AZ-104 — Microsoft Azure Administrator
Microsoft

Microsoft Azure Administrator (AZ-104) Practice Questions

★★★★★★ 4.9 358 verified reviews
100 questions
June 11, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Manage Azure identities and governance
  • Implement and manage storage
  • Deploy and manage Azure compute resources
  • Implement and manage virtual networking
  • Monitor and maintain Azure resources

Sample Questions (10 of 100 shown)

Q1 Manage Azure Identities and Governance (20%)
What is the difference between a Microsoft Entra ID user and a Microsoft Entra ID guest user (B2B)?
  1. Guest users have full administrative access by default
  2. Guest users are external collaborators invited from other organizations to access resources in your tenant
  3. Guest users cannot access any Azure resources
  4. There is no difference
✓ Correct Answer: B
B2B (Business-to-Business) guest users are external identities invited to collaborate on your organization's resources. They authenticate through their home tenant and access your resources via invitation. Guest users have limited default permissions and must be explicitly granted access. Native users belong to your tenant directly.
Q2 Manage Azure Identities and Governance (20%)
A company needs to enforce multi-factor authentication (MFA) for all administrative roles including Global Administrator. What is the most effective approach?
  1. Send email reminders to administrators
  2. Configure a Conditional Access policy requiring MFA for directory roles
  3. MFA is automatically enforced for all administrators
  4. Ask administrators to manually enable MFA in their profile
✓ Correct Answer: B
Conditional Access policies provide the most effective enforcement — create a policy targeting directory roles (Global Admin, etc.) requiring MFA. It's evaluated at sign-in and cannot be bypassed by users. Email reminders and manual opt-in are not enforceable. MFA is not automatically enforced (Option C).
Q3 Manage Azure Identities and Governance (20%)
What is the purpose of Azure RBAC (Role-Based Access Control)?
  1. To monitor network traffic in Azure VNets
  2. To provide fine-grained access management to Azure resources based on assigned roles
  3. To encrypt data at rest
  4. To deploy virtual machines
✓ Correct Answer: B
Azure RBAC controls access to Azure resources (subscription, resource groups, individual resources) by assigning roles (Owner, Contributor, Reader, or custom roles) to security principals (users, groups, service principals, managed identities). It follows the principle of least privilege. RBAC is an authorization system built on Azure Resource Manager (ARM).
Q4 Manage Azure Identities and Governance (20%)
Which built-in Azure RBAC role should be assigned to a user who needs to create and manage virtual machines but should NOT be able to grant access to other users?
  1. Owner
  2. Contributor
  3. Reader
  4. User Access Administrator
✓ Correct Answer: B
Contributor allows full create, read, update, and delete operations on Azure resources but does NOT grant the ability to assign roles to other users (that requires Owner or User Access Administrator). Owner has full access including role assignment. Reader is read-only. User Access Administrator only manages role assignments, not resources.
Q5 Manage Azure Identities and Governance (20%)
What is the purpose of Azure Policy?
  1. To control user access to resources
  2. To create and enforce rules about resource properties to ensure compliance with organizational standards
  3. To monitor resource performance
  4. To calculate cloud costs
✓ Correct Answer: B
Azure Policy evaluates resource configurations against defined rules and can deny non-compliant resources, audit violations, or automatically modify resources. Example: "Only allow VMs of size Standard_DS3_v2" or "Require a tag named 'Environment' on all resources." RBAC (Option A) controls who can access. Policy controls what they can create.
Q6 Manage Azure Identities and Governance (20%)
A company needs to organize 25 Azure subscriptions for governance and billing. How should they structure their subscriptions?
  1. Keep all subscriptions at the root level with no hierarchy
  2. Use Management Groups to organize subscriptions hierarchically and apply policies and RBAC at the group level
  3. Create separate Azure AD tenants for each subscription
  4. Merge all subscriptions into one
✓ Correct Answer: B
Management Groups provide governance above subscriptions — organize them hierarchically (up to 6 levels) and apply Azure Policy and RBAC assignments that cascade down. This enables unified governance across many subscriptions. Flat structure (Option A) requires per-subscription management. Separate tenants (Option C) fragment identity management.
Q7 Manage Azure Identities and Governance (20%)
What is a resource group in Azure?
  1. A collection of Azure subscriptions
  2. A logical container that holds related Azure resources, enabling management, deployment, and access control as a group
  3. A security boundary for network traffic
  4. A billing category for cost management
✓ Correct Answer: B
Resource groups are logical containers for resources that share the same lifecycle. You can deploy, manage, and delete related resources together. RBAC roles assigned at the resource group scope apply to all resources within it. Resources can belong to only one resource group but can be in different regions.
Q8 Manage Azure Identities and Governance (20%)
A user has been assigned the Reader role on a resource group and the Contributor role on a specific VM within that group. What permissions does the user have on that VM?
  1. Read only (Reader takes precedence)
  2. Full read, write, and delete (Contributor — the most permissive effective permission applies)
  3. No access
  4. Owner access
✓ Correct Answer: B
Azure RBAC uses an additive model — the effective permissions are the union of all assigned roles. Reader on the RG + Contributor on the VM = Contributor on the VM (create, read, update, delete). Any explicitly assigned Deny takes precedence (via Azure Blueprints resource locks or explicit deny assignments), but standard RBAC assignments are additive.
Q9 Manage Azure Identities and Governance (20%)
What is the difference between a subscription and a management group?
  1. Management groups contain subscriptions and provide a higher-level governance scope; subscriptions are billing and access boundaries for resources
  2. Subscriptions contain management groups
  3. They are the same thing
  4. Management groups only control billing
✓ Correct Answer: A
Subscriptions are billing boundaries (each subscription gets a bill) and access boundaries (each subscription can have different admins). Management Groups sit above subscriptions, providing governance (policy, RBAC) that cascades to all subscriptions in the hierarchy. A management group can contain multiple subscriptions and nested management groups.
Q10 Manage Azure Identities and Governance (20%)
A developer accidentally has Contributor access to a production resource group. According to least privilege, what should be done?
  1. Nothing — developers should always have Contributor access
  2. Remove Contributor access and assign only the specific roles/permissions needed for the developer's actual tasks
  3. Assign the Owner role instead
  4. Delete the developer's account
✓ Correct Answer: B
Least privilege means granting only the minimum necessary permissions. If a developer only deploys code and doesn't manage infrastructure, they may only need Developer/Deployer roles or custom RBAC with narrower scope. Removing excessive Contributor access reduces the blast radius of errors or compromised credentials.

