- AZ-104 requires a passing scaled score of 700-not a simple 70% raw score-so every question's weight matters.
- The exam runs 100 minutes with 40-60 questions spanning six interactive formats plus possible performance-based lab tasks.
- Identities/governance and compute each carry 20-25% of the exam weight, making them the highest-priority study targets.
- No prerequisite certification is required, but Microsoft expects real Azure administrator hands-on experience before you sit.
The Real Difficulty Picture
Candidates searching "how hard is AZ-104" often expect a one-word answer. The honest answer is: harder than most associate-level exams if you lack hands-on Azure experience, and very manageable if you do. The AZ-104 certification is Microsoft's role-based badge for Azure administrators-people who actually spin up virtual machines, configure virtual networks, manage identities, and monitor resources in production environments. It is not a theoretical knowledge quiz.
The difficulty comes from three compounding factors: the breadth of five distinct technical domains, interactive question formats that require you to perform rather than just recognize an answer, and a scoring model that most candidates misunderstand until they read the fine print. This guide breaks all three down in explicit AZ-104 terms so you know exactly what you are walking into.
Exam Format and Question Types
Understanding the format is the first step to calibrating difficulty. AZ-104 is a proctored exam delivered through Pearson VUE. The appointment window feels longer than 100 minutes because it includes seat time, an onboarding tutorial, a post-exam survey, and check-in procedures-but the actual assessed portion is 100 minutes.
Question Types You Will Encounter
Microsoft uses a wider range of item formats on AZ-104 than most candidates expect. These include:
- Multiple choice (single answer): The format most candidates are comfortable with.
- Multiple choice (multiple answers): You must select all correct answers; partial credit rules vary.
- Case studies: A scenario with several pages of context followed by multiple related questions. You cannot return to case study questions once you move past that section.
- Drag-and-drop: Sequence or match Azure services, configuration steps, or policy elements.
- Build-list: Select and order items from a pool-common for step-by-step deployment scenarios.
- Hot-area: Click a specific region of a diagram or screenshot, such as a portal blade or network topology.
- Performance-based tasks (labs): When scheduled for a lab-included delivery, you interact with a real or simulated Azure environment and must complete a task without a script. These cannot be skipped and are time-intensive.
The candidate pool typically sees roughly 40-60 items. Microsoft does not publish a fixed scored versus unscored split, so treat every question as if it counts. During eligible role-based exam deliveries, Microsoft Learn lookup access may be available, but no additional time is granted-so knowing where to find information quickly matters as much as memorizing facts.
Where Candidates Actually Struggle: Domain by Domain
The AZ-104 Exam Domains 2026: Complete Guide to All 5 Content Areas covers each area in full depth. Here, the focus is specifically on where difficulty spikes and why.
Domain 1: Manage Azure Identities and Governance (20-25%)
The heaviest-weighted domain. Candidates must understand Microsoft Entra ID (formerly Azure Active Directory), role-based access control (RBAC), Azure Policy, management groups, and subscriptions.
- RBAC scope hierarchy (management group → subscription → resource group → resource) confuses many candidates who try to memorize rather than understand the logic.
- Governance tooling-Azure Policy definitions, initiatives, and compliance reporting-requires knowing not just what a policy does but which effect (Deny, Audit, DeployIfNotExists) applies in a given scenario.
- Microsoft Entra ID concepts overlap with the AZ-900 and SC-300 tracks, but AZ-104 tests them at an operational depth those exams do not reach.
Domain 2: Implement and Manage Storage (15-20%)
Storage accounts, blob lifecycle management, Azure Files, and data transfer options. Difficulty here is less conceptual and more about knowing specific configuration knobs.
- Redundancy options (LRS, ZRS, GRS, GZRS) and their failover behaviors are common question targets.
- Shared access signatures (SAS), stored access policies, and encryption at rest versus in transit distinctions appear frequently in scenario questions.
- Candidates underestimate Azure File Sync configuration steps; this is a reliable source of drag-and-drop and build-list items.
