Microsoft Azure Administrator (Exam AZ-104)

Navigate the Azure portal, a web-based graphical user interface to log in, manage resources, and customize dashboards with themes, default views, and multiple dashboards for applications.

Manage Azure resources on the go with the Azure mobile app, checking virtual machines and resource health from a mobile device. Restart or connect to vm via rdp while traveling.

Explore the Azure cloud shell in the portal, initialize a storage account and file share, authenticate to your subscription, and run PowerShell and CLI commands without local installs.

Connect to your Azure subscription with Azure PowerShell, install the Az module, and manage resources with scripts, list virtual machines, and create resource groups for automated workflows.

Install the Azure CLI across platforms via MSI installer or PowerShell. Then log in with az login and use the interactive CLI to manage virtual machines.

Learn how Azure Resource Manager simplifies governance by grouping resources into resource groups, using declarative templates, tagging for billing, and applying RBAC across regions via portal, CLI, or API.

Use resource locks to prevent deletion at the resource or resource group level, applying a delete lock to protect items like databases while allowing other actions.

Move eligible resources between resource groups or subscriptions, including vm, disks, vnet, ip, and storage accounts; understand which resources can be moved and how resource group locking occurs.

Azure Resource Manager templates enable declarative deployments. They deliver infrastructure as code that is repeatable and consistent, reducing manual errors and supporting modular templates for networks and virtual machines.

Demystify ARM templates and learn how to customize parameters, manage networks, and deploy resources—storage, public IP, network security groups, and a virtual machine—across regions.

Deploy a Windows VM in Azure using an ARM template; import the template, configure subscription, resource group, admin credentials, DNS label, OS, and VM size for repeatable deployments.

Discover Azure storage's secure-by-default design with encryption at rest and in transit, built-in durability, geo-redundancy, and scalable access via REST APIs for files, blobs, tables, and Cosmos DB.

Learn to create an Azure storage account in the portal, choose storage v2, set a unique name, configure replication and access tiers, and access blob, file, queue, and table storage.

Create and manage containers in an Azure storage account, control public or private access, upload files, and explore with Azure Storage Explorer using access keys or Azure Active Directory.

Create a container to store binary objects in an Azure storage account and apply lifecycle rules to move blobs, delete, or rehydrate archived blobs across hot, cool, and archive tiers.

Explore how Azure Files enables SMB-based cloud file shares to replace on-premises file servers, support cross-region replication, centralized logs, and local caching with Azure File Sync.

Create a file share in an Azure storage account via the portal, then map it as a drive over SMB from Windows, Linux, or Mac using the given commands.

Create and view Azure file share snapshots to protect data, roll back to a point in time, and restore individual files as read-only copies or full backups.

centralize file shares with the azure file sync service, creating an on-premises cached copy accessible via smb across multiple offices.

Discover how Azure storage encrypts data by default, secures in transit, uses encryption with BitLocker and vTPM, and provides access controls via Azure Active Directory, keys, SAS, and policies.

Configure shared access signatures to grant limited, time-bound read and list access to storage resources, either programmatically or via the portal, without exposing the primary access keys.

Create a cloud virtual network to isolate traffic, enable private communication among subnets, and manage routing automatically, using non overlapping block notation to support cross-premises connectivity.

Create a virtual network in the Azure portal or via the command-line interface, configure address space and two subnets, and assign it to a resource group.

Manage private and public IP addresses in Azure virtual networks, with dynamic or static allocations, IP reservations, and on-premises routing via site-to-site VPN, for load balancers and gateways.

Explore how Azure service endpoints extend your virtual network to storage and other resources via private IPs, eliminating public endpoints and enabling secure access over Microsoft's backbone.

Learn how network security groups control inbound and outbound traffic for subnets and NICs by applying prioritized rules to allow or deny port 80 and 443.

Create a network security group in the portal, attach it to a resource group, and configure inbound and outbound rules with priorities to control traffic.

Azure firewall provides stateful, scalable protection as a service with packet inspection and high availability. It blocks traffic by default, enables application fqdn filtering, and integrates logs with Azure Monitor.

Add up to 900 custom domains to a single Azure Active Directory tenant, verify ownership via DNS TXT or MX records, and set a primary domain for new objects.

Learn to create and manage Azure DNS zones to host DNS records, using DNS as a service, and configure record sets with multiple IP addresses while updating registrar name servers.

Plan Azure virtual machines by considering virtual networks, naming conventions, region availability, and pricing to balance performance, proximity, and compliance.

Configure Azure virtual machine disks, including the operating system, temp, and data disks. Compare standard vs premium storage and unmanaged vs managed disks for cost, SLA, and availability.

Learn to create Azure virtual machines through the portal or JSON templates, selecting resource group, region, OS image, size, storage, networking, and optional templates for fast, consistent deployments.

Connect to your Azure VM via SSH or RDP. Use a Bastion host to access it over SSL through the Azure portal, without exposing a public IP.

Create an availability set to distribute virtual machines across fault and update domains, ensuring high availability during unplanned maintenance and outages through live migration, automatic recovery, and planned maintenance.

