- What the AZ-104 Exam Actually Tests
- Domain 1: Manage Azure Identities and Governance (20-25%)
- Domain 2: Implement and Manage Storage (15-20%)
- Domain 3: Deploy and Manage Azure Compute Resources (20-25%)
- Domain 4: Implement and Manage Virtual Networking (15-20%)
- Domain 5: Monitor and Maintain Azure Resources (10-15%)
- How Domain Weights Should Shape Your Prep
- Exam Format, Scoring, and Registration Facts
- A Domain-Aligned Study Schedule
- Frequently Asked Questions
- AZ-104 has five official domains; identities/governance and compute are each weighted at 20-25%, making them the highest-priority areas.
- The passing score is 700 on Microsoft's scaled model - not a simple 70% raw score.
- Candidates typically see 40-60 questions in 100 minutes, including interactive item types and possible performance-based lab tasks.
- Skills measured reflect the April 17, 2026 study guide; verify you are studying the current version before exam day.
What the AZ-104 Exam Actually Tests
The AZ-104 Certification - Microsoft Certified: Azure Administrator Associate - is structured around five content domains that map directly to the day-to-day responsibilities of an Azure administrator. Microsoft publishes these domains with explicit percentage weight ranges, which means you know in advance exactly where questions will concentrate. That transparency is rare in enterprise certification, and it makes strategic preparation far more effective than generic studying.
Before diving into each domain, it helps to understand what What Is AZ-104 means in practice. This is not a conceptual architecture exam. Microsoft expects candidates to configure, troubleshoot, and administer real Azure workloads - through the portal, via Azure CLI, through PowerShell, and using ARM templates or Bicep. The exam reflects that breadth by mixing traditional multiple-choice questions with drag-and-drop, hot-area, build-list, case study, and potentially performance-based lab tasks in the same appointment.
The five domains are not equal in weight. Two domains - identities/governance and compute - each carry 20-25% of the exam. Two more - storage and virtual networking - each carry 15-20%. The fifth domain, monitoring and maintenance, carries 10-15%. Knowing these numbers lets you invest study time proportionally rather than spreading effort evenly across all topics.
Domain 1: Manage Azure Identities and Governance (20-25%)
This is one of the two heaviest domains on the exam. For a full breakdown of every subtopic, see the dedicated AZ-104 Domain 1: Manage Azure identities and governance (20-25%) - Complete Study Guide 2026. Here is what candidates must understand at the operational level.
Domain 1: Manage Azure Identities and Governance
Covers Microsoft Entra ID (formerly Azure Active Directory), role-based access control, subscriptions, management groups, and policy enforcement across Azure environments.
- Create and manage users, groups, and service principals in Microsoft Entra ID
- Configure and assign Azure RBAC roles at the correct scope (management group, subscription, resource group, resource)
- Implement and evaluate Azure Policy definitions and assignments
- Configure and manage management groups and subscription hierarchies
- Apply and interpret resource locks and resource tags at scale
- Manage identity governance features including access reviews and Privileged Identity Management basics
The governance half of this domain is frequently underestimated. Candidates who focus only on Entra ID user management often miss questions about policy compliance evaluation, management group inheritance, and how RBAC deny assignments interact with role assignments. Microsoft expects you to troubleshoot real access problems, not just assign roles from memory.
Domain 2: Implement and Manage Storage (15-20%)
Storage is the first of the two mid-weight domains. The complete subtopic list is covered in the AZ-104 Domain 2: Implement and manage storage (15-20%) - Complete Study Guide 2026. This domain requires hands-on familiarity with Azure Storage accounts at a configuration level, not just a conceptual one.
Domain 2: Implement and Manage Storage
Covers storage account creation and configuration, data redundancy options, access control, Azure Files, Blob Storage lifecycle management, and storage security.
- Configure storage account types (Standard, Premium) and replication options (LRS, ZRS, GRS, GZRS, RA-GRS)
- Implement Shared Access Signatures (SAS), stored access policies, and Microsoft Entra-based authorization for Blob and Queue storage
- Manage Azure Blob Storage access tiers (Hot, Cool, Cold, Archive) and lifecycle management policies
- Configure Azure Files shares, including SMB and NFS, and Azure File Sync
- Implement Azure Storage firewalls, virtual network service endpoints, and private endpoints
- Use AzCopy, Azure Storage Explorer, and import/export jobs for data movement
Exam questions in this domain frequently involve selecting the correct redundancy tier for a described scenario or identifying why a storage access policy is failing. Hot-area and drag-and-drop question formats appear here, asking candidates to map replication options to their failover behaviors or match SAS token parameters to their effects.
Domain 3: Deploy and Manage Azure Compute Resources (20-25%)
Tied with Domain 1 as the heaviest exam content area, compute is where most Azure administrators spend the majority of their working hours. The deep-dive version of this domain is available in the AZ-104 Domain 3: Deploy and manage Azure compute resources (20-25%) - Complete Study Guide 2026.
