AZ-104 Exam Topics 2026: Complete Breakdown of All Domains

If you’re preparing for the Microsoft Azure Administrator certification, start with one thing: a clear picture of the AZ-104 exam topics you’ll actually be tested on. Too many candidates study from outdated PDFs, old YouTube playlists, or third-party guides that no longer match what Microsoft is asking on exam day. The result? Practice scores that don’t translate into a passing result.

The AZ-104 exam validates the skills of a working Azure administrator. That means managing identities, implementing storage, deploying compute resources, configuring virtual networks, and keeping an Azure environment monitored and healthy. It’s one of the most in-demand associate-level certifications in cloud computing. It also signals to employers that you can operate confidently inside a real Azure subscription, not just recite terminology.

Microsoft doesn’t leave this exam static. On April 17, 2026, Microsoft updated the official AZ-104 skills-measured outline. The changes weren’t cosmetic: Manage Azure identities and governance increased in weight, virtual networking decreased slightly, the exam completed its transition to Microsoft Entra ID naming (replacing any remaining Azure Active Directory references), and container coverage expanded to include Azure Container Apps alongside Azure Container Instances. Studying from material written before that date means working from a blueprint that no longer matches the real exam.

This guide is built to be a complete azure az 104 study guide in itself: every domain, every skill area within those domains, the exact weighting for 2026, and practical study guidance for each section. You’ll also get honest answers to the questions candidates ask most, including whether the exam is genuinely difficult, which resources are worth your time heading into az 104 exam questions 2026, and whether so-called az 104 exam topics with answers sites and brain dumps are something you should ever touch. Everything here is based directly on Microsoft’s official skills-measured documentation, not speculation.

AZ-104 Exam Overview

Before diving into the individual domains, it helps to understand the shape of the exam itself.

A few things worth internalizing early: the 700-point passing score is scaled, not a straightforward percentage of questions answered correctly. Some questions and case studies carry more weight than others, so don’t try to reverse-engineer your score from how many questions “felt right.” Focus on consistent, repeatable performance across practice material instead.

Official AZ-104 Exam Domains & Weights (2026)

The AZ-104 exam covers five domains: identities and governance, storage, compute, virtual networking, and monitoring, each weighted differently. Here is the complete, current breakdown of what topics are covered in the AZ-104 exam, straight from Microsoft’s skills-measured outline updated April 17, 2026.

These five domains are the entire exam. Everything Microsoft asks, every scenario, every case study, every drag-and-drop item, maps back to one of these areas.

Why these weights matter: the percentage ranges tell you roughly how many questions to expect from each domain, which should directly shape how you allocate study hours. A domain sitting at 20–25% deserves noticeably more of your time than one sitting at 10–15%. Studying every domain “equally” is one of the most common ways candidates waste preparation time, you end up over-studying low-weight material while under-preparing for the sections that make up nearly half the exam.

Notably, Identities and Governance now shares the top weight tier with Compute, a change from earlier versions of the exam where networking carried the heaviest weighting. If your study plan or third-party course still treats networking as the dominant domain, it was built before April 2026 and needs to be adjusted.

Detailed Domain Breakdown

This is the core of your preparation. Below is the full, official topic list for each domain, along with practical notes on where candidates commonly lose points.

1. Manage Azure Identities and Governance (20–25%)

This domain now carries the highest weight on the exam, tied with compute. It reflects how central identity and governance have become to real-world Azure administration, you can’t manage resources securely without first controlling who has access to them and how that access is governed.