You've viewed 3 of 100 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

Microsoft launched the AZ-104 exam as the successor to the retired AZ-103, establishing it as the core requirement for the Azure Administrator Associate credential. The exam code AZ-104 corresponds to the full title "Microsoft Azure Administrator," a role-based assessment that validates your ability to implement, manage, and monitor an enterprise Azure environment end to end. Unlike foundational exams that test conceptual knowledge, AZ-104 requires you to make concrete configuration decisions: which NSG rule opens the correct port, which RBAC role grants the minimum required permission, which storage redundancy option survives a regional outage.

Six months of hands-on administration is the practical floor before attempting this exam. You should be comfortable running Azure CLI commands to create resource groups, writing Bicep templates to deploy VM scale sets, and interpreting Log Analytics Kusto query output without referencing documentation. The official preparation course is AZ-104T00-A (4-day instructor-led), and the self-paced Azure Administrator Learning Series on Microsoft Learn breaks the content into six digestible modules. Because Microsoft Learn is available during the real exam, you can look up syntax — but with only about two minutes per question, you cannot rely on it as a crutch.

Five domains shape the AZ-104 blueprint, with the heaviest weight on managing Azure identities and governance (20–25%) and deploying Azure compute resources (20–25%). The remaining domains — implementing storage (15–20%), configuring virtual networking (15–20%), and monitoring Azure resources (10–15%) — complete the assessment. A distinctive feature of this exam is the case study section: you will encounter one or two extended scenarios that lock question order, forcing you to commit to answers before reviewing. You must know how to calculate effective security rules when NSGs, ASGs, and UDRs overlap, because the exam presents realistic network topologies and asks whether traffic flows.

The practice questions here mirror the five-domain distribution exactly, with scenario-based items that reproduce the case study format and the multi-part interactive question types you will face at the test center. Each question includes a detailed explanation that walks through the configuration logic — why a specific RBAC role is the minimum viable permission, how VNet peering differs from private endpoints, and when to choose Geo-Redundant Storage over Zone-Redundant Storage. The downloadable PDF packages the same question bank for offline review, so you can practice Bicep template syntax and Log Analytics KQL queries during commutes or in environments without reliable internet.

