In the full course
What you get
- 400 exam-style questions, each with a full explanation
- 20 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 26 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to Microsoft AZ-104
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
“The flashcards are underrated. I used them during my commute and it made a huge difference for the theory-heavy ITIL questions. Passed first try. Already using it again for CISM.”
AZ-104 is the Microsoft Azure Administrator exam, the associate certification for people who run an Azure environment day to day. It covers identity and governance, storage, compute, virtual networking, and monitoring and backup. This course gives you practice questions, flashcards, interactive tasks and a full study guide mapped to the five official skill areas.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
About the Microsoft AZ-104 Exam
Exam AZ-104 earns you the Microsoft Certified: Azure Administrator Associate credential. It is written for people who already run things in Azure: creating storage accounts, assigning RBAC roles, peering virtual networks, sizing virtual machines, and getting a Recovery Services vault to restore what it backed up. Microsoft gives you 100 minutes and requires a scaled score of 700 out of 1000. The five skill areas carry published weight ranges: identities and governance at 20 to 25 percent, storage at 15 to 20 percent, compute at 20 to 25 percent, virtual networking at 15 to 20 percent, and monitoring and maintenance at 10 to 15 percent. Compute and identity together account for close to half the exam, so time spent on Bicep files, scale sets, App Service plans and the scope of a role assignment pays back more than time spent anywhere else. The thing candidates underestimate is scope. Most governance questions turn on where a policy, lock or role assignment was applied: management group, subscription, resource group or resource. Get the inheritance wrong and the answer is wrong even when you know the service perfectly well. Role-based exams also let you search learn.microsoft.com during the test. That helps with a syntax question and does nothing for a question asking which NSG rule wins, which is why working through questions beats memorising portal blades. The skills measured were last updated on 17 April 2026. Every question, flashcard and chapter in this course follows that version of the blueprint.
Exam Domains Covered
- Manage Azure identities and governance24%
- Implement and manage storage19%
- Deploy and manage Azure compute resources24%
- Implement and manage virtual networking19%
- Monitor and maintain Azure resources14%
Exam Format & Details
100 minutes. Scored on a scale of 1 to 1000, with 700 required to pass. Microsoft publishes no fixed question count and states that most of its certification exams contain 40 to 60 questions. Expect multiple choice alongside interactive item types: drag and drop, build list, active screen, hot area and case studies. Some sittings include hands-on labs, which Microsoft does not announce in advance. Booked through Pearson VUE, online or at a test centre, with the price set by the country you take it in. The certification expires after 12 months and is renewed at no cost by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
AZ-104 questions rarely ask what a service does. They give you a requirement and several configurations that all look reasonable, then ask which one meets it. A service endpoint and a private endpoint both restrict traffic to a storage account, and only one of them gives that account a private IP inside your virtual network. Practice questions are where you find out which distinctions you actually hold. Every explanation here says why the tempting wrong answer fails, so a question you miss teaches you the boundary between two options rather than just the name of the right one.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft AZ-104 exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft AZ-104 exam, not actual exam content.
Q1.A team lead holds Contributor on rg-contoso-web. She tries to give a new engineer the Reader role on the same resource group and the portal blocks the save. What explains the failure?
- A.Contributor excludes write and delete operations under Microsoft.Authorization, so it cannot create role assignments
- B.Contributor is only valid at subscription scope and above
- C.The Reader role can only be granted by a Microsoft Entra Global Administrator
- D.Role assignments cannot be created at resource group scope
Domain: Manage Azure identities and governance
Q2.Destructive backup operations such as disabling soft delete or shortening retention must require approval from a security team that owns a separate subscription. What should be configured?
- A.Multi-user authorisation backed by a Resource Guard in the security team's subscription
- B.An immutable vault with the lock made irreversible
- C.Soft delete retention extended from 14 days to 180 days
- D.Backup alerts configured for deletions and policy changes
Domain: Monitor and maintain Azure resources
Q3.A connection to vm-db1 on TCP 1433 fails and the rule set spans a subnet group and an interface group. Which tool returns an Allow or Deny answer and names the specific rule responsible?
- A.IP flow verify
- B.Effective security rules
- C.Next hop
- D.Connection monitor
Domain: Implement and manage virtual networking
Q4.Management wants a monthly report of top talkers, open ports and unusual traffic patterns across the Contoso virtual networks, without anyone writing queries. Which combination produces it?
