Azure Administrator Exam Topics Explained

A domain-by-domain breakdown of the AZ-104 skills measured — identity, storage, compute, networking and monitoring — and what each one actually tests.

Daniel Carter27 July 2026 · 11 min read

Ask AIChatGPT Claude Gemini Copilot Perplexity Grok

Five illustrated tiles representing the AZ-104 exam domains: identity and governance, storage, compute, networking, and monitoring

The AZ-104 exam tests five skills-measured domains: managing Azure identities and governance, implementing and managing storage, deploying and managing Azure compute resources, implementing and managing virtual networking, and monitoring and maintaining Azure resources. Microsoft publishes the official domain percentage weightings in the AZ-104 study guide (aka.ms/AZ104-StudyGuide), and the exam content was last updated on 17 April 2026, so always cross-check that guide before you build a revision list.

This article unpacks what each of those five domains actually asks of you — the services involved, the tasks Microsoft expects you to perform, and the sub-topics that candidates most often underestimate. It deliberately stops at the boundary of the syllabus itself: if you want a week-by-week preparation schedule, that lives in our AZ-104 study plan, and guidance on using mock exams effectively is covered in our AZ-104 practice test strategy.

What the AZ-104 exam covers at a glance

Exam AZ-104, Microsoft Azure Administrator, is the single exam required for the Microsoft Certified: Azure Administrator Associate certification. It is a proctored, 100-minute exam that may include interactive components alongside conventional question types, delivered through Pearson VUE either at a test centre or via online proctoring. The passing score is 700 on a scale of 1 to 1,000 — a scaled score, not 70% — and Microsoft does not publish the number of questions on the exam.

The five domains, as named in the official skills outline, are:

Manage Azure identities and governance
Implement and manage storage
Deploy and manage Azure compute resources
Implement and manage virtual networking
Monitor and maintain Azure resources

Microsoft keeps the exact percentage weighting of each domain in the official study guide rather than on the certification page, and those weightings shift when the exam is refreshed. Rather than quoting numbers that may be superseded, treat all five domains as examinable in depth and check the current split at aka.ms/AZ104-StudyGuide before you sit the exam.

One framing point before the detail: AZ-104 is an administrator's exam, not an architect's. Across every domain, the questions lean towards doing — configuring, deploying, troubleshooting, assigning — through the Azure portal, Azure PowerShell, the Azure CLI, and Azure Resource Manager (ARM) templates or Bicep. Microsoft formally recommends hands-on experience with all of these tools, and the phrasing of the skills outline ("configure", "create", "manage", "implement") reflects that operational focus.

Domain 1: Manage Azure identities and governance

This domain covers who can do what in an Azure environment, and the guardrails that keep a subscription tidy and compliant. It centres on Microsoft Entra ID — the identity platform formerly known as Azure Active Directory — plus Azure's governance layer.

Identity: users, groups and Entra ID

Expect to demonstrate that you can create and manage users and groups, handle group membership types, manage licences, and configure user and device properties. External collaboration (guest accounts) and self-service password reset sit in this space too. The recurring theme is administration at scale: not just "create a user", but understanding how dynamic groups, administrative units and bulk operations keep a directory manageable.

Access: RBAC and built-in roles

Role-based access control (RBAC) is one of the most heavily connected topics in the whole syllabus, because it touches storage, compute and networking scenarios as well. You need to know how role assignments combine a security principal, a role definition and a scope; how scope inheritance flows from management group to subscription to resource group to resource; and when to use built-in roles rather than creating custom ones. Interpreting an existing set of assignments — "can this user restart this virtual machine?" — is a classic administrator task this domain represents well.

Governance: subscriptions, Azure Policy, locks and tags

The governance half of the domain covers the structures that sit above individual resources: management groups and subscriptions, resource groups, tags for organisation and cost tracking, resource locks that prevent accidental deletion or modification, and Azure Policy for enforcing standards (allowed regions, required tags, permitted SKUs). Moving resources between resource groups and subscriptions, with the constraints that apply, is a practical sub-topic that catches out candidates who have only ever worked in a single sandbox subscription.

Domain 2: Implement and manage storage

The storage domain is narrower in surface area than identity but deep in configuration detail. It revolves around Azure storage accounts and the services inside them.