Learn how to create an availability set in the portal, configure fault and update domains, and deploy multiple Windows VMs for high availability in a single resource group.

Explore how virtual machine scale sets automatically deploy identical virtual machines to scale out and in with demand, enabling stateless deployments without pre provisioning and scaling to a thousand instances.

Create a virtual machine scale set, enable auto scaling from two to five instances, and configure load balancing with a public IP and virtual network.

Learn how to use Azure virtual machine extensions to provision anti-malware and custom scripts, support desired state configuration, and deploy extensions during or after VM setup.

Explore Azure VPN gateways for site-to-site and point-to-site connectivity across a virtual network, including tunnel limits and throughput options from basic to high-performance gateways.

Create and configure a virtual network gateway to enable a route-based VPN over the internet, set up gateway subnet and public IP, and establish VNet-to-VNet connections.

Use VNet peering to connect two virtual networks over the private Microsoft network, reducing latency and avoiding internet exposure, with regional and global options and differences in capabilities.

Configure VNet to VNet peering between two Azure virtual networks in the West US and Central US regions. Enable bidirectional access, forwarded traffic, and Gateway transit in the portal.

Explore ExpressRoute, a private, low-latency link from on-prem to Azure that supports data migration, business continuity, and disaster recovery without relying on the internet.

Azure auto-manages virtual network routing with built-in routes like virtual network default route and internet route; service endpoints and VNet peering add routes to storage, Azure SQL, and on-premises VPN.

Explore how to implement user defined routes in Azure to control traffic flow by choosing next hops like a network virtual appliance, virtual network gateway, internet, or none.

Create a route table in the Azure portal, define a next hop for specific destination ranges, and associate it with subnets to control traffic with user defined routes.

Azure load balancer distributes traffic across backend instances, offering public or internal front ends. Configure health probes, routing rules, and a back-end pool using basic or standard SKU across zones.

Learn how to create and configure an Azure load balancer in the portal, including front-end public or internal IPs, back-end pools, health probes, and routing rules.

Traffic Manager routes users via DNS to multiple regions and even between cloud and on-premises, boosting availability and reducing latency through routing methods like priority, performance, and geographic routing.

configure a traffic manager by adding Azure, external, and nested endpoints to route between east and central app services and enable regional failover during maintenance.

Understand how the Azure Application Gateway load balances web traffic, routes by host header and URL, and enables SSL termination with an optional web application firewall.

Discover how Azure Backup protects on-prem and cloud data with encryption, application-consistent backups, and long-term retention using the Recovery Services vault for Azure VM and file share protection.

Create a recovery services vault and configure backups for on-premises and Azure environments, including vault credentials, Windows Server agent installation, and scheduled backups.

Protect virtual machines in Azure by using snapshots for quick recovery points, Azure Backup with geo-redundant Recovery Services vaults, and Azure Site Recovery to replicate and failover VMs across regions.

Configure Recovery Services vault backup for on-premises and Azure VMs, choose a default or custom policy, enable the VM extension, and retain snapshots every two days with restore options.

Explore how the Azure Monitor service centralizes telemetry, logs, and metrics from Azure and on premises into a single pane for visualization and alerts.

Explore the Azure Monitor service in the portal, set up alert rules with action groups and email notifications, and analyze metrics and log analytics for virtual machines.

Discover how Azure Advisor analyzes your configuration and telemetry to enforce best practices, optimize costs, and improve high availability, security, performance, and operational excellence with actionable recommendations.

Discover how Log Analytics, part of Azure Monitor, collects data from cloud and on-premises systems with Windows and Linux agents, using a custom query language.

Learn how Network Watcher automatically monitors Azure virtual networks, enabling packet capture, VPN diagnostics, traffic monitoring, latency checks, NSG flow logs, and visual diagrams of topology.

Explore how the Azure Network Watcher analyzes and troubleshoots virtual network traffic, showing topology, NSG rules, connection monitoring, IP flow verify, next hop, and packet capture.

Explore how Azure Active Directory delivers cloud-based identity and access management with multi-factor authentication, device registration, and self-service password reset, plus just-in-time privilege identity management and on-premises integration.

Create and manage users and groups in the Azure Active Directory portal, including bulk import from CSV, and assign members to security or Office 365 groups.

Install and configure the Azure AD Connect tool, choose custom settings, set up directory synchronization with password hash synchronization, verify domains, and monitor connectors and synchronization status.

Join devices to Azure Active Directory to create trusted devices and enable single sign-on to Azure SaaS apps; support hybrid join for cloud and on-prem resources.

Enable Azure AD MFA to add a second factor via the authenticator app, push, SMS, or phone call, with Azure AD premium P1/P2 licensing.

Enable Azure AD identity protection to detect anomalous sign-ins, analyze risk from unfamiliar locations, and automatically enforce password resets or multi-factor authentication based on risk.

Configure self-service password reset in Azure Active Directory, assign who can reset, and select authentication methods; enable password writeback with Azure AD Connect for on-premises synchronization.