Official Exam Domains & Weighting

To successfully pass the AZ-104 exam, candidates must master the following core domains:
  • Domain 1: Manage Azure identities and governance — 20–25%
Covers Microsoft Entra ID user and group management, self-service password reset (SSPR) configuration, and enterprise licensing. You must master Azure RBAC role assignment at every scope (tenant, management group, subscription, resource group) and interpret effective access inheritance. The governance portion tests Azure Policy authorship and enforcement, cost tracking with budgets and Azure Advisor, and resource tag strategies for multi-subscription environments.
  • Domain 2: Implement and manage storage — 15–20%
Focuses on storage account creation, blob lifecycle management rules, and redundancy selection (LRS, GRS, ZRS, RA-GRS). Security topics include SAS token generation boundaries, network firewall rules, private endpoint configuration, and identity-based Azure Files access. You should know when to use AzCopy versus Azure Storage Explorer for data migration, and how to configure immutable storage policies for compliance workloads.
  • Domain 3: Deploy and manage Azure compute resources — 20–25%
Tests Infrastructure as Code using JSON ARM templates or Bicep files, including parameter files and linked templates. VM configuration covers disk encryption, availability sets, fault/update domains, and availability zones. VMSS autoscale policies (vertical and horizontal) appear frequently. Container topics include Azure Container Registry (ACR) security, Azure Container Instances (ACI), and Azure Container Apps deployment. App Service multi-slot deployment and scaling rounds out this domain.
  • Domain 4: Implement and manage virtual networking — 15–20%
Builds custom VNet address spaces, subnets, and VNet peering configurations. Routing and security are the exam's most difficult subtopic: you must calculate effective routes when custom UDRs override system routes, and determine traffic flow through overlapping NSG and ASG rules. Azure Bastion for secure RDP/SSH, Azure Load Balancer NAT rules and health probes, and private/public DNS zone configuration complete this domain.
  • Domain 5: Monitor and maintain Azure resources — 10–15%
Covers Azure Monitor metric and log queries using Kusto Query Language (KQL) in Log Analytics workspaces. You must configure metric alerts, log alerts, and action groups for automated remediation. Backup and recovery tests Recovery Services vault deployment, VM backup policies, file share backup, and point-in-time restore. Azure Site Recovery (ASR) regional failover replication and failback planning appear as scenario questions.

What Our Customers Say 358 verified reviews

4.9 ★★★★★★ Based on 358 reviews
★★★★★★
I studied for AZ-104 with this bank and passed comfortably. The questions are well-organized and the UI is clean.
— Lauren C.
★★★★★★
Comprehensive coverage for AZ-104. Every domain is represented and the question difficulty ramps up nicely.
— Emma J.
★★★★★★
I travel a lot for work, so the mobile-friendly AZ-104 practice was a lifesaver. Did questions on flights and during commute.
— Lily B.
★★★★★★
The AZ-104 question bank is very comprehensive. I went through all 120+ questions and felt completely ready for exam day.
— Sebastian M.
★★★★★★
Comparing this with other Microsoft practice tests, this one feels the most like the real AZ-104 exam.
— Mia R.
★★★★★★
I was nervous about the AZ-104 exam because it had been years since my last cert. These questions got me back on track fast.
— Aurora C.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Virtual networking consistently causes the most failures. The exam presents complex network topologies and asks you to calculate effective security rules when NSGs, ASGs, and custom UDRs interact — you cannot rely on memorization, you must trace packet flow. Storage security (SAS token scoping and expiry) and Bicep/ARM template syntax tracking are also frequent stumbling points. Practice with real scenario questions that force you to choose between redundant storage options under a specific failure scenario, and calculate effective NSG rules for a given VNet peering configuration.

Do not rely on Microsoft Learn to pass. The integrated documentation is useful for checking exact PowerShell or Azure CLI syntax, but the exam timer does not pause while you browse. With roughly two minutes per question, looking up more than four or five answers will cause you to run out of time. Furthermore, the exam interface disables Ctrl+F page search, making navigation slower than you expect. Use Learn as a safety net, not a primary strategy.

If your score falls below 700 on your first attempt, you must wait 24 hours before rescheduling. For a third, fourth, or fifth attempt, a mandatory 14-day waiting period applies between bookings. Microsoft caps you at five attempts within any rolling 12-month window, and each retake requires full payment of the $165 exam fee.

The credential is valid for one year from your exam date. Within 180 days before expiration, you can renew for free by passing an unproctored, open-book renewal assessment on Microsoft Learn that covers only the features added in the past year. No retesting of the full exam is required.

Our mock exam reproduces the AZ-104 question formats you will encounter: single-choice, multiple-response, drag-and-drop sequencing, hot area diagrams, drop-down script completions (PowerShell and Azure CLI), and case studies with locked navigation. The practice test enforces the same 120-minute timer and presents scenario questions that require you to calculate effective NSG rules, choose the correct RBAC role, and write Bicep template snippets — the same skills measured in the real exam.

Yes, the complete question bank is available as a downloadable PDF that packages all five domains in the same weighted distribution as the real exam. The PDF includes detailed answer explanations with references to official Azure documentation, Bicep template examples, and KQL query samples for Azure Monitor. You can use the PDF to review Azure RBAC role assignments, virtual network UDR configuration steps, and Azure Site Recovery failover procedures while commuting or in environments without internet access.

Start by building a small lab environment where you can deploy a VNet with subnets, assign RBAC roles to test effective permissions, and configure an NSG to block specific traffic — then verify the result using Network Watcher. Practice writing Bicep templates that deploy a VM with a managed disk and a storage account with a private endpoint. When you can complete these tasks without documentation, the scenario questions become straightforward applications of your hands-on experience. Focus especially on overlapping NSG rules and UDR route precedence, because the exam presents multi-layered network diagrams and asks you to trace exactly one packet.