Manage Microsoft Entra users and groups

• Create users and groups
• Manage user and group properties
• Manage licenses in Microsoft Entra ID
• Manage external users
• Configure self-service password reset (SSPR)

Manage access to Azure resources

• Manage built-in Azure roles
• Assign roles at different scopes
• Interpret access assignments

Manage Azure subscriptions and governance

• Implement and manage Azure Policy
• Configure resource locks
• Apply and manage tags on resources
• Manage resource groups
• Manage subscriptions
• Manage costs by using alerts, budgets, and Azure Advisor recommendations
• Configure management groups

Practical notes: Note that this domain uses Microsoft Entra ID terminology throughout, Microsoft has fully retired “Azure Active Directory” branding in the current outline, so make sure your study material reflects the rename, not just the underlying functionality. A common exam trap is confusing Azure RBAC role assignment scope (management group → subscription → resource group → resource) with Azure Policy inheritance, they behave similarly but serve different purposes, and Microsoft likes to test that distinction directly. Spend hands-on time actually assigning roles at different scopes and observing how a resource lock or policy assignment inherits downward. Don’t just memorize the theory, build it in a free-tier subscription.

2. Implement and Manage Storage (15–20%)

Storage is foundational to almost every other Azure service, and this domain tests both the security controls around storage and the operational configuration of storage accounts.

Configure access to storage

• Configure Azure Storage firewalls and virtual networks
• Create and use shared access signature (SAS) tokens
• Configure stored access policies
• Manage access keys
• Configure identity-based access for Azure Files

Configure and manage storage accounts

• Create and configure storage accounts
• Configure Azure Storage redundancy
• Configure object replication
• Configure storage account encryption
• Manage data by using Azure Storage Explorer and AzCopy

Configure Azure Files and Azure Blob Storage

• Create and configure a file share in Azure Files
• Create and configure a container in Azure Blob Storage
• Configure storage tiers
• Configure soft delete for blobs and containers
• Configure snapshots and soft delete for Azure Files
• Configure blob lifecycle management
• Configure blob versioning

Practical notes: Candidates frequently mix up the different redundancy options (LRS, ZRS, GRS, GZRS, and their read-access variants), know exactly what each protects against and where the trade-offs lie between cost and durability. Another frequent trap: understanding the difference between a SAS token and a stored access policy, and when you’d revoke one versus the other. Lab this out directly, create a storage account, generate a SAS token, configure a lifecycle management rule, and walk through soft delete recovery for both blobs and file shares. The exam likes to test operational recovery scenarios, not just configuration steps.

3. Deploy and Manage Azure Compute Resources (20–25%)

Compute is tied for the highest weight on the exam, and this is also the domain with the most significant topic expansion in the April 2026 update, particularly around infrastructure-as-code and containers.

Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files

• Interpret an Azure Resource Manager template or a Bicep file
• Modify an existing Azure Resource Manager template
• Modify an existing Bicep file
• Deploy resources by using an Azure Resource Manager template or a Bicep file
• Export a deployment as an Azure Resource Manager template or convert an Azure Resource Manager template to a Bicep file

Create and configure virtual machines

• Create a virtual machine
• Configure encryption at host for Azure virtual machines
• Move a virtual machine to another resource group, subscription, or region
• Manage virtual machine sizes
• Manage virtual machine disks
• Deploy virtual machines to availability zones and availability sets
• Deploy and configure an Azure Virtual Machine Scale Set

Provision and manage containers in the Azure portal

• Create and manage an Azure Container Registry
• Provision a container by using Azure Container Instances
• Provision a container by using Azure Container Apps
• Manage sizing and scaling for containers, including Azure Container Instances and Azure Container Apps

Create and configure Azure App Service

• Provision an App Service plan
• Configure scaling for an App Service plan
• Create an App Service
• Configure certificates and Transport Layer Security (TLS) for an App Service
• Map an existing custom DNS name to an App Service
• Configure backup for an App Service
• Configure networking settings for an App Service
• Configure deployment slots for an App Service

Practical notes: This is where the expanded container coverage shows up directly, Azure Container Apps is now explicitly named alongside Container Instances. The one-sentence version to remember: Container Instances is for spinning up a single, simple container quickly with no orchestration, while Container Apps is for running scalable, microservices-style workloads that need built-in autoscaling, revisions, and Dapr integration. Bicep is also weighted more heavily than it used to be; if you’ve only ever worked with raw ARM JSON, spend deliberate time reading and modifying Bicep files, since the exam explicitly tests interpreting and converting between the two formats. For VMs, availability zones versus availability sets is a classic point of confusion, know which one protects against a full datacenter failure versus a rack-level failure.

