Azure

AZ-104 Complete Guide: Microsoft Azure Administrator Associate Exam Scope, Study Resources & Pass Strategy

2026-05-24

NicheeLab Editorial Team

Microsoft Certified: Azure Administrator Associate (AZ-104) is the flagship certification for Azure operations administrators, and the most-requested Azure credential in Japanese job listings. Where AZ-900 was a concept-focused Fundamentals exam, AZ-104 is an Associate-tier exam that tests hands-on implementation skills across the Azure portal, Azure CLI, PowerShell, ARM templates, and Bicep. The difficulty is in another league entirely. This article walks through all 5 exam domains, the hands-on practice you cannot skip, a 3-4 month pass roadmap, and what to do with your AZ-104 once you have it.

The biggest value of AZ-104 is that it is the foundation for every advanced certification — Architect (AZ-305), DevOps (AZ-400), Network (AZ-700), and Security (SC-500). Whatever Azure role you target, AZ-104 operational knowledge is the required baseline. Microsoft's own certification roadmap explicitly positions it as the starting point for the Azure Associate / Expert tracks. "If you're not sure where to start, start with AZ-104" is the standard industry advice.

AZ-104 Exam Specifications

AZ-104's exam specs follow the standard Associate tier.100 minutes, 40-60 questions, a passing score of 700 / 1000, $165 USD / JPY 21,103, and 12 months of validity (renewable via the renewal assessment). You can take it online via OnVUE or at a Pearson VUE test center, in multiple languages including Japanese. The question format mixes multiple choice with case studies (scenario questions), drag-and-drop questions, and lab questions (where you complete tasks in the actual Azure portal UI — recently in decline).

Domain 1: Manage Identities and Governance (20-25%)

The first domain covers the identity and governance layer that controls everything in Azure. Core topics: Microsoft Entra ID (formerly Azure AD) user and group management, on-prem AD sync via Entra Connect, resource access via Azure RBAC, compliance enforcement via Azure Policy, Resource Lock (CanNotDelete / ReadOnly), resource classification via Tags, and budget control via Azure Cost Management. The full set of organizational governance tools is in scope.

The biggest trap in this domain is confusing Microsoft Entra ID roles with Azure RBAC roles. Global Administrator is an Entra tenant management role, not an Azure resource operation role — this distinction will absolutely come up on the exam.

Domain 2: Implement and Manage Storage (15-20%)

The storage management domain, centered on Azure Storage Account. Topics include Storage Account types (Standard / Premium, StorageV2 / BlobStorage / FileStorage), replication options (LRS / ZRS / GRS / GZRS / RA-GRS) and how to choose between them, Blob tiers (Hot / Cool / Cold / Archive) and lifecycle management policies, SMB / NFS shares via Azure Files, access control via SAS tokens and Stored Access Policy, and data transfer with Azure Storage Explorer and AzCopy.

For hands-on practice, walk through this end-to-end flow once: create a Storage Account, upload a file to a Blob container, and configure a lifecycle policy that automatically tiers blobs to Cool after 30 days and Archive after 180 days. Going through this once dramatically sharpens your response to exam scenarios.

Domain 3: Deploy and Manage Azure Compute Resources (20-25%)

Tied for the highest weight in the exam, this domain covers Azure's full compute portfolio. Core: Azure Virtual Machine (VM) create / manage / scale, autoscaling via Virtual Machine Scale Sets (VMSS), VM snapshots via Azure Backup, and DR (disaster recovery) design via Azure Site Recovery. Plus App Service and deployment slots, and the container services Azure Container Instances (ACI), Azure Container Apps, and Azure Kubernetes Service (AKS).

The single most frequently tested topic in this domain is VM high availability design. The three layers — Availability Set (redundant placement within a region), Availability Zone (distributed across 3 datacenters), and Region Pair (geo-redundancy) — and when to use each are guaranteed exam material.

Domain 4: Implement and Manage Virtual Networking (15-20%)

The networking domain — partially overlapping with AZ-700 (Network Engineer). Core: Virtual Network (VNet) and Subnet design, VNet Peering (intra-region and Global), traffic control via Network Security Group (NSG) and Application Security Group (ASG), Azure DNS and Private DNS Zones, on-prem connectivity via VPN Gateway, and dedicated-line connectivity via ExpressRoute.