Domain 3: Deploy and Manage Azure Compute Resources (20-25%)
Tied with Domain 1 for highest weight. Virtual machines, availability sets and zones, scale sets, Azure App Service, Azure Container Instances, and ARM/Bicep templates.
- ARM template structure-parameters, variables, resources, outputs-must be readable and editable, not just recognizable.
- VM sizing, disk types (Standard HDD/SSD, Premium SSD, Ultra), and backup configuration are fertile ground for scenario questions.
- Container and App Service topics have grown in prominence; candidates who skip them because they "aren't classic infrastructure" tend to lose points.
Domain 4: Implement and Manage Virtual Networking (15-20%)
VNets, subnets, Network Security Groups (NSGs), Azure DNS, VPN Gateway, ExpressRoute, Azure Load Balancer, and Application Gateway.
- NSG rule priority logic is a consistent source of errors-candidates mix up lower-number equals higher-priority direction.
- Distinguishing Azure Load Balancer (Layer 4) from Application Gateway (Layer 7) in scenario context is a repeated exam theme.
- VNet peering versus VPN Gateway versus ExpressRoute trade-offs appear in case study questions where the scenario details determine the right answer.
Domain 5: Monitor and Maintain Azure Resources (10-15%)
Azure Monitor, Log Analytics, Azure Alerts, Azure Backup, and Azure Site Recovery. The lowest-weighted domain, but questions here are scenario-rich and practical.
- Alert rule components-signal type, condition, action group, severity-must be distinguishable from one another.
- Backup policy configuration for VMs and Azure SQL is tested at a configuration-step level, not just conceptually.
- Candidates who skip this domain to focus on heavier areas often lose easy points; 10-15% is not negligible.
For granular topic lists per domain, see the dedicated guides: Domain 1: Manage Azure Identities and Governance, Domain 3: Deploy and Manage Azure Compute Resources, and Domain 4: Implement and Manage Virtual Networking.
Scoring Mechanics That Trip People Up
AZ-104 uses Microsoft's scaled scoring model. You need a score of 700 or above on a 1-1000 scale to pass. This is not equivalent to getting 70% of questions correct. Scaled scoring accounts for item difficulty-harder questions contribute more to your score than easier ones when answered correctly, and the reverse is also true when answered incorrectly.
What this means practically:
- You cannot predict your pass/fail status by counting correct answers during the exam.
- A cluster of incorrect answers in a high-difficulty section (like Domain 1 governance scenarios or Domain 3 ARM templates) can pull your score below 700 even if your overall correct-answer percentage looks acceptable.
- Performance-based lab tasks, when present, contribute to your scaled score and often carry significant weight per task completed or partially completed.
Key Takeaway
Do not aim to "just pass" by targeting 70%. Aim to genuinely understand every domain so your scaled score reflects real competency. Candidates who study specifically to the 700 threshold tend to land on the wrong side of it.
Who Finds AZ-104 Hard vs. Who Finds It Manageable
| Candidate Profile | Difficulty Level | Biggest Risk Area |
|---|---|---|
| Azure administrator with 6+ months hands-on experience | Moderate | Governance policy syntax and ARM/Bicep template editing |
| IT professional transitioning from on-prem (Windows Server/AD) | Moderate-High | Cloud-native networking (VNet peering, Application Gateway) |
| AZ-900 holder with no hands-on Azure work | High | Performance-based lab tasks and case study scenarios |
| Developer with Azure exposure but no admin focus | Moderate-High | Backup, Site Recovery, and governance tooling |
| Networking engineer moving to cloud | Low-Moderate (networking only), High elsewhere | Identity, governance, and compute domains |
Microsoft does not require any prerequisite certification to register, but its official recommendation includes experience with operating systems, networking, servers, virtualization, PowerShell, Azure CLI, Azure portal, ARM/Bicep templates, and Microsoft Entra ID. That list is long for a reason-this is genuinely a practitioner-level exam.
A Realistic Preparation Timeline
The right preparation length depends entirely on your starting point. Rather than a generic schedule, below is a domain-sequenced approach based on AZ-104's actual weight distribution. Full strategic preparation advice is in the AZ-104 Study Guide 2026: How to Pass on Your First Attempt.
