AZ-104 Microsoft Azure Administrator - Complete Exam Prep

Provide a high-level overview of Azure services, highlighting virtual machines, virtual networking, and storage, plus Microsoft Entra identity, and explain how these core components underpin the exam objectives.

Explore azure compute with virtual machines and app services, covering IaaS deployment of Windows or Linux VMs, virtual networks, availability options, and auto-scaling for web apps.

Explore unmanaged storage accounts, scalable to petabytes with blobs, queues, tables, and file shares, plus redundancy and access tiers; examine relational SQL and non-relational data services like Cosmos DB.

Explore microservices and serverless patterns in Azure, using containers, Azure Container Apps, API management, and event-driven functions, while mastering connectivity, security, delivery, and monitoring in cloud networking.

Explore PowerShell and Bash CLI scripting to automate Azure resources, read JSON outputs, and prepare for performance-based and code-reading questions on the AZ-104 exam.

Master the predictable az command pattern to guess Azure CLI tasks. Try az vm list and az vm create in Cloud Shell, and explore Get-AzVM in PowerShell.

Learn to use PowerShell 7 and the CLI across platforms, install and update the AZ module, and connect to Azure via cloud shell or local PowerShell.

Install PowerShell 7 on Windows 11, update the Az module to the latest release, and log into Azure with Connect-AzAccount to list resource groups using Get-AzResourceGroup.

Switch between multiple Azure subscriptions in PowerShell by listing subscriptions with Get-AzSubscription and selecting one with Set-AzContext using its ID, making subsequent actions apply to the chosen tenant.

Explore Microsoft Entra ID, the cloud-native identity service derived from Microsoft Active Directory, and learn how to manage users, groups, and applications with OAuth and SAML in hybrid environments.

Compare Entra ID pricing tiers—free, P1, and P2—and summarize which features are included (authentication, SSO, cloud sync) and which are restricted (SLA, advanced reporting, conditional access, self-service password reset, governance).

Learn how to manage multiple tenants, understand the relationship between accounts, tenants, and subscriptions, and assign roles to users while using managed identities for applications.

Understand the updated process for creating Microsoft Entra ID tenants and how paid licenses affect tenant creation, with B2C tenants as the option when a paid subscription isn't available.

Create a brand new Azure Active Directory tenant and become the global administrator. Choose a unique domain and region, and understand where the tenant's resources are stored.

Discover how to switch between Entra ID tenants using manage tenants or switch directory, understand the global administrator role in Azure AD, and navigate tenant licenses and user management.

Compare the free Azure Active Directory with premium P2, noting limits on custom roles, and learn to start a 30-day trial for extra multifactor authentication options and AI security features.

Learn how to upgrade from a free trial to Entra ID premium P2 in the Azure admin center, including tenant switching, global administrator setup, and purchasing licenses.

Add a custom domain to your Azure tenant by verifying ownership with a TXT or MX DNS record at your registrar, then set it as primary for user creation.

Create and manage Azure AD / Microsoft Entra ID users, assign domains, log in with unique usernames and auto-generated passwords, view and edit properties, and delete users.

Create and manage Azure AD groups to organize students and teachers with security and dynamic membership. Assign roles to groups and use bulk operations and access reviews with audit logs.

Manage Azure AD licenses, compare free, P1, and P2 tiers, and assign licenses to users for features like self-service password reset, multifactor authentication for admin roles, and privileged identity management.

Demonstrate administrative units to segregate Azure Active Directory permissions, letting a teacher act as a password administrator for a specific classroom, e.g., classroom 1 with student 1.

Understand how Azure AD tracks and manages devices—view device status (managed vs unmanaged), apply conditional access, and enforce multifactor authentication and BitLocker key management.

Explore bulk operations in Azure Active Directory, using a CSV template to bulk create users and assign group memberships, enabling rapid handling of large datasets.

Invite external guests as guest users to collaborate on resources, assign permissions and roles, enforce multifactor authentication and conditional access, and join via emailed invitations.

Explore self-service password reset in Azure Active Directory, enabling group-based resets with licenses and requiring multifactor authentication.

Explore role-based access control (rbac) in Azure, and learn how assigning permissions to roles simplifies management, enforces least privilege, and reduces risk by avoiding one-off permissions.

Explore Azure Active Directory administrative roles, including built-in roles like Application Administrator, Global Administrator, and Global Reader, and distinguish admin versus reader permissions, license administration, and RBAC usage.

Learn to manage permissions for resources like web apps, virtual machines, and containers with Azure AD and RBAC, including switching a storage account from access keys to Azure AD authorization.

Disable storage account key access and enable Azure AD access, then grant myself storage blob owner to manage containers and data.

