AZ-104 Azure Administrator

Course overview

If AZ-900 taught you the language, AZ-104 teaches you to run the building. Azure administrators create identities, assign access, enforce policy, build networks, deploy compute, protect storage, watch everything and recover when it breaks. This course follows Microsoft's skills outline as of April 17, 2026 and puts a keyboard in your hands for every objective — portal and command line and Bicep.

The exam at a glance

Exam weights (current)

Learning outcomes

1. Manage Entra users, groups, licenses, guests and SSPR.
2. Assign and interpret Azure RBAC at every scope.
3. Govern subscriptions with Policy, locks, tags, management groups and budgets.
4. Secure and configure storage accounts, SAS, keys, redundancy, replication and encryption.
5. Operate Blob Storage and Azure Files: tiers, soft delete, snapshots, lifecycle, versioning.
6. Read, modify and deploy ARM templates and Bicep files.
7. Build and manage VMs, disks, zones, scale sets, containers and App Service.
8. Build VNets, peering, routes, NSGs/ASGs, Bastion, service and private endpoints, DNS and load balancers — and troubleshoot them.
9. Monitor with metrics, logs (KQL), alerts, Insights and Network Watcher.
10. Back up and recover with Recovery Services vaults, Backup vaults and Site Recovery.

Lab environment

• Your own Azure subscription (pay-as-you-go with a $25 budget, or Azure for Students). Every lab ends with a teardown step. Budget ~$10–20 total if you tear down promptly.
• Tools: Azure portal, Cloud Shell (Bash), optionally local Azure CLI and VS Code with the Bicep extension.
• Naming convention used: rg-104-<lesson>, region eastus (swap for yours).
• Microsoft's free official lab repo: AZ-104 labs on GitHub.

Watch your wallet: Bastion, VPN gateways, Application Gateway, Site Recovery and premium SKUs bill by the hour whether you use them or not. Labs that create these tell you to delete them the same day.

Assessment

Lesson 1 — Microsoft Entra users and groups

Exam objectives: create users and groups; manage user and group properties; manage licenses in Entra ID; manage external users; configure SSPR.

1.1 Identities you'll manage

Dope Translation: You're running HR and the front desk at the same time. Users are employees. Guests are vendors with a visitor badge. Groups are crews — give the crew the key once instead of cutting 40 separate keys.

1.2 Licenses

Licenses (Microsoft 365, Entra ID P1/P2) are assigned to users or groups (group-based licensing). A user needs a usage location set before a license can be assigned. Group-based licensing is the admin-efficient answer on the exam.

1.3 Self-service password reset (SSPR)

• Scope: None / Selected (one group) / All.
• Authentication methods required: 1 or 2 (admins always need 2).
• Methods: mobile app notification/code, email, mobile phone, office phone, security questions (not for admins).
• Registration can be required at next sign-in; re-confirm every N days.
• Password writeback (for synced users) requires Entra Connect/Cloud Sync and P1.

1.4 Beyond the exam — but your job

Privileged Identity Management (PIM): just-in-time, time-bound admin roles with approval (Entra ID P2). Not in the AZ-104 outline; it's covered in DCT Cloud Security and SC-500.

Lab 1 — Identity operations (60 min)

# Create a user
DOMAIN=$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d@ -f2)
az ad user create --display-name "Kai Brooks" \
  --user-principal-name kai.brooks@$DOMAIN \
  --password "Use-A-Long-Passphrase-2026!" --force-change-password-next-sign-in true

# Create a security group and add the user
az ad group create --display-name "sg-helpdesk" --mail-nickname sg-helpdesk
az ad group member add --group sg-helpdesk \
  --member-id $(az ad user show --id kai.brooks@$DOMAIN --query id -o tsv)

Portal tasks: 1. Set Kai's usage location and department = IT. 2. Users → New user → Invite external user: invite a personal email address as a guest. Accept it from that inbox. 3. Password reset → Properties: enable SSPR for Selected → sg-helpdesk, 2 methods. 4. If you have a P1 trial: create a dynamic group dg-it with rule user.department -eq "IT" and watch Kai appear.

Evidence: screenshots of group membership, guest user (UserType Guest), SSPR settings. Teardown: delete test users and guest.

Lesson 1 knowledge check