You studied for weeks. You watched every YouTube video. You read every blog post. And you still failed the AZ-104 on your first attempt. You’re not alone—industry estimates put the first-time fail rate somewhere between 40% and 60%. The problem isn’t that the AZ-104: Microsoft Azure Administrator exam is impossibly hard. The problem is that most people study for the wrong exam.
The AZ-104 doesn’t test whether you can recite Azure service names. It tests whether you can administer Azure infrastructure under realistic constraints—identity management, networking, storage, compute, and monitoring—across 40 to 60 questions in about two hours. If your study plan doesn’t reflect that reality, you’re memorizing flashcards for a performance exam.
What the AZ-104 Actually Tests
The exam validates intermediate-level expertise across five weighted domains. Not beginner-level. Not architect-level. The sweet spot where you’re expected to have roughly six months of hands-on Azure experience and the ability to make real configuration decisions without someone holding your hand.
Here’s what you’re walking into. The exam covers managing Microsoft Entra ID (formerly Azure Active Directory) users, groups, and role assignments. It covers storage accounts, blob tiers, and redundancy options. It covers deploying VMs, containers, and App Service apps. It covers virtual networking—subnets, NSGs, load balancers, DNS—which is where most people lose points. And it covers monitoring with Azure Monitor, Log Analytics, and backup strategies using Recovery Services vaults.
The weighting matters. Identity and governance plus compute eat up 40-50% of the exam. Networking and storage cover another 30-40%. Monitoring gets 10-15%. If you spend equal time on all five domains, you’re over-investing in monitoring and under-investing in the sections that determine your score.
Reality Check: The current exam objectives include Bicep as a required skill alongside ARM templates, and soft delete for blobs and containers is explicitly tested. If your study materials don’t cover Bicep and container soft delete, you’re studying for a version of the exam that no longer exists.
The Five Domains, Ranked by Difficulty
Not all domains are created equal. Here’s where people actually struggle, based on community feedback and the exam’s own weighting.
Networking is the wall. Virtual networking consistently ranks as the hardest domain. Subnets, peering, NSG priority rules, the difference between Azure Load Balancer (Layer 4) and Application Gateway (Layer 7), private endpoints versus service endpoints—if you can’t diagram these relationships on a whiteboard, you’re not ready. The questions aren’t “what is a VNet?” They’re “given this network topology with these NSG rules, which traffic is allowed?”
Identity trips people up on scope. Role-Based Access Control (RBAC) questions test whether you understand inheritance. A Contributor role at the subscription level grants permissions to every resource group and resource beneath it. The exam loves questions about what happens when you assign conflicting roles at different scopes. If you haven’t practiced assigning roles at management group, subscription, resource group, and resource levels, you’ll second-guess yourself on exam day.
Storage is deceptively straightforward. You need to know the difference between LRS, ZRS, GRS, and GZRS redundancy options—and when to use each. You need to understand Shared Access Signatures (SAS) for granular access without handing out account keys. And you need to know blob access tiers: Hot for frequent access, Cool for infrequent access with a 30-day minimum, and Archive for rare access with a 180-day minimum and significant retrieval latency. Soft delete gets tested heavily—know how to configure it for both blobs and containers, and understand the retention period behavior.
Compute is broad but predictable. VMs, availability sets versus availability zones, Azure Container Apps versus Azure Container Instances versus AKS, App Service plans and deployment slots. Bicep is the curveball here. You don’t need to write Bicep from scratch, but you need to interpret Bicep files, understand parameterization, and know how to convert an ARM template to Bicep. If you’ve never touched Bicep, budget at least a few days of hands-on practice.
Monitoring is the smallest domain, but don’t skip it. Azure Monitor, Log Analytics workspaces, Kusto Query Language (KQL) basics, alert rules and action groups, and Recovery Services vault configuration for backup and restore. This domain is worth 10-15% of your score. Spending two days on it instead of five is a reasonable allocation—but spending zero days is how you lose those easy points.
Build Your Study Plan Around Doing, Not Reading
Here’s where most study guides fall apart. They give you a reading list and wish you luck. Reading about Azure networking doesn’t teach you Azure networking. You need to be running commands, breaking things, and fixing them.
Start with the Microsoft Learn AZ-104 learning path. It’s free, it’s comprehensive, and it’s structured around the exam objectives. But don’t just read the modules. Open the Azure portal—or better, open a terminal—and follow along. Every az CLI command and every PowerShell cmdlet in those modules should be something you’ve run yourself.
