Try Microsoft AZ-104
Get a taste before you commit — no account needed. Then a free account unlocks 25 questions with readiness tracking, no card required.
Get full access to Microsoft AZ-104
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
This course
$9.95
one-time
Monthly
$12.99
per month · all courses
Takes 30 seconds — create a free account, then straight to checkout. Already have an account? Sign in
Microsoft · Exam reference
About the Microsoft AZ-104 exam
AZ-104 is the Microsoft Azure Administrator exam, the associate certification for people who run an Azure environment day to day. It covers identity and governance, storage, compute, virtual networking, and monitoring and backup. This course gives you practice questions, flashcards, interactive tasks and a full study guide mapped to the five official skill areas.
10
Sample questions
100 min
Exam time limit
70%
Passing score
Exam AZ-104 earns you the Microsoft Certified: Azure Administrator Associate credential. It is written for people who already run things in Azure: creating storage accounts, assigning RBAC roles, peering virtual networks, sizing virtual machines, and getting a Recovery Services vault to restore what it backed up. Microsoft gives you 100 minutes and requires a scaled score of 700 out of 1000. The five skill areas carry published weight ranges: identities and governance at 20 to 25 percent, storage at 15 to 20 percent, compute at 20 to 25 percent, virtual networking at 15 to 20 percent, and monitoring and maintenance at 10 to 15 percent. Compute and identity together account for close to half the exam, so time spent on Bicep files, scale sets, App Service plans and the scope of a role assignment pays back more than time spent anywhere else. The thing candidates underestimate is scope. Most governance questions turn on where a policy, lock or role assignment was applied: management group, subscription, resource group or resource. Get the inheritance wrong and the answer is wrong even when you know the service perfectly well. Role-based exams also let you search learn.microsoft.com during the test. That helps with a syntax question and does nothing for a question asking which NSG rule wins, which is why working through questions beats memorising portal blades. The skills measured were last updated on 17 April 2026. Every question, flashcard and chapter in this course follows that version of the blueprint.
Exam Domains Covered
Exam Format & Details
100 minutes. Scored on a scale of 1 to 1000, with 700 required to pass. Microsoft publishes no fixed question count and states that most of its certification exams contain 40 to 60 questions. Expect multiple choice alongside interactive item types: drag and drop, build list, active screen, hot area and case studies. Some sittings include hands-on labs, which Microsoft does not announce in advance. Booked through Pearson VUE, online or at a test centre, with the price set by the country you take it in. The certification expires after 12 months and is renewed at no cost by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
AZ-104 questions rarely ask what a service does. They give you a requirement and several configurations that all look reasonable, then ask which one meets it. A service endpoint and a private endpoint both restrict traffic to a storage account, and only one of them gives that account a private IP inside your virtual network. Practice questions are where you find out which distinctions you actually hold. Every explanation here says why the tempting wrong answer fails, so a question you miss teaches you the boundary between two options rather than just the name of the right one.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft AZ-104 exam — not actual exam content.
Q1.A tenant nests security groups several levels deep. Which statements about nested group behaviour are correct? (Choose three.)
- A.An Azure role assignment on a parent group applies to members of nested child groups.
- B.A licence assigned to a parent group is applied only to its direct, first-level members.
- C.A group assigned to an enterprise application grants access only to first-level members.
- D.A dynamic group's membership can be extended by nesting another group inside it.
- E.Nested members receive group licences once Reprocess is run on the parent group.
- F.A Microsoft 365 group can hold devices when it is nested inside a security group.
Domain: Manage Azure identities and governance
Q2.Bulk invite was used to add auditors from fabrikam.com to the contoso tenant. The guest objects appear in All users, but the auditors report they have no access. Which are plausible explanations? (Choose three.)
- A.The auditors have not redeemed their invitations yet, so the objects exist but nobody is behind them.
- B.Collaboration restrictions carry an allow list that does not include fabrikam.com, so the invitations were refused.
- C.The auditors' own organisation blocks outbound collaboration with contoso.
- D.Bulk invite creates the accounts without sending any email, so no invitation ever reached them.
- E.Guest accounts cannot be added to security groups, so no access can be granted to them.
- F.Each guest needs a Microsoft Entra ID P1 licence before an invitation can be redeemed.
Domain: Manage Azure identities and governance
Q3.A contractor holds Reader through sg-app-readers, Contributor assigned directly on rg-contoso-identity, and membership of a Microsoft 365 group with its own SharePoint site. The contract has ended and every trace of their access must be removed. Which actions are required? (Choose three.)
- A.Remove the Contributor role assignment on rg-contoso-identity.
- B.Remove the contractor from sg-app-readers and from the Microsoft 365 group.
- C.Delete the guest account, which is the only action that removes it from the directory.
- D.Remove the Contributor assignment only, because deleting it revokes the group-based access as well.
- E.Set Block sign in to Yes, which removes the account from the directory.
- F.Wait 30 days, after which unused guest accounts are removed automatically.
Domain: Manage Azure identities and governance
Q4.An administrator opens Access control (IAM) on the resource group rg-contoso-prod, selects Add > Add role assignment, picks the Virtual Machine Contributor role and adds the group grp-vm-ops. Which three components make up the assignment that was created?
- A.Security principal, role definition and scope
- B.Security principal, permission set and resource provider
- C.Role definition, deny assignment and scope
- D.Subscription, action string and management group
Domain: Manage Azure identities and governance
Q5.The management group mg-contoso-platform contains sub-contoso-prod and sub-contoso-dev. A monitoring team is assigned Reader at mg-contoso-platform. What can the team see?
- A.Every resource in both subscriptions, because assignments inherit down to all child scopes
- B.Only the management group object and its properties
- C.Nothing, until Reader is also assigned at each subscription
- D.Only resources created in the two subscriptions after the assignment was made
Domain: Manage Azure identities and governance
Frequently Asked Questions
What is included in the free Microsoft AZ-104 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft AZ-104 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft AZ-104 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft AZ-104 course cover?
The course covers 5 exam domains: Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Implement and manage virtual networking, Monitor and maintain Azure resources.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.