4. Implement and Manage Virtual Networking (15–20%)

Networking’s weight decreased slightly in the April 2026 update, but it remains a substantial part of the exam and is often where candidates with less networking background struggle most.

Configure and manage virtual networks in Azure

• Create and configure virtual networks and subnets
• Create and configure virtual network peering
• Configure public IP addresses
• Configure user-defined routes
• Troubleshoot network connectivity

Configure secure access to virtual networks

• Create and configure network security groups (NSGs) and application security groups
• Evaluate effective security rules in NSGs
• Implement Azure Bastion
• Configure service endpoints for Azure platform as a service (PaaS)
• Configure private endpoints for Azure PaaS

Configure name resolution and load balancing

• Configure Azure DNS
• Configure an internal or public load balancer
• Troubleshoot load balancing

Practical notes: “Evaluate effective security rules in NSGs” is a specific, testable skill, Microsoft expects you to be able to look at multiple NSGs applied at both the subnet and NIC level and determine which rule actually wins. For example: if a subnet-level NSG allows inbound traffic on port 3389 but the NIC-level NSG on that same VM explicitly denies it, the deny wins, because Azure evaluates rules from both layers together and the more restrictive rule takes effect. This trips up a lot of candidates who understand NSGs conceptually but haven’t practiced reading combined rule sets. Also be precise about the difference between service endpoints and private endpoints, they solve a similar problem (securing PaaS access) in fundamentally different ways, and the exam tests that distinction directly. Build a hub-and-spoke style lab with peered VNets, a Bastion host, and an NSG with layered rules, then trace traffic through it manually.

5. Monitor and Maintain Azure Resources (10–15%)

The smallest domain by weight, but not one to skip, monitoring and backup questions are often scenario-based and can be time-consuming if you haven’t practiced the workflows.

Monitor resources in Azure

• Interpret metrics in Azure Monitor
• Configure log settings in Azure Monitor
• Query and analyze logs in Azure Monitor
• Set up alert rules, action groups, and alert processing rules in Azure Monitor
• Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights
• Use Azure Network Watcher and Connection Monitor

Implement backup and recovery

• Create a Recovery Services vault
• Create an Azure Backup vault
• Create and configure a backup policy
• Perform backup and restore operations by using Azure Backup
• Configure Azure Site Recovery for Azure resources
• Perform a failover to a secondary region by using Site Recovery
• Configure and interpret reports and alerts for backups

Practical notes: Know the difference between a Recovery Services vault and an Azure Backup vault, they’re not interchangeable, and Microsoft has both listed as separate skills for a reason (Backup vaults are used for newer workload types like disks and blobs, while Recovery Services vaults handle VMs, SQL, and SAP HANA). Basic KQL (Kusto Query Language) familiarity will help significantly with the “query and analyze logs” skill, you don’t need to be an expert, but you should be comfortable writing a simple log query in Azure Monitor. Also practice an actual failover using Azure Site Recovery in a lab if you can; the exam frequently frames these as “what would you do in this failure scenario” questions rather than pure definitions.

How to Prioritize Your Study Time Based on Domain Weights

A simple, defensible way to allocate your study hours is to roughly mirror the exam weights:

1. Identities and Governance (20–25%) and Compute (20–25%), spend the largest, roughly equal share of your time here. Together they can represent up to half the exam.
2. Storage (15–20%) and Networking (15–20%), the next tier down. Give these solid, focused time, especially networking if it’s not your background.
3. Monitoring and Maintenance (10–15%), smallest weight, but don’t treat it as optional. A well-prepared candidate should still be comfortable with every skill listed above.

A practical rule of thumb: if you have roughly 10 weeks to prepare, spend about 2 weeks each on identities/governance and compute, 1.5 weeks each on storage and networking, and 1 week on monitoring, with the final week reserved for full-length practice exams and reviewing weak areas.