Domain 1: Identities and Governance (20-25%)
- Build Microsoft Entra ID tenant, create users and groups hands-on
- Configure RBAC assignments at each scope level and verify effective permissions
- Create and assign Azure Policies; test Deny and Audit effects with real resources
- Run practice questions on governance scenarios nightly using the AZ-104 practice tests
Domain 3: Compute Resources (20-25%)
- Deploy VMs using both portal and ARM/Bicep templates; edit templates manually
- Configure availability zones, scale sets, and VM backup policies
- Deploy an App Service plan and a container instance; compare scaling behaviors
- Focus Feynman-technique review on ARM template structure-explain it without notes
Domains 2 and 4: Storage and Networking (15-20% each)
- Create storage accounts with each redundancy type; configure SAS tokens and lifecycle rules
- Build a hub-and-spoke VNet topology; configure NSG rules and verify traffic flow
- Set up Azure DNS zones and test name resolution across peered VNets
Domain 5 + Full Review: Monitor and Maintain (10-15%)
- Configure Azure Monitor alerts, Log Analytics workspace queries, and diagnostic settings
- Practice Azure Site Recovery vault setup for a VM
- Take timed full-length practice exams; review every wrong answer at the domain level
- Repeat weak-domain practice sets using spaced repetition until score is consistently strong
Registration, Cost, and Logistics
AZ-104 is administered by Pearson VUE. The exam fee in the United States is $165 USD, with pricing adjusted based on the country or region where the exam is proctored-some regions have significantly lower local pricing. Full pricing details are covered in the AZ-104 Certification Cost 2026: Complete Pricing Breakdown.
You can schedule the exam as an online proctored session or at a Pearson VUE testing center. Both options include identity verification and environment checks that add time before the clock starts on your 100-minute assessment window.
If you do not pass on your first attempt, Microsoft's standard retake policy applies: you must wait 24 hours before a second attempt, and subsequent attempts require longer waiting periods. This makes thorough preparation before sitting the exam economically and strategically sensible. The skills measured on the exam are current as of April 17, 2026.
Once you earn the Microsoft Certified: Azure Administrator Associate badge, renewal is required every 12 months. Renewal is free and completed through an online Microsoft Learn renewal assessment-no retaking the full proctored exam, no additional fee. This makes AZ-104 one of the lower ongoing-cost credentials relative to competitors who charge for renewal exams. The credential's value in the job market is explored in detail in AZ-104 Salary Guide 2026: Complete Earnings Analysis.
Frequently Asked Questions
The passing score is 700 on Microsoft's scaled scoring model, which runs from 1 to 1000. This is not a percentage of correct answers-it reflects a scaled score that weights questions by difficulty. Earning exactly 700 passes; 699 does not, regardless of how many questions you answered correctly.
Candidates typically encounter approximately 40-60 questions. Microsoft does not publish a fixed count or a confirmed scored-versus-unscored split. The exam may also include performance-based lab tasks depending on the delivery type scheduled, which are separate from the standard question pool.
No prerequisite certification is formally required to register. However, Microsoft strongly recommends that candidates have real hands-on experience with Azure administration, including PowerShell, Azure CLI, ARM/Bicep templates, virtual networking, compute resources, and Microsoft Entra ID. Lacking that experience-not a prior certification-is the most common reason candidates struggle.
The certification is valid for 12 months and must be renewed annually. Renewal is free and completed through a Microsoft Learn online assessment-no proctored exam, no retake fee. Microsoft sends renewal reminders before the expiration window, and the renewal assessment can be retaken if you do not pass on the first try.
Start with Domain 1 (Manage Azure Identities and Governance) and Domain 3 (Deploy and Manage Azure Compute Resources) because each carries 20-25% of the exam weight-together they represent nearly half the exam. Building a strong foundation in RBAC, Microsoft Entra ID, and ARM templates early also supports understanding in Domains 2, 4, and 5, which build on those concepts.