Pass the Microsoft Azure Administrator AZ-104 in 4 weeks

Navigate case study section by quickly scanning lengthy requirements, answer ten independent questions within the two-hour exam, jot key details on provided paper, and use the review screen to finalize.

Explore dynamic group membership for users and devices and administrative units in Entra, covering license automation, conditional access, project based access, location based access, and role assignments.

Explore access reviews within identity governance to regularly verify users' access, including security group memberships, enterprise apps, and privileged identity management components, with lifecycle workflows to automate user lifecycles.

Learn how Azure Policy enforces governance and compliance at scale, using built-in and custom policies, automatic remediation, tagging, and policy sets across subscriptions and resource groups.

Learn how resource groups organize resources under a subscription, manage access with role-based access control, apply delete and read-only locks, and use tagging to track costs.

Register apps in a Microsoft Entra tenant to create a global application object and tenant-specific service principals, while managed identities simplify access to resources without credentials.

Learn how an Azure storage account provides a unique namespace for storing blobs, files, queues, and tables with durable, highly available, encrypted, and scalable data storage.

Explore Azure blob storage redundancy options, from locally redundant storage to geo zone redundant storage, across about six options, with RPO, durability, and read access choices.

Explore object replication for block blobs across regions, using change feed and versioning with container pairs, website hosting, and server-side encryption with Microsoft managed, customer managed, or customer provided keys.

Learn to configure secure access to your storage account by setting up firewalls and virtual networks, creating SAS tokens, managing access keys, and applying stored access policies.

Explore shared access signature tokens for delegated access to storage resources (blobs, files, queues, tables), covering user delegation, service, and account sas types, their required fields and stored access policies.

Explore configuring Azure Files and Azure Blob Storage, including file shares, identity-based access, containers, storage tiers, snapshots, soft delete, lifecycle management, versioning, and data lake storage and tables and queues.

Discover azure files and azure file sync, enabling fully managed smb and nfs file shares for on-prem and cloud workloads with bidirectional synchronization and cloud caching.

Discover how Azure Files SMB and NFS shares support workloads with premium vs standard tiers and LIRS, XRES, GRS, and GSRs redundancy, plus identity based access via Kerberos.

Understand the differences between manual blob snapshots and automatic versioning, learn how read-only copies protect data, and explore soft delete and immutable storage for regulatory compliance.

Explore DevOps overview, from clickops to infrastructure as code, and how automation tools enable versioned, testable, and faster deployments across dev, test, and prod.

Explore how Azure Resource Manager templates declare resources in JSON for idempotent, ordered deployments. Learn parameters, variables, functions, and deployment history with what-if analysis and dynamic values.

Master the essential ARM template components and explore design options for structuring resources, including a single template, separate templates per tier, or nested templates, for scalable Azure deployments.

Learn how template specs store ARM templates as an Azure resource with RBAC access, enabling deployment via PowerShell or DevOps pipelines and replacing Azure blueprints.

Deploy resources with arm or bicep templates via portal or cli, manage permissions and what-if checks, export and decompile templates, and track deployments across resource groups.

Explore virtual machine sizes and types, disk encryption and various VM disks, then cover availability zones, scale sets, dedicated hosts, bastion and just-in-time access, spot VMs, and proximity placement groups.

Move a vm across resource groups, subscriptions, or regions in the portal, noting resource id changes, quotas, and required permissions, and choose disk types from hdd to ultradisk.

Discover how a bastion host enables secure private IP access to VMs via a single public IP, and how just-in-time access in Defender for Cloud reduces inbound exposure.

Explore spot VMs, replacing legacy low priority VMs, offering significant discounts during excess capacity with eviction and deallocation choices, and proximity placement groups to minimize latency.

Explore containers, container registry, container instances, and container apps, and learn how to scale ACI and ACA.

Explore how containers package applications with images and dockerfiles, run isolated processes via docker run, and differ from virtual machines by sharing the host OS kernel.