Storage accounts and secure access

You should be comfortable creating and configuring storage accounts: choosing redundancy options (locally redundant through to geo-redundant variants), configuring firewalls and virtual network rules, and managing access. Access control is a major sub-theme — shared access signatures (SAS), stored access policies, access keys and key rotation, and identity-based access all appear in the outline. The exam-relevant skill is matching the access mechanism to the scenario: a time-limited SAS for a third party, Entra ID-based authorisation for internal applications, and so on.

Blob storage, Azure Files and data movement

Within the account, expect blob-specific configuration: containers, access tiers (hot, cool, archive), lifecycle management policies that shift or expire data automatically, and features such as soft delete and versioning. Azure Files brings its own thread — file shares, and the scenarios where a managed SMB share replaces a traditional file server. Finally, the domain includes moving data: tools such as AzCopy and Storage Explorer, and knowing which fits a given migration or transfer scenario.

Domain 3: Deploy and manage Azure compute resources

This is the domain most candidates picture when they think "Azure administrator", and it rewards genuine hands-on time more than any other.

Virtual machines from every angle

Virtual machine (VM) coverage spans the full lifecycle: creating VMs with appropriate sizes and disk types, configuring availability (availability sets, availability zones), resizing and redeploying, managing disks and encryption, and connecting securely. Automation is woven through it — deploying VMs from ARM templates or Bicep files, and using scale sets when a workload needs identical instances that grow and shrink with demand. Reading and lightly modifying a template is a realistic expectation; you are not asked to be a full-time infrastructure-as-code developer, but you cannot afford to find template JSON or Bicep syntax alien.

Containers and App Service

Compute in AZ-104 is broader than VMs. The outline includes container-based options — running containers without managing full VM infrastructure, and the basics of Azure's container services — plus Azure App Service for web applications: creating App Service plans, understanding how plan tiers affect features and scaling, and configuring deployment and settings for a web app. The skill being tested is selection as much as configuration: given a workload description, which compute service fits, and what are the cost and management consequences?

Domain 4: Implement and manage virtual networking

Networking is widely reported by candidates as the most demanding part of AZ-104, largely because misconfigurations here produce subtle, indirect symptoms. The domain covers the connectivity fabric that everything else runs on.

Core networking: virtual networks, subnets, IP and DNS

Foundational tasks include creating virtual networks and subnets, planning IP address ranges, configuring public and private IP addresses, and setting up name resolution with Azure DNS or private DNS zones. Virtual network peering — connecting networks so resources can communicate — is a staple sub-topic, along with understanding what peering does and does not provide by default.

Securing traffic: NSGs and service endpoints

Network security groups (NSGs) are the packet-filtering layer, and you should be able to read a rule set and predict whether given traffic will be allowed or denied — priority order, default rules and the effect of associating an NSG at subnet versus network-interface level all matter. The outline also covers options for private connectivity to Azure platform services, so that traffic to storage or databases does not traverse the public internet.

Load balancing and connectivity troubleshooting

The domain includes distributing traffic with Azure Load Balancer and understanding when a different service is the better fit, plus diagnosing connectivity problems with Azure's network monitoring and diagnostic tooling. Troubleshooting questions are where the interactive exam components can bite: they simulate the kind of "the VM cannot reach the database — why?" investigation an administrator does weekly.

If your interest in networking runs deeper than administration — hybrid connectivity design, advanced routing, application delivery at scale — that is the territory of the dedicated networking exam; see the AZ-700 Azure network engineering exam page for what that credential covers.

Domain 5: Monitor and maintain Azure resources

The final domain closes the operational loop: once resources exist, an administrator keeps them observable, recoverable and healthy.

Azure Monitor, alerts and Log Analytics

Expect coverage of Azure Monitor as the umbrella service: collecting metrics and logs, configuring alerts and action groups so the right people are notified when thresholds are crossed, and querying collected data in Log Analytics. You do not need to be a Kusto Query Language expert at administrator level, but you should be able to interpret straightforward queries and know where different types of telemetry land.

Backup and recovery

The maintenance half covers Azure Backup — protecting VMs and files, configuring backup policies and vaults, and performing restores — together with Azure Site Recovery concepts for keeping workloads available when a region or site fails. Questions in this space tend to be scenario-led: given a recovery requirement, which combination of backup policy and replication meets it?

How the exam actually presents these topics

Knowing the topic list is necessary but not sufficient; it helps to understand how AZ-104 tests it.