Domain 3: Deploy and Manage Azure Compute Resources
Covers virtual machines, VM scale sets, Azure App Service, Azure Container Instances, and ARM/Bicep template deployments across Windows and Linux workloads.
- Create and configure Azure Virtual Machines including availability sets, availability zones, and VM scale sets
- Configure VM networking, disks, extensions, and custom script execution
- Deploy and manage Azure App Service plans and web apps, including deployment slots
- Create and configure Azure Container Instances and Azure Container Apps
- Deploy infrastructure using ARM templates and Bicep files, including what-if analysis and deployment modes
- Automate VM tasks using Azure Automation, run commands, and desired state configuration
Performance-based lab tasks, when they appear, commonly target Domain 3 scenarios - deploying a VM with specific sizing, configuring auto-scaling, or troubleshooting an ARM deployment error. Candidates who have only read about these operations and never executed them in the Azure portal or CLI are at a measurable disadvantage on lab-format items.
Domain 4: Implement and Manage Virtual Networking (15-20%)
Virtual networking is the second mid-weight domain, carrying 15-20% of the exam. For the complete subtopic breakdown, visit the AZ-104 Domain 4: Implement and manage virtual networking (15-20%) - Complete Study Guide 2026. This domain rewards candidates who understand how Azure networking decisions cascade - a misconfigured NSG rule or incorrect route table entry affects connectivity across multiple resources.
Domain 4: Implement and Manage Virtual Networking
Covers VNet design, DNS, network security groups, Azure Load Balancer, Application Gateway, VPN Gateway, ExpressRoute, and network monitoring tools.
- Create and configure virtual networks, subnets, and VNet peering (including global peering)
- Configure and troubleshoot Network Security Groups (NSGs) and Application Security Groups (ASGs)
- Implement Azure DNS, private DNS zones, and custom DNS configurations
- Deploy and configure Azure Load Balancer (Standard), Application Gateway, and Azure Firewall
- Configure site-to-site VPN, point-to-site VPN, and ExpressRoute connectivity
- Use Network Watcher tools: connection troubleshoot, flow logs, IP flow verify, topology
NSG rule evaluation order and effective route priority are perennial exam topics. Candidates must be able to trace why traffic is allowed or blocked across a described network topology - a common case study format that requires both conceptual understanding and step-by-step evaluation logic.
Domain 5: Monitor and Maintain Azure Resources (10-15%)
The smallest domain by weight, but not ignorable. At 10-15%, Monitor and Maintain typically accounts for several questions per exam. Neglecting it in favor of compute and identity is rational only if you have already achieved high confidence in Domains 1-4.
Domain 5: Monitor and Maintain Azure Resources
Covers Azure Monitor, Log Analytics, alerts, backup, disaster recovery with Azure Site Recovery, and cost management through Azure Advisor and Cost Management tools.
- Configure Azure Monitor metrics, diagnostic settings, and Log Analytics workspaces
- Create and manage alerts using metric rules, log query alerts, and action groups
- Implement Azure Backup for virtual machines, Azure Files, and SQL workloads
- Configure Azure Site Recovery replication and failover policies
- Use Azure Advisor recommendations and Azure Cost Management for optimization and budgeting
- Interpret and act on Azure Service Health notifications and alerts
How Domain Weights Should Shape Your Prep
The domain percentage ranges are your study budget. Combined, Domains 1 and 3 represent 40-50% of the total exam. If you pass at exactly 700 but underperform on both of these domains, you have likely left points on the table that required the least additional study time to recover.
| Domain | Weight | Priority Level | Common Weak Spot |
|---|---|---|---|
| 1 - Identities & Governance | 20-25% | Highest | Policy inheritance, RBAC scope troubleshooting |
| 2 - Storage | 15-20% | High | Redundancy tier selection, SAS token configuration |
| 3 - Compute | 20-25% | Highest | ARM/Bicep deployments, VMSS scaling rules |
| 4 - Virtual Networking | 15-20% | High | NSG evaluation order, effective routes |
| 5 - Monitor & Maintain | 10-15% | Moderate | Log Analytics KQL queries, backup policy scopes |
For candidates wondering How Hard Is the AZ-104 Exam, the domain structure itself provides a useful answer: the difficulty is spread across technical depth in five distinct areas, not concentrated in one. Broad practical experience with Azure administration is the most effective preparation, not memorization of a single topic.
Exam Format, Scoring, and Registration Facts
AZ-104 is delivered through Pearson VUE, either at a testing center or via online proctoring. The U.S. exam fee is typically $165 USD, though pricing varies by the country or region where the exam is proctored. For a full cost breakdown including discounts, vouchers, and retake pricing, see the AZ-104 Certification Cost 2026: Complete Pricing Breakdown.
Microsoft allocates 100 minutes for the exam assessment itself. Your full appointment will be longer once seat check-in, a tutorial, and the post-exam survey are included - budget accordingly if you have a hard stop after your scheduled slot.
