Pass the Microsoft Azure Administrator AZ-104 in 4 weeks

Navigate case study section by quickly scanning lengthy requirements, answer ten independent questions within the two-hour exam, jot key details on provided paper, and use the review screen to finalize.

Master Azure rbac and intra roles, including owner, contributor, reader, and administrators. Learn how to assign roles at management group, subscription, resource group, and resource levels.

Explore dynamic group membership for users and devices and administrative units in Entra, covering license automation, conditional access, project based access, location based access, and role assignments.

Explore identity governance and entitlement management, automating access requests, reviews, and expiration with access packages for time-limited, lifecycle workflows and multi-stage approvals.

Explore access reviews within identity governance to regularly verify users' access, including security group memberships, enterprise apps, and privileged identity management components, with lifecycle workflows to automate user lifecycles.

Explore conditional access as a zero trust engine using signals such as users, location, device, and apps to enforce MFA and compliance, plus hybrid identity with Entra and AD Connect.

Learn how Azure Policy enforces governance and compliance at scale, using built-in and custom policies, automatic remediation, tagging, and policy sets across subscriptions and resource groups.

Learn how resource groups organize resources under a subscription, manage access with role-based access control, apply delete and read-only locks, and use tagging to track costs.

Register apps in a Microsoft Entra tenant to create a global application object and tenant-specific service principals, while managed identities simplify access to resources without credentials.

Explore extra exam topics, including external users and B2B collaboration in Entra with guest identities and invitation workflows, plus Active Directory domain services and security group vs Microsoft 365 group.

Learn how an Azure storage account provides a unique namespace for storing blobs, files, queues, and tables with durable, highly available, encrypted, and scalable data storage.

Configure and manage storage accounts, set cross-region redundancy, learn storage account types, enable replication, configure encryption, and manage data with Storage Explorer and AzCopy.

Explore Azure blob storage redundancy options, from locally redundant storage to geo zone redundant storage, across about six options, with RPO, durability, and read access choices.

Explore object replication for block blobs across regions, using change feed and versioning with container pairs, website hosting, and server-side encryption with Microsoft managed, customer managed, or customer provided keys.

Learn to configure secure access to your storage account by setting up firewalls and virtual networks, creating SAS tokens, managing access keys, and applying stored access policies.

Compare service endpoints and private endpoints in Azure VNets, detailing traffic flow, private ip injection, and dns requirements, plus on-prem access and cost differences.

Explore shared access signature tokens for delegated access to storage resources (blobs, files, queues, tables), covering user delegation, service, and account sas types, their required fields and stored access policies.

Explore configuring Azure Files and Azure Blob Storage, including file shares, identity-based access, containers, storage tiers, snapshots, soft delete, lifecycle management, versioning, and data lake storage and tables and queues.

Discover azure files and azure file sync, enabling fully managed smb and nfs file shares for on-prem and cloud workloads with bidirectional synchronization and cloud caching.

Discover how Azure Files SMB and NFS shares support workloads with premium vs standard tiers and LIRS, XRES, GRS, and GSRs redundancy, plus identity based access via Kerberos.

Understand the differences between manual blob snapshots and automatic versioning, learn how read-only copies protect data, and explore soft delete and immutable storage for regulatory compliance.

Deploy and manage Azure compute resources by applying infrastructure as code with Bicep and ARM templates, exploring compute, disks, encryption, containers, and app service hosting.

Explore DevOps overview, from clickops to infrastructure as code, and how automation tools enable versioned, testable, and faster deployments across dev, test, and prod.

Explore how Azure Resource Manager templates declare resources in JSON for idempotent, ordered deployments. Learn parameters, variables, functions, and deployment history with what-if analysis and dynamic values.

Master the essential ARM template components and explore design options for structuring resources, including a single template, separate templates per tier, or nested templates, for scalable Azure deployments.

Learn how template specs store ARM templates as an Azure resource with RBAC access, enabling deployment via PowerShell or DevOps pipelines and replacing Azure blueprints.

Deploy resources with arm or bicep templates via portal or cli, manage permissions and what-if checks, export and decompile templates, and track deployments across resource groups.

Explore virtual machine sizes and types, disk encryption and various VM disks, then cover availability zones, scale sets, dedicated hosts, bastion and just-in-time access, spot VMs, and proximity placement groups.

Learn to create an Azure VM in the portal, selecting subscription, resource group, region, image, size, and network settings. Explore VM family naming from general purpose to high performance computing.

Move a vm across resource groups, subscriptions, or regions in the portal, noting resource id changes, quotas, and required permissions, and choose disk types from hdd to ultradisk.

Discover deploying VMs into Azure availability zones to boost high availability, comparing zone redundant deployments with zonal deployments, and using a load balancer to failover across zones.

Discover how a bastion host enables secure private IP access to VMs via a single public IP, and how just-in-time access in Defender for Cloud reduces inbound exposure.

Explore spot VMs, replacing legacy low priority VMs, offering significant discounts during excess capacity with eviction and deallocation choices, and proximity placement groups to minimize latency.

Explore containers, container registry, container instances, and container apps, and learn how to scale ACI and ACA.

Explore how containers package applications with images and dockerfiles, run isolated processes via docker run, and differ from virtual machines by sharing the host OS kernel.

Learn how Azure container registry, or ECR, stores and versions docker images, enabling push and pull in ci/cd pipelines with Jenkins or Azure Pipelines, with tls security and tier options.

