 2016 or 2019 and migrate data from 2012 R2.

Discover how Azure compute delivers on-demand resources, including disks, processors, memory, networking, and operating systems, for cloud apps with pay-as-you-go pricing, and learn to create virtual machines and containers.

Learn how to create a Windows virtual machine in the Azure portal, configuring subscription, resource group, region, image, size, network, public IP, RDP access, and extensions.

Explore how to access the newly created virtual machine in the Payroll resource group, review deployment details, and verify resources such as storage account, public IP, and virtual network.

Connect to an Azure virtual machine via RDP using the public IP 23.101.139.227 in East US, verify credentials and security group access, and prepare it for production by installing apps.

Install the IIS web server role on a Windows virtual machine via Server Manager, then verify locally on localhost and prepare for access on port 80 by configuring security groups.

Open port 80 on the virtual machine by updating the security group's inbound rule, enabling web traffic and verifying the site loads successfully.

Learn to create a Windows Server 2016 Datacenter VM in Azure with PowerShell, then configure credentials, OS, storage, and network to deploy and obtain the public IP.

Learn to create a Linux virtual machine in Azure, configure SSH key authentication, open ports 22 and 80, install Apache, and access the web server via the public IP.

Prepare for unplanned hardware maintenance, unexpected downtime, and planned maintenance as an Azure administrator, using live migration and auto healing to minimize downtime.

Enhance reliability with Azure Availability Sets that spread virtual machines across servers and storage, avoiding a single point of failure and supporting staggered upgrades with load balancers and managed disks.

Understand fault domains and update domains in Azure availability sets, ensuring VMs are spread across racks to tolerate hardware failures and updates reboot one domain at a time.

Use custom script extensions to automate installing monitoring agents and other components during VM provisioning. Create and upload PowerShell scripts, and handle timeouts, dependencies, and sensitive data securely.

Learn to install extensions on an Azure virtual machine, using pre-built and custom script extensions (PowerShell) to deploy components like Microsoft Antimalware and IIS, and verify provisioning.