Microsoft
Free Microsoft AZ-104 Practice Questions
The Microsoft AZ-104 exam is up to 50 questions in 100 minutes. CertCrush provides 400 syllabus-aligned practice questions and 20 performance-based questions across all 5 exam domains, each with a full explanation. Free to try, no account required.
AZ-104 is the Microsoft Azure Administrator exam, the associate certification for people who run an Azure environment day to day. It covers identity and governance, storage, compute, virtual networking, and monitoring and backup. This course gives you practice questions, flashcards, interactive tasks and a full study guide mapped to the five official skill areas.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
About the Microsoft AZ-104 Exam
Exam AZ-104 earns you the Microsoft Certified: Azure Administrator Associate credential. It is written for people who already run things in Azure: creating storage accounts, assigning RBAC roles, peering virtual networks, sizing virtual machines, and getting a Recovery Services vault to restore what it backed up. Microsoft gives you 100 minutes and requires a scaled score of 700 out of 1000. The five skill areas carry published weight ranges: identities and governance at 20 to 25 percent, storage at 15 to 20 percent, compute at 20 to 25 percent, virtual networking at 15 to 20 percent, and monitoring and maintenance at 10 to 15 percent. Compute and identity together account for close to half the exam, so time spent on Bicep files, scale sets, App Service plans and the scope of a role assignment pays back more than time spent anywhere else. The thing candidates underestimate is scope. Most governance questions turn on where a policy, lock or role assignment was applied: management group, subscription, resource group or resource. Get the inheritance wrong and the answer is wrong even when you know the service perfectly well. Role-based exams also let you search learn.microsoft.com during the test. That helps with a syntax question and does nothing for a question asking which NSG rule wins, which is why working through questions beats memorising portal blades. The skills measured were last updated on 17 April 2026. Every question, flashcard and chapter in this course follows that version of the blueprint.
Exam Domains Covered
Exam Format & Details
100 minutes. Scored on a scale of 1 to 1000, with 700 required to pass. Microsoft publishes no fixed question count and states that most of its certification exams contain 40 to 60 questions. Expect multiple choice alongside interactive item types: drag and drop, build list, active screen, hot area and case studies. Some sittings include hands-on labs, which Microsoft does not announce in advance. Booked through Pearson VUE, online or at a test centre, with the price set by the country you take it in. The certification expires after 12 months and is renewed at no cost by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
AZ-104 questions rarely ask what a service does. They give you a requirement and several configurations that all look reasonable, then ask which one meets it. A service endpoint and a private endpoint both restrict traffic to a storage account, and only one of them gives that account a private IP inside your virtual network. Practice questions are where you find out which distinctions you actually hold. Every explanation here says why the tempting wrong answer fails, so a question you miss teaches you the boundary between two options rather than just the name of the right one.
Try Microsoft AZ-104
Get a taste before you commit — no account needed. Then a free account unlocks 25 questions with readiness tracking, no card required.
Get full access to Microsoft AZ-104
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Monthly
$12.99
per month · all courses
Takes 30 seconds — create a free account, then straight to checkout. Already have an account? Sign in
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft AZ-104 exam — marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft AZ-104 exam — not actual exam content.
Q1.A contractor holds Reader through sg-app-readers, Contributor assigned directly on rg-contoso-identity, and membership of a Microsoft 365 group with its own SharePoint site. The contract has ended and every trace of their access must be removed. Which actions are required? (Choose three.)
- A.Remove the Contributor role assignment on rg-contoso-identity.
- B.Remove the contractor from sg-app-readers and from the Microsoft 365 group.
- C.Delete the guest account, which is the only action that removes it from the directory.
- D.Remove the Contributor assignment only, because deleting it revokes the group-based access as well.
- E.Set Block sign in to Yes, which removes the account from the directory.
- F.Wait 30 days, after which unused guest accounts are removed automatically.
Domain: Manage Azure identities and governance
Q2.An administrator opens Access control (IAM) on the resource group rg-contoso-prod, selects Add > Add role assignment, picks the Virtual Machine Contributor role and adds the group grp-vm-ops. Which three components make up the assignment that was created?
- A.Security principal, role definition and scope
- B.Security principal, permission set and resource provider
- C.Role definition, deny assignment and scope
- D.Subscription, action string and management group
Domain: Manage Azure identities and governance
Q3.The management group mg-contoso-platform contains sub-contoso-prod and sub-contoso-dev. A monitoring team is assigned Reader at mg-contoso-platform. What can the team see?