Is the AZ-104 Exam Difficult?

Here’s an honest, balanced answer: AZ-104 is moderately difficult, and where you land on that spectrum depends heavily on your background.

Factors that make it challenging:

• The exam covers five broad domains, and you’re expected to have working knowledge across all of them, there’s no way to specialize in just compute or just networking and skip the rest.
• Many questions are scenario-based rather than pure recall, requiring you to apply multiple concepts together (for example, a networking question that also touches identity-based access).
• The scaled 700/1000 passing score means you can’t easily predict your result from how the exam “felt.”
• Some skills, like evaluating effective NSG rules or interpreting Bicep files, require hands-on practice, not just reading. Candidates who only read documentation without lab time tend to struggle here.
• Time pressure is real: 100 minutes for 40–60 questions, some of which are multi-part case studies, doesn’t leave much room for second-guessing.

Who finds it easier: Candidates already working as system administrators, IT support engineers, or in any hands-on Azure role tend to find the exam very manageable, because much of the content maps directly to tasks they already perform. Familiarity with PowerShell or the Azure CLI also helps significantly, since several exam questions are framed around command-line or scripted operations.

Who finds it harder: Candidates coming from a pure development background with limited infrastructure or networking exposure, or those studying exclusively from theory without ever opening the Azure portal, tend to find the networking and compute domains more difficult. If that describes you, weight your lab time accordingly.

AZ-104 rewards genuine hands-on experience over memorization. It is absolutely passable with focused study and lab practice, but it is not an exam you can cram for using flashcards alone.

Best Study Resources & Study Guides for AZ-104 (2026)

If you’re looking for a single azure az 104 study guide to anchor your prep, start with Microsoft’s own resources, they’re guaranteed to reflect the current April 2026 outline, and everything else should be measured against them:

• Microsoft Learn’s AZ-104 learning paths, free, self-paced modules that map directly to each skill area, including hands-on sandbox exercises. Best for building foundational knowledge domain by domain.
• The official AZ-104 study guide on Microsoft Learn’s certification site, the authoritative source for the current skills-measured outline and change log. Best for confirming exactly what’s in scope before you commit to any paid material.
• Microsoft’s free Practice Assessment, a low-stakes way to see how questions are framed before you commit to a paid practice exam. Best for a quick, no-cost readiness check.
• Exam Readiness Zone and Azure Fridays video series, useful for reinforcing specific topics in a more conversational format. Best when you learn better by watching a scenario walked through than by reading documentation.

In addition to Microsoft’s official materials, a structured AZ-104 study guide that maps directly to the September 2026 skills outline can significantly speed up your preparation. You can also review a complete AZ-104 exam guide covering format, cost, passing score, and skills measured for a clear overview before diving deeper into each domain.

Third-party resources can genuinely add value, but they serve different purposes depending on where you are in your prep, look for a track record of aligning to the current objectives and explaining why an answer is correct, not just providing the answer itself:

• Instructor-led video courses that explicitly reference the April 2026 skills outline and update their content whenever Microsoft changes it, best for structured, guided learning if you’re newer to Azure.
• Hands-on lab platforms that let you provision real (or simulated) Azure resources rather than just reading static screenshots, best for closing the gap between knowing a concept and actually being able to do it.
• Community resources like Microsoft Q&A and Azure-focused forums, best for clarifying specific conceptual sticking points once you’ve already worked through the core material.

Whatever combination you choose, cross-check the table of contents against the official skills-measured list above before you buy anything. If a resource is missing a topic, or still uses old terminology like “Azure Active Directory” instead of Microsoft Entra ID, or doesn’t mention Azure Container Apps, it’s outdated.

About Practice Questions and Brain Dumps

This deserves a direct, honest answer: are there brain dumps available for the AZ-104 exam? Unfortunately, yes, a search for “az 104 exam questions and answers” or “az 104 exam topics with answers” will surface sites claiming to have real, leaked exam questions. You should not use them, and here’s why.