Pro Tip: Set up an Azure Free Tier account if you don’t have one. You get $200 in credits for 30 days, plus 12 months of free-tier services. That’s enough to build and destroy every lab environment you’ll need. Just set a budget alert so you don’t accidentally spend real money on a forgotten VM.
Next, work through the official AZ-104 lab exercises on GitHub. Labs 01 (identity), 04 (networking), and 10 (data protection) are consistently cited as the most exam-relevant. One note: security updates now require you to manually provide passwords during template deployments in these labs, so don’t be surprised when the instructions don’t match exactly.
For video content, John Savill’s AZ-104 Study Cram on YouTube is the closest thing to a cheat code the community has found. His whiteboard explanations of networking and identity concepts translate directly to exam question patterns. Watch the study cram after you’ve done the hands-on work, not before—it’s a review tool, not a substitute for practice.
Practice exams matter more than you think. Tutorials Dojo and MeasureUp both offer practice tests that mimic the format, ambiguity, and difficulty of the actual exam. The real exam questions aren’t clean multiple-choice with one obvious answer. They’re scenario-based with two plausible answers and one subtle detail that makes the difference. If your practice tests feel easy, they’re the wrong practice tests.
Exam Day Strategy
The AZ-104 isn’t just a knowledge test—it’s a time management test. With 40 to 60 questions in roughly 120 minutes, you’re averaging about two minutes per question. That sounds fine until you hit a case study that eats 15 minutes.
Case studies appear at the beginning or end of the exam. Read the questions first, then scan the documentation for the specific details those questions ask about. Reading the entire case study background before looking at the questions is a trap—you’ll waste five minutes absorbing information you don’t need.
The exam includes open-book access to Microsoft Learn. You can search official documentation during the exam. Before you celebrate, understand the catch: the clock doesn’t stop, the search is limited to Microsoft Learn content (no forums, no Stack Overflow, no external search engines), and the search functionality is slow. Use it only when you’re genuinely 50/50 on a question and need to verify a specific SKU limit or configuration parameter. If you’re looking up basic concepts during the exam, you didn’t study enough.
Warning: Drag-and-drop and hot area questions take significantly longer than multiple-choice. Budget extra time for these. If you’re running behind, flag complex questions and come back to them—but remember you can’t return to case study sections once you leave them.
What a Passing Score Looks Like
You need a 700 out of 1000 to pass. That’s not 70%—the scoring uses a scaled model that accounts for question difficulty. Some questions are worth more than others, and the exact algorithm isn’t public. What this means practically: you can afford to miss questions, but you can’t afford to miss easy questions. Getting the monitoring and storage questions right while bombing networking is a viable passing strategy. Getting networking right while missing easy identity questions is not.
The certification is valid for one year. Renewal is free—you take an online assessment through Microsoft Learn without scheduling a proctored exam. If you let it lapse, you retake the full exam at full price. Set a calendar reminder.
| Domain | Weight | Study Priority |
|---|---|---|
| Identity & Governance | 20-25% | High—scope and RBAC questions are tricky |
| Storage | 15-20% | Medium—predictable but details matter |
| Compute | 20-25% | High—Bicep is new and broadly tested |
| Networking | 15-20% | Critical—highest failure rate |
| Monitoring | 10-15% | Lower—but don’t skip it entirely |
| Resource | Best For | Cost |
|---|---|---|
| Microsoft Learn AZ-104 Path | Structured study, all objectives | Free |
| GitHub Lab Exercises | Hands-on practice | Free (Azure costs may apply) |
| John Savill’s Study Cram | Concept review, whiteboard explanations | Free |
| Tutorials Dojo Practice Tests | Exam simulation, question patterns | Paid |
| MeasureUp Practice Tests | Official-style practice questions | Paid |
The Real Secret to Passing
There isn’t one. You study the five domains, you run the commands, you take practice tests until you’re consistently scoring above 80%, and then you schedule the exam. The people who fail aren’t failing because they’re not smart enough. They’re failing because they read about Azure instead of using it, they studied outdated materials, or they underestimated networking.
If you’re scoring 85%+ on practice exams from Tutorials Dojo or MeasureUp, you’re ready. If you can explain the difference between a service endpoint and a private endpoint without looking it up, you’re ready. If you’ve deployed a VM, peered two VNets, configured an NSG, and set up a Recovery Services vault backup policy—all from the CLI—you’re ready.
Schedule the exam. Pass it. Then forget everything you learned about Azure Policy inheritance until you need it at work. (You will.)