Candidates typically encounter 40-60 questions. Item types include multiple-choice (single and multi-select), case studies, drag-and-drop, build-list, hot-area items, and possibly performance-based lab tasks. No formal prerequisite certification is required, but Microsoft recommends real-world experience with Azure administration, PowerShell, Azure CLI, the Azure portal, ARM/Bicep, and Microsoft Entra ID before attempting the exam.
Microsoft Learn lookup access may be available during eligible role-based exams. No extra time is added when this feature is available. This means candidates should not rely on it as a substitute for knowledge - it may help confirm syntax, but looking up foundational concepts during the exam is not a viable strategy within the time constraints.
Once certified, renewal is free and required every 12 months through an online Microsoft Learn renewal assessment. No retesting at a Pearson VUE center is needed for renewal.
A Domain-Aligned Study Schedule
If you are building a structured prep timeline, align your weeks to domain weight rather than treating all five areas equally. The schedule below assumes roughly six weeks of focused study and is designed specifically around the AZ-104 domain structure. For a broader strategy covering practice tests, weak area identification, and final review, see the AZ-104 Study Guide 2026: How to Pass on Your First Attempt.
Domain 1 - Identities & Governance (Heavy)
- Microsoft Entra ID user, group, and service principal management
- RBAC role assignment at all four scope levels
- Azure Policy: definitions, initiatives, compliance evaluation
- Management group hierarchy and subscription organization
Domain 3 - Compute (Heavy)
- Virtual machine deployment, sizing, availability zones, and scale sets
- App Service plans, web apps, and deployment slots
- ARM template and Bicep deployment modes and troubleshooting
Domain 2 - Storage (Mid)
- Storage account types and all replication options with failover behavior
- SAS tokens, stored access policies, and Entra-based authorization
- Lifecycle management, access tiers, and Azure File Sync
Domain 4 - Virtual Networking (Mid)
- VNet design, peering, and DNS configuration
- NSG and ASG rule evaluation; effective route priority
- Load Balancer, Application Gateway, VPN Gateway, and Network Watcher
Domain 5 - Monitor & Maintain + Lab Practice
- Azure Monitor, Log Analytics, and diagnostic settings
- Backup and Site Recovery configuration
- Complete at least two timed practice exams on the AZ-104 practice test platform
Full Review + Weak Domain Targeting
- Analyze practice test results by domain and focus on lowest-scoring areas
- Complete hands-on lab scenarios for compute and networking
- Final timed simulation on AZ-104 practice tests under exam conditions
Key Takeaway
Spend the first two weeks on Domains 1 and 3. These two domains together represent up to half the exam. Building depth here first means your foundation is strongest where the question volume is highest, and your final review weeks can correct gaps in the lighter domains rather than scrambling to learn identity and compute fundamentals late.
Professionals who earn this certification frequently pursue AZ-104 Jobs in cloud operations, infrastructure engineering, and DevOps-adjacent roles. The domain structure directly mirrors those job responsibilities - which is precisely why employers recognize this credential as a meaningful signal of practical Azure capability.
Frequently Asked Questions
AZ-104 has five official content domains: Manage Azure Identities and Governance (20-25%), Implement and Manage Storage (15-20%), Deploy and Manage Azure Compute Resources (20-25%), Implement and Manage Virtual Networking (15-20%), and Monitor and Maintain Azure Resources (10-15%). The current skills measured document reflects the April 17, 2026 update.
Start with Domain 1 (Identities and Governance) and Domain 3 (Compute). Both carry 20-25% of the exam weight, making them the highest-return areas to master first. If you have limited time, maximizing your score on these two domains has the biggest impact on crossing the 700 scaled score threshold.
The passing score is 700 on Microsoft's scaled scoring model. This is not a raw percentage - it is a scaled score that accounts for the relative difficulty of your specific question set. A score of 700 out of 1000 does not mean 70% of questions answered correctly.
Performance-based lab tasks may appear in AZ-104 appointments when scheduled for that delivery. These tasks require candidates to complete real administrative steps in a live or simulated Azure environment. Preparation should include hands-on practice in the Azure portal, Azure CLI, and PowerShell - not reading alone.
The Microsoft Certified: Azure Administrator Associate certification must be renewed every 12 months. Renewal is free and completed through an online Microsoft Learn renewal assessment. There is no requirement to retake the full Pearson VUE proctored exam for renewal purposes.
- AZ-104 Domain 1: Manage Azure identities and governance (20-25%) - Complete Study Guide 2026
- AZ-104 Domain 2: Implement and manage storage (15-20%) - Complete Study Guide 2026
- AZ-104 Domain 3: Deploy and manage Azure compute resources (20-25%) - Complete Study Guide 2026
- AZ-104 Domain 4: Implement and manage virtual networking (15-20%) - Complete Study Guide 2026