Why brain dumps are a bad idea:

• They violate the Microsoft Certification Agreement. Every candidate agrees not to share or use actual exam content. Microsoft actively monitors for this and has revoked certifications and banned candidates who are found to have used braindump material.
• They’re frequently wrong or outdated. Because dumps are scraped from memory or old leaked sets, they often reflect exam versions from before the April 2026 update, meaning you’d be memorizing incorrect answers to a version of the exam that no longer exists.
• They don’t build real skill. Even if a dump happens to contain a real question, memorizing an answer without understanding the underlying concept leaves you unable to perform the job the certification is supposed to validate, which shows up quickly in an actual role.
• The ethical cost is real. Azure certifications carry weight specifically because employers trust that certified professionals earned them legitimately. Using dumps undermines that trust for everyone holding the credential.

What to use instead: Legitimate AZ-104 practice tests and scenario-based mock exams are the best way to validate readiness without risking your certification. You can also review carefully curated AZ-104 Microsoft Azure Administrator exam questions that focus on understanding rather than memorization, plus a full guide on how to prepare for AZ-104 with mock exams.

Frequently Asked Questions FAQ’s

What topics are covered in the AZ-104 exam?

The AZ-104 exam covers five domains: managing Azure identities and governance (20–25%), implementing and managing storage (15–20%), deploying and managing Azure compute resources (20–25%), implementing and managing virtual networking (15–20%), and monitoring and maintaining Azure resources (10–15%). Each domain includes a specific list of skills, from managing Microsoft Entra users to configuring Bicep deployments to setting up Azure Backup, all detailed in the breakdown above.

Is the AZ-104 exam difficult?

It’s moderately difficult, particularly for candidates without hands-on Azure experience. The exam rewards practical, lab-based preparation over memorization, and its scenario-based questions require you to apply concepts across domains rather than recall isolated facts.

What is the best study guide for the AZ-104 exam?

Start with Microsoft’s own official study guide and free Learn modules, since they’re guaranteed to reflect the current skills-measured outline. Supplement with a reputable third-party course or lab platform that explicitly references the April 2026 update and includes hands-on practice, not just video lectures.

Are there brain dumps available for the AZ-104 exam?

They exist online, but using them violates Microsoft’s certification agreement, risks a ban or revoked certification, and frequently teaches outdated or incorrect information. Use legitimate practice tests instead.

How many questions are on the AZ-104 exam?

Typically between 40 and 60 questions, delivered in a mix of formats including multiple choice, drag-and-drop, hot area, and case studies, within a 100-minute time limit.

How long is the AZ-104 certification valid?

One year from the date you pass. You can renew for free by passing an online renewal assessment through Microsoft Learn, available starting six months before your certification expires.

Final Tips to Pass the AZ-104 Exam in 2026

• Study the April 17, 2026 outline specifically, don’t rely on any material that predates it, especially around identity terminology and container services.
• Prioritize by weight, not by personal interest, give identities/governance and compute the most hours since they carry the most weight.
• Get hands-on, even in a free-tier subscription. Reading about NSG rule evaluation is not the same as building conflicting rules and tracing which one wins.
• Practice reading Bicep files, not just ARM JSON, this is one of the more noticeably expanded skills in the current outline.
• Use timed, full-length practice exams in your final week to build stamina for the 100-minute format and get comfortable with case-study pacing.
• Skip the dumps entirely. They put your certification at risk and won’t prepare you for the job the credential represents.

Conclusion

The AZ-104 exam topics for 2026 reflect a real shift in what it means to administer Azure day to day, heavier emphasis on identity and governance, deeper container coverage, and a networking domain that, while slightly reduced in weight, is still substantial. Understanding exactly how these five domains break down, and studying in proportion to their weight, is the single highest-leverage thing you can do to prepare efficiently.

Start with Microsoft’s official AZ-104 study guide and free Learn modules, build real hands-on experience in a live or sandbox Azure environment, and use legitimate practice tests to validate your readiness. Do that consistently, and the AZ-104 certification is well within reach.