Microsoft · Exam reference
About the Microsoft AZ-104 exam
AZ-104 is the Microsoft Azure Administrator exam, the associate certification for people who run an Azure environment day to day. It covers identity and governance, storage, compute, virtual networking, and monitoring and backup. This course gives you practice questions, flashcards, interactive tasks and a full study guide mapped to the five official skill areas.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
Exam AZ-104 earns you the Microsoft Certified: Azure Administrator Associate credential. It is written for people who already run things in Azure: creating storage accounts, assigning RBAC roles, peering virtual networks, sizing virtual machines, and getting a Recovery Services vault to restore what it backed up. Microsoft gives you 100 minutes and requires a scaled score of 700 out of 1000. The five skill areas carry published weight ranges: identities and governance at 20 to 25 percent, storage at 15 to 20 percent, compute at 20 to 25 percent, virtual networking at 15 to 20 percent, and monitoring and maintenance at 10 to 15 percent. Compute and identity together account for close to half the exam, so time spent on Bicep files, scale sets, App Service plans and the scope of a role assignment pays back more than time spent anywhere else. The thing candidates underestimate is scope. Most governance questions turn on where a policy, lock or role assignment was applied: management group, subscription, resource group or resource. Get the inheritance wrong and the answer is wrong even when you know the service perfectly well. Role-based exams also let you search learn.microsoft.com during the test. That helps with a syntax question and does nothing for a question asking which NSG rule wins, which is why working through questions beats memorising portal blades. The skills measured were last updated on 17 April 2026. Every question, flashcard and chapter in this course follows that version of the blueprint.
Exam Domains Covered
Exam Format & Details
100 minutes. Scored on a scale of 1 to 1000, with 700 required to pass. Microsoft publishes no fixed question count and states that most of its certification exams contain 40 to 60 questions. Expect multiple choice alongside interactive item types: drag and drop, build list, active screen, hot area and case studies. Some sittings include hands-on labs, which Microsoft does not announce in advance. Booked through Pearson VUE, online or at a test centre, with the price set by the country you take it in. The certification expires after 12 months and is renewed at no cost by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
AZ-104 questions rarely ask what a service does. They give you a requirement and several configurations that all look reasonable, then ask which one meets it. A service endpoint and a private endpoint both restrict traffic to a storage account, and only one of them gives that account a private IP inside your virtual network. Practice questions are where you find out which distinctions you actually hold. Every explanation here says why the tempting wrong answer fails, so a question you miss teaches you the boundary between two options rather than just the name of the right one.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft AZ-104 exam — not actual exam content.
Q1.A team lead holds Contributor on rg-contoso-web. She tries to give a new engineer the Reader role on the same resource group and the portal blocks the save. What explains the failure?
- A.Contributor excludes write and delete operations under Microsoft.Authorization, so it cannot create role assignments
- B.Contributor is only valid at subscription scope and above
- C.The Reader role can only be granted by a Microsoft Entra Global Administrator
- D.Role assignments cannot be created at resource group scope
Domain: Manage Azure identities and governance
Q2.Destructive backup operations such as disabling soft delete or shortening retention must require approval from a security team that owns a separate subscription. What should be configured?
- A.Multi-user authorisation backed by a Resource Guard in the security team's subscription
- B.An immutable vault with the lock made irreversible
- C.Soft delete retention extended from 14 days to 180 days
- D.Backup alerts configured for deletions and policy changes
Domain: Monitor and maintain Azure resources
Q3.A connection to vm-db1 on TCP 1433 fails and the rule set spans a subnet group and an interface group. Which tool returns an Allow or Deny answer and names the specific rule responsible?
- A.IP flow verify
- B.Effective security rules
- C.Next hop
- D.Connection monitor
Domain: Implement and manage virtual networking
Q4.Management wants a monthly report of top talkers, open ports and unusual traffic patterns across the Contoso virtual networks, without anyone writing queries. Which combination produces it?
- A.Flow logs with Traffic Analytics enabled into a Log Analytics workspace
- B.Scheduled packet captures on each virtual machine
- C.Connection Monitor tests between every pair of subnets
- D.Network Insights topology view pinned to an Azure dashboard
Domain: Monitor and maintain Azure resources
Q5.Port 445 is blocked by the branch office internet provider and the share still has to be mounted from that branch. Select every workaround that addresses the block.
- A.A site-to-site VPN or ExpressRoute connection into the virtual network
- B.Switching the share from SMB 3.1.1 to SMB 2.1
- C.A private endpoint giving the share a private IP in the virtual network
- D.SMB over QUIC from a Windows Server 2022 or later machine
- E.Generating a service SAS for the file share
Domain: Implement and manage storage
Frequently Asked Questions
What is included in the free Microsoft AZ-104 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft AZ-104 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft AZ-104 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft AZ-104 course cover?
The course covers 5 exam domains: Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Implement and manage virtual networking, Monitor and maintain Azure resources.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.