- A.Flow logs with Traffic Analytics enabled into a Log Analytics workspace
- B.Scheduled packet captures on each virtual machine
- C.Connection Monitor tests between every pair of subnets
- D.Network Insights topology view pinned to an Azure dashboard
Domain: Monitor and maintain Azure resources
Q5.Port 445 is blocked by the branch office internet provider and the share still has to be mounted from that branch. Select every workaround that addresses the block.
- A.A site-to-site VPN or ExpressRoute connection into the virtual network
- B.Switching the share from SMB 3.1.1 to SMB 2.1
- C.A private endpoint giving the share a private IP in the virtual network
- D.SMB over QUIC from a Windows Server 2022 or later machine
- E.Generating a service SAS for the file share
Domain: Implement and manage storage
Q6.One instance in a Uniform scale set runs a long licensing process that must not be removed when autoscale reduces the count, although the instance should still receive model updates. What should you configure?
- A.Apply instance protection from scale-in to that specific instance
- B.Set the scale-in policy on the scale set to OldestVM
- C.Set the scale-in policy on the scale set to NewestVM
- D.Delete the scale-in rules from the autoscale profile
Domain: Deploy and manage Azure compute resources
Q7.Contoso runs four identical web servers spread across zones 1, 2 and 3 in UK South. Which service level agreement does that arrangement meet?
- A.99.9 percent
- B.99.95 percent
- C.99.99 percent
- D.100 percent
Domain: Deploy and manage Azure compute resources
Q8.You are at a shell prompt with the Azure CLI already signed in to the contoso tenant and need to create one cloud-only account for Alice Wong. Which command does it?
- A.az ad user create --display-name "Alice Wong" --user-principal-name alicew@contoso.com --password "<initial-password>"
- B.az ad user create --display-name "Alice Wong" --email alicew@contoso.com
- C.az ad group create --display-name "Alice Wong" --mail-nickname alicew
- D.az account create --name "Alice Wong" --user alicew@contoso.com
Domain: Manage Azure identities and governance
Q9.vnet-spoke-app and vnet-spoke-data are each peered to vnet-hub-eastus, and both peerings are Connected. An application server in one spoke cannot reach a database in the other. What is required?
- A.Azure Firewall or a network virtual appliance in the hub, with user-defined routes on each spoke pointing at it
- B.Allow forwarded traffic enabled on all four peering configurations
- C.Allow gateway transit enabled on both spoke peerings
- D.A larger address space on the hub so it can carry both spoke ranges
Domain: Implement and manage virtual networking
Q10.A template defines storageSKU under parameters with a default of Standard_LRS, and storageName under variables built with concat and uniqueString. An operator deploying the template wants a different redundancy setting and a different account name. What can the operator actually change at deployment time?
- A.The redundancy only, because the name is a variable computed inside the template
- B.Both values, by supplying each of them in a parameter file
- C.The name only, because variables are evaluated last
- D.Neither value, because the template already has defaults
Domain: Deploy and manage Azure compute resources
Microsoft AZ-104 guides & exam news
How to Pass the Microsoft AZ-104 Exam in 2026: An 8-Week Azure Administrator Study Plan
A week-by-week plan to pass the Microsoft AZ-104 Azure Administrator exam in 2026, with the latest domain weightings, the April 2026 objective refresh, and a realistic study schedule that works around a full-time job.
SC-500 vs SC-200 in 2026: Which Microsoft Security Exam Should You Take?
SC-500 is for engineers who build and harden Azure, hybrid and AI workloads. SC-200 is for analysts who detect, investigate and respond. How the two 2026 exams differ, where their objectives overlap, and which to take first.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
Frequently Asked Questions
Does the Microsoft AZ-104 course include performance-based questions?
Yes. The Microsoft AZ-104 course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft AZ-104 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft AZ-104 course?
The full Microsoft AZ-104 course includes 400 practice questions and 20 performance-based tasks, covering all 5 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft AZ-104 course cover?
The course covers 5 exam domains: Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Implement and manage virtual networking, Monitor and maintain Azure resources.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full Microsoft AZ-104 course is $9.99, once.