Explore Azure App Service and its types—web apps, static web apps, and web app plus database—and how it hosts apps and APIs with multiple runtimes.

Learn how app service health check enables high availability by validating the health endpoint across layers. Remove unhealthy instances from the load balancer; learn auto scaling with always ready instances.

Configure a custom domain for your app service, verify ownership with CNAME and TXT records, and secure with App Service managed certificates or Key Vault stored certificates.

Utilize app service deployment slots to achieve zero-downtime releases via blue/green traffic swapping, with pre-warmed instances and options for automatic or custom backups and restores.

Explore key vault concepts, including keys, secrets, and certificates, with rbac and access policies; learn auto rotation of cmk, control plane vs data plane, and vm autoscale basics.

Implement and manage virtual networking in Azure, understanding its security implications and how it interfaces with your on-premises network across three subsections.

Discover how private networking works with Azure VNet, using RFC 1918 private address spaces, NAT, and subnets to isolate resources and connect via VPN, peering, or ExpressRoute with public IPs.

Master VNet gateway concepts, including VPN gateway and ExpressRoute gateway, for VNet connections. Compare VNet gateway versus VNet peering for encrypted site-to-site links and low-latency backbone.

Understand VNet traffic routing with system routes per subnet, default routes for the four private address spaces, and longest prefix match, plus how user defined routes override them.

Explore configuring VNet security with network security groups, application security groups, bastion server, service endpoints for platform as a service, and private link and private endpoints for vnets.

Explore how NSG filters inbound and outbound traffic within and between your VNet. Learn about five-tuple rules, 0 or 1 NSG associations, default inbound deny, and ASG integration.

Implement a bastion server to securely access VMs using private IPs, avoiding public IPs, via Azure Bastion with RDP/SSH over TLS; and configure VNet service endpoints for Azure service access.

Explore Azure DNS and domain naming service, balance traffic with internal and external load balancers, and compare layer four network load balancers with application load balancers, while troubleshooting common issues.

Learn Azure DNS for public and private resolution, configure A, CNAME, NS, and TXT records, set up DNS zones with delegation, and link private zones to your VNet.

Compare static vs dynamic public IPs, including usage scenarios for DNS and certificates, and review Azure load balancer SKUs—basic, standard, gateway—and session persistence with hash-based distribution.

Master Azure Monitor by configuring metrics, logs, alerts, and insights, then use Network Watcher to monitor and troubleshoot your resources.

Discover Azure Monitor's metrics and logs, covering platform and custom metrics, log analytics, app insights, container insights, and alerts, with visualizations in Grafana and Power BI.

Explore how to alert on metrics and logs with Azure Monitor, configure scope, signal, and condition, and trigger action groups to notify or automate remediation.

Explore Network Watcher and its connection monitor to visualize end-to-end network paths, monitor connectivity between sources and destinations, and view test results in log analytics for Azure infrastructure components.

Explore the network diagnostic tools in network watcher, including IP flow verify, NSG diagnostics, next hop, effective security rules, VPN troubleshoot, packet capture, and connection troubleshoot.

Monitor the current state of your Azure network with NSG and VNet flow logs, tracking ingress and egress traffic and open ports for compliance and intrusion detection.

Explore Azure backup and recovery concepts, including recovery services vault and backup vault, their differences, and how to manage and restore backups with site recovery.

Use the recovery service vault to store backups and recovery points for Azure VMs, SQL in Azure, and Windows or Linux workloads. Define policies with frequency, retention, and instant restore.

The Mars agent, part of the Microsoft Azure Recovery Service, backs up files, folders, and system data on Windows machines. Maps provides on prem backup for VMs, applications, and databases.

Explore action groups in Azure Monitor to define alert notifications and automated responses, and study data collection rules and agents for metrics and logs to Azure Monitor or Log Analytics.

Review your full length exam experience and build confidence through practice with full length tests. Use more practice tests to master tougher questions, minute details, ARM templates, and JSON.