Questions cross domain boundaries. A single scenario may involve an NSG (networking), a VM (compute) and a role assignment (identity). The five domains organise the syllabus, not the questions.
Interactive components appear. Microsoft states the exam may include interactive question styles beyond multiple choice, and the official Exam Sandbox demonstrates the formats — worth exploring before test day so no format is a surprise.
Tooling is assumed, not siloed. PowerShell, the CLI, the portal and ARM/Bicep can all surface in any domain. If you have only ever clicked through the portal, command-line syntax questions will feel harder than they should.
Scoring is scaled. The 700 passing mark is not "70% of questions correct", and Microsoft does not publish question counts — so ignore folklore about needing a specific number of correct answers.

As of 2026, the exam fee varies by the country or region in which it is proctored (third-party sources commonly cite around US$165 for associate-level Microsoft exams in the United States — confirm the current price for your country on the official exam page). The certification is valid for 12 months and renews free of charge through an online, unproctored assessment on Microsoft Learn.

Which topics deserve disproportionate attention?

All five domains are examinable, but three patterns emerge consistently from the structure of the outline itself:

RBAC and scope inheritance connect to nearly everything. A shaky grasp of roles and scopes costs you marks in storage, compute and networking questions, not just identity ones.
Networking rewards prediction, not recognition. Being able to define an NSG is recognition; being able to trace why traffic is blocked across peered networks with layered rules is prediction. The exam wants the latter.
The "quiet" topics punish neglect. Lifecycle management policies, resource locks, moving resources between subscriptions, SAS token behaviour — small topics that get one bullet in the outline but are cheap marks for candidates who covered them and lost marks for those who skimmed.

A useful self-audit: take the five domain names and, for each, write down three tasks you could perform right now in a live subscription without documentation. Any domain where you struggle to list three is a genuine gap, whatever your reading notes say. For checking your knowledge question-by-question once you have studied, ExamPractice's AZ-104 exam page offers free sample practice questions mapped to this exam, with fuller sets and timed simulation available to subscribers.

Topics people expect on AZ-104 that are not centre-stage

Part of understanding a syllabus is knowing its edges:

Architecture and design decisions — choosing regions for a global rollout, designing governance hierarchies from scratch — belong to the Azure Solutions Architect exam (AZ-305), for which AZ-104 is the mandatory prerequisite certification.
Deep security engineering — threat protection tooling and security operations — sits beyond administrator scope in the security certification track.
Cloud concepts and billing basics are assumed knowledge, tested at fundamentals level in AZ-900 rather than re-tested here.

Whether you should sit AZ-900 before attempting AZ-104 is a separate decision — our comparison of Azure Fundamentals vs Azure Administrator covers it — and the broader career value of the certification is weighed in Is the Azure Administrator Certification Worth It?

Frequently asked questions

How many questions are on the AZ-104 exam?

Microsoft does not publish question counts for its exams; any specific number you see online is unofficial. What is official: you have 100 minutes, the exam may include interactive components, and the passing score is 700 on a 1–1,000 scale.

How often do the AZ-104 exam topics change?

Microsoft revises its exams periodically; the AZ-104 content was last updated on 17 April 2026. The certification page and study guide list the current version and a change log, so re-check them if your study materials are more than a few months old.

Do the exam topics require PowerShell and CLI knowledge, or is the portal enough?

The official recommendation is experience with the portal, Azure PowerShell, the Azure CLI and ARM templates or Bicep. Treat all four as in scope: questions can present tasks or snippets in any of them, in any domain.

Are there prerequisites before I can register for AZ-104?

No. There is no required prior exam or certification — AZ-900 is optional context, not a gate. Microsoft recommends practical Azure administration experience rather than any formal prerequisite.

From topic list to test readiness

The AZ-104 syllabus rewards candidates who treat it as a set of jobs to perform rather than facts to memorise: manage identities and governance, run storage, operate compute, connect and secure networks, and keep it all monitored and recoverable. Read the official study guide for the current weightings, then measure yourself against tasks, not pages read — the three-tasks-per-domain audit above is a harsher and more honest test than a highlighted PDF.

When you are ready to turn this topic map into a calendar, the week-by-week AZ-104 study plan sequences these domains into a preparation timeline, and the practice test strategy guide explains how to verify each domain is actually sticking.

Exam facts in this guide were checked against official certification-provider pages on 30 August 2026. Fees, exam codes and policies change — confirm on the provider’s own site before you book.