Explore Azure app service basics, including the app service plan prerequisites, hosting options like web app and static web app, plus health checks, scaling, certificates, deployment slots, environments, and backups.

Discover how app service plans define compute resources for web apps and functions, enabling serverless compute, and master manual, automatic, and rules-based scaling to manage instance counts in a region.

Explore Azure App Service and its types—web apps, static web apps, and web app plus database—and how it hosts apps and APIs with multiple runtimes.

Learn how app service health check enables high availability by validating the health endpoint across layers. Remove unhealthy instances from the load balancer; learn auto scaling with always ready instances.

Configure a custom domain for your app service, verify ownership with CNAME and TXT records, and secure with App Service managed certificates or Key Vault stored certificates.

Utilize app service deployment slots to achieve zero-downtime releases via blue/green traffic swapping, with pre-warmed instances and options for automatic or custom backups and restores.

Explore key vault concepts, including keys, secrets, and certificates, with rbac and access policies; learn auto rotation of cmk, control plane vs data plane, and vm autoscale basics.

Implement and manage virtual networking in Azure, understanding its security implications and how it interfaces with your on-premises network across three subsections.

Learn to configure and manage virtual networks in Azure, enable peering, expose web apps with public IP addresses, and route traffic between subnets and on-premises networks.

Discover how private networking works with Azure VNet, using RFC 1918 private address spaces, NAT, and subnets to isolate resources and connect via VPN, peering, or ExpressRoute with public IPs.

Master VNet gateway concepts, including VPN gateway and ExpressRoute gateway, for VNet connections. Compare VNet gateway versus VNet peering for encrypted site-to-site links and low-latency backbone.

Understand VNet traffic routing with system routes per subnet, default routes for the four private address spaces, and longest prefix match, plus how user defined routes override them.

Explore configuring VNet security with network security groups, application security groups, bastion server, service endpoints for platform as a service, and private link and private endpoints for vnets.

Explore how NSG filters inbound and outbound traffic within and between your VNet. Learn about five-tuple rules, 0 or 1 NSG associations, default inbound deny, and ASG integration.

Implement a bastion server to securely access VMs using private IPs, avoiding public IPs, via Azure Bastion with RDP/SSH over TLS; and configure VNet service endpoints for Azure service access.

Discover private link and private endpoints for private access to Azure services within your VNet using private IPs and DNS integration, and compare with service endpoints for secure cross-VNet connectivity.

Explore Azure DNS and domain naming service, balance traffic with internal and external load balancers, and compare layer four network load balancers with application load balancers, while troubleshooting common issues.

Learn Azure DNS for public and private resolution, configure A, CNAME, NS, and TXT records, set up DNS zones with delegation, and link private zones to your VNet.

Explore Azure DNS private resolvers that enable querying private DNS zones from on-premises to Azure and back without VM-based DNS servers, using inbound and outbound endpoints and rule sets.

Compare static vs dynamic public IPs, including usage scenarios for DNS and certificates, and review Azure load balancer SKUs—basic, standard, gateway—and session persistence with hash-based distribution.

Explore Azure Monitor to view metrics, configure logs, query and analyze logs, and set up alerts with Azure Monitor Insights and Network Watcher.

Master Azure Monitor by configuring metrics, logs, alerts, and insights, then use Network Watcher to monitor and troubleshoot your resources.

Discover Azure Monitor's metrics and logs, covering platform and custom metrics, log analytics, app insights, container insights, and alerts, with visualizations in Grafana and Power BI.

Explore the log analytics workspace and Azure tables, including creating custom tables via data collection rules or log uploads; learn to analyze data with KQL using tabular expressions and pipes.

Explore how to alert on metrics and logs with Azure Monitor, configure scope, signal, and condition, and trigger action groups to notify or automate remediation.

Explore Azure App Insights, an application performance monitoring tool for live web apps, featuring investigate, monitor, and usage views to improve observability and user insights.

Explore Network Watcher and its connection monitor to visualize end-to-end network paths, monitor connectivity between sources and destinations, and view test results in log analytics for Azure infrastructure components.

Explore the network diagnostic tools in network watcher, including IP flow verify, NSG diagnostics, next hop, effective security rules, VPN troubleshoot, packet capture, and connection troubleshoot.

Monitor the current state of your Azure network with NSG and VNet flow logs, tracking ingress and egress traffic and open ports for compliance and intrusion detection.

Explore Azure backup and recovery concepts, including recovery services vault and backup vault, their differences, and how to manage and restore backups with site recovery.

Use the recovery service vault to store backups and recovery points for Azure VMs, SQL in Azure, and Windows or Linux workloads. Define policies with frequency, retention, and instant restore.

The Mars agent, part of the Microsoft Azure Recovery Service, backs up files, folders, and system data on Windows machines. Maps provides on prem backup for VMs, applications, and databases.

Learn to restore from Azure backup, choosing full VM, disk, or file restores. Compare encrypted versus unencrypted restores, recovery points, instant restore, vault tier, and site recovery concepts.

Explore action groups in Azure Monitor to define alert notifications and automated responses, and study data collection rules and agents for metrics and logs to Azure Monitor or Log Analytics.

Review your notes and cheat sheet, and prepare with a full-length two-hour practice exam to simulate testing time and pressure in one sitting.

Review your full length exam experience and build confidence through practice with full length tests. Use more practice tests to master tougher questions, minute details, ARM templates, and JSON.