Assign container-level permissions in Azure blob storage using AD user authentication and data owner permissions. Grant data reader access to teachers on a container, with scope from container to subscription.

Explore creating custom Azure roles to tailor permissions, such as cloning a storage blob data contributor role and removing delete rights, and assign at subscription or resource group scope.

Enforce resource group scope to assign development and production access using roles like full contributor and reader, and note that permissions merge and deny assignments require blueprints mapping to subscriptions.

Interpret access assignments in the Azure portal by examining role assignments across resource groups and subscriptions, and compare Azure AD roles to Azure roles.

Understand how an Azure account, a tenant, a subscription, and a resource group organize access, billing, and resources within an organization, including authentication via Azure Active Directory and roles.

Explore how Azure subscriptions act as the billing unit, link to a single tenant while supporting multiple subscriptions and types like pay-as-you-go, with RBAC, cost analysis, invoices, and quotas.

Explore Azure cost management by analyzing spending with cost analysis, setting budgets and alerts, understanding anomalies, and leveraging the advisor for subscription cost recommendations.

Apply resource locks at subscription, resource group, or single resource levels to prevent deletions or modifications, using delete locks or read-only locks with controlled access.

Apply and enforce Azure policy by defining allowed locations and assigning to a scope, restricting resource deployments to approved regions within a resource group, subscription, or management group.

Azure policy restricts resources to approved regions, causing validation to fail for disallowed regions such as Japan, and enabling deployment only in regions like East US.

Create a custom Azure policy from a JSON template to enforce https encryption on storage accounts, duplicating definitions and assigning with an adjustable effect (deny or audit) at subscription scope.

Discover how to create and apply resource tags as metadata to define environment, billing codes, and contact details, and use Azure Policy with tags for cost analysis and resource management.

Move resources between regions, subscriptions, or resource groups; disks are copied, not moved, and verify support in the resource mover documentation.

Automate azure governance by using PowerShell in Cloud Shell to assign a policy to a resource group, retrieving the policy definition and applying it with a scoped policy assignment.

Explore Azure subscriptions and management groups to organize billing across departments and clients; create, nest, and assign subscriptions within a root group, set budgeting, owners, and billing plans.

Learn to create an Azure storage account by selecting subscription, resource group, and a unique name, choosing a region, and noting blob storage and data residency considerations.

Explore Azure storage redundancy options, including locally redundant storage, zone-redundant storage, geo-redundant storage, and geo-zone redundant storage. Understand how three copies across data centers and regions influence availability and cost.

Explore advanced storage account options in the Azure portal, including secure transfer, anonymous access, keys vs Entra RBAC, Data Lake Gen2, and blob access tiers.

Analyze hot, cool, cold, and archive access tiers for storage accounts, compare monthly storage vs access costs, and learn to move files between tiers with lifecycle automation.

Discover how storage accounts default to public internet access and how to restrict exposure using virtual networks, subnets, public IP allowances, private endpoints via private links, and Microsoft network routing.

Review data protection options in the storage account setup, including point-in-time restore, soft delete, versioning, and immutability. Use change feed and access control to manage retention and recovery.

Choose who manages storage encryption by default using Microsoft-managed keys with Transparent Data Encryption, or switch to customer-managed keys stored in Key Vault; consider enabling infrastructure encryption for added security.

Learn to finalize an azure storage account deployment via review and create, validate settings, and deploy with Azure Resource Manager, then explore containers, blobs, and access keys.

Explore how a general-purpose v2 storage account stores blobs in containers and files, with versioning, access tiers, and private access, setting up for access keys and shared access signature.

Discover how to use storage account access keys and shared access signatures to grant secure, time-bounded read access, rotate keys, and revoke tokens.

Explore stored access policies to centrally manage sas token permissions, start and expiry times, and reuse policies across tokens for containers and files.

Switch from access keys to Entra ID RBAC for storage accounts, enabling fine-grained access at account or container levels with roles like Storage Blob Data Contributor, and improving long-term control.

Explore storage account lifecycle management to move blobs to cooler, cold, or archive storage as they age, with rules and minimum storage duration charges.

Explore object replication in Azure storage to copy asynchronously from a source account to a destination across regions or subscriptions, with rules to copy only new objects or all objects.

Learn to copy files between Azure storage accounts or from local to storage using AzCopy v10, with SAS tokens or RBAC, for efficient command-line transfers across Windows, Linux, and macOS.

Navigate the storage browser to manage blob containers and file shares, copy and paste files, clone items, and generate SAS when enabled; learn desktop access with Azure Storage Explorer.

Create Azure file shares to host a cloud file server with SMB and NFS, and learn about backups, Azure file sync, and AD authentication.

Create and manage point-in-time snapshots of Azure file shares to recover deleted or modified files, stored as incremental backups in the same storage account, manually or via backup policy.