- A.Every resource in both subscriptions, because assignments inherit down to all child scopes
- B.Only the management group object and its properties
- C.Nothing, until Reader is also assigned at each subscription
- D.Only resources created in the two subscriptions after the assignment was made
Domain: Manage Azure identities and governance
Q4.Azure RBAC scope levels are arranged as parent and child. Which sequence lists them from broadest to narrowest?
- A.Management group, subscription, resource group, resource
- B.Subscription, management group, resource group, resource
- C.Tenant, management group, subscription, resource group
- D.Management group, subscription, resource, resource group
Domain: Manage Azure identities and governance
Q5.A team lead holds Contributor on rg-contoso-web. She tries to give a new engineer the Reader role on the same resource group and the portal blocks the save. What explains the failure?
- A.Contributor excludes write and delete operations under Microsoft.Authorization, so it cannot create role assignments
- B.Contributor is only valid at subscription scope and above
- C.The Reader role can only be granted by a Microsoft Entra Global Administrator
- D.Role assignments cannot be created at resource group scope
Domain: Manage Azure identities and governance
Q6.An external auditor must view the configuration of every resource in sub-contoso-prod for four weeks and must not change anything. Which built-in role, whose definition is a single Actions entry of */read, fits the requirement?
- A.Reader
- B.Contributor
- C.Storage Blob Data Reader
- D.User Access Administrator
Domain: Manage Azure identities and governance
Q7.A support engineer holds Owner on the storage account stcontosoprod. Signed in with her own Microsoft Entra credentials, she can change the account's networking settings but gets an authorisation failure when she opens a container and tries to view a blob. Which assignment resolves it?
- A.Storage Blob Data Reader on stcontosoprod
- B.Reader on stcontosoprod
- C.Contributor on sub-contoso-prod
- D.User Access Administrator on stcontosoprod
Domain: Manage Azure identities and governance
Q8.A Global Administrator must temporarily view and repair role assignments across every subscription and management group in the Contoso tenant, including ones nobody has granted her access to. What should she do?
- A.Set Access management for Azure resources to Yes in Microsoft Entra ID > Properties
- B.Assign herself Owner at the root management group from Access control (IAM)
- C.Create a custom role with / in AssignableScopes and assign it to herself
- D.Assign herself the Global Administrator role at each subscription scope
Domain: Manage Azure identities and governance
Q9.Two administrators hold Owner on sub-contoso-prod. One of them has twice deleted the production virtual machine vm-contoso-sql01 by mistake. What should be configured to stop the deletion while leaving both Owner assignments in place?
- A.A CannotDelete resource lock on vm-contoso-sql01
- B.A deny assignment on vm-contoso-sql01 for both administrators
- C.A Reader assignment for both administrators on vm-contoso-sql01
- D.A NotActions entry for the delete operation added to the Owner definition
Domain: Manage Azure identities and governance
Q10.An engineer authors a custom role definition in JSON with "AssignableScopes": [ "/" ] so that it can be used anywhere in the tenant. The create command is rejected. Why?
- A.Custom roles are not allowed to use the root scope /, so AssignableScopes must list real management groups, subscriptions or resource groups
- B.Custom roles must be cloned from a built-in role in the portal rather than written as JSON
- C.A custom role definition must contain at least one DataActions entry
- D.The tenant limit of 5,000 custom roles applies to every definition using the root scope
Domain: Manage Azure identities and governance
Microsoft AZ-104 guides & exam news
How to Pass the Microsoft AZ-104 Exam in 2026: An 8-Week Azure Administrator Study Plan
A week-by-week plan to pass the Microsoft AZ-104 Azure Administrator exam in 2026, with the latest domain weightings, the April 2026 objective refresh, and a realistic study schedule that works around a full-time job.
Microsoft AB-410 Exam Topics, Cost and Difficulty: The PL-200 Replacement Explained (2026)
PL-200 retires on 31 August 2026 and AB-410 takes its place. Here are the official AB-410 skills measured with domain weightings, the pass mark, the cost, and an honest read on how the difficulty compares.
Microsoft AZ-900 Practice Questions: 25 Exam-Style Examples With Answers and Explanations (2026 Objectives)
Twenty-five free AZ-900 practice questions written to the objectives Microsoft published on 20 July 2026, split across the three domains in their real exam proportions, with a full explanation of the correct answer and every distractor.
Frequently Asked Questions
Does the Microsoft AZ-104 course include performance-based questions?
Yes. The Microsoft AZ-104 course includes 20 performance-based questions (PBQs) — hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft AZ-104 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft AZ-104 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft AZ-104 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft AZ-104 course cover?
The course covers 5 exam domains: Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Implement and manage virtual networking, Monitor and maintain Azure resources.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.