On top of that, the load balancer family — Azure Load Balancer (L4), Application Gateway (L7 + WAF), Front Door (global CDN + WAF), and Traffic Manager (DNS-based) — and when to use each is a high-frequency topic.

Domain 5: Monitor and Maintain Azure Resources (10-15%)

The monitoring and operations domain. Core: Azure Monitor with its Metrics, Logs (Log Analytics workspaces), and Alerts; APM via Application Insights; BCP / DR via Azure Backup and Azure Site Recovery; network diagnostics via Network Watcher; and best-practice recommendations via Azure Advisor.

KQL (Kusto Query Language) shows up frequently in this domain. Deep syntax is not tested, but you are expected to be able to read and write basic Log Analytics queries like AzureActivity | where ....

3-4 Month Pass Roadmap

A 3-month plan assuming 1-3 years of IT experience plus AZ-900 already in hand.Month 1: Work through the Microsoft Learn AZ-104 learning path (Identities / Storage), and do one full cycle of building Resource Group / VM / Storage Account in the portal.Month 2: Study Compute / Networking domains. Hands-on: VNet construction, VM-to-VM communication, NSG configuration, VPN Gateway setup.Month 3: Monitor / Backup domains and wrap-up. Iterate on the official Practice Assessment until you can score 80%+, and revisit weak areas on Microsoft Learn. If you don't have AZ-900 and have zero other-cloud experience, add 1-2 months for a realistic 4-5 month plan.

What to Aim For After AZ-104

AZ-104 is the centerpiece of the Azure certification track, and it leaves you with the widest set of next-step options. For architects, go to AZ-305 (Solutions Architect Expert) — design-judgment-centered Expert tier and the staircase to senior architect roles in the JPY 8M-12M range. For DevOps, go to AZ-400 (DevOps Engineer Expert) covering CI/CD, IaC, GitOps, and SRE practices. For networking specialization, AZ-700 (Network Engineer Associate). For security specialization, SC-200 / SC-300 / SC-500. To combine with data, pair with DP-203 / DP-700 — a dual-track that the job market values highly.

Frequently Asked Questions

What kind of exam is AZ-104?

Microsoft Certified: Azure Administrator Associate (AZ-104) is the flagship certification for Azure operations administrators. It runs 100 minutes, has 40-60 questions, costs $165 USD, requires 700/1000 to pass, is valid for 12 months, and is offered in multiple languages including Japanese. The exam tests hands-on implementation skills across the Azure portal, Azure CLI, PowerShell, ARM templates, and Bicep, and is dramatically harder than Fundamentals (AZ-900). It is the most-requested Azure certification in Japanese job listings and the de facto required foundation for Expert-tier certifications like AZ-305 and AZ-400.

Can I pass AZ-104 without taking AZ-900 first?

Yes. AZ-900 is not a prerequisite for AZ-104. People with hands-on experience in another cloud (AWS or GCP) or with on-prem Windows Server / Hyper-V operations frequently jump straight to AZ-104 and pass. On the other hand, people with 1-3 years of general IT experience but no cloud background tend to finish AZ-104 faster and with a higher pass rate when they learn the vocabulary and big picture via AZ-900 first.

What are the exam domains and weightings?

The exam has 5 domains. Manage identities and governance (20-25%) covers Microsoft Entra ID, RBAC, locks, and cost management. Implement and manage storage (15-20%) covers Storage Account, Blob, and Files. Deploy and manage Azure compute resources (20-25%) covers VM, VMSS, and containers. Implement and manage virtual networking (15-20%) covers VNet, NSG, VPN, and ExpressRoute. Monitor and maintain Azure resources (10-15%) covers Azure Monitor and Backup. The exam is heavy on implementation-style questions (PowerShell commands, JSON templates, portal click-paths), so hands-on experience is essentially mandatory.

How many study hours does it take to pass?

The typical range reported in Japanese write-ups is 100-150 hours for IT beginners, 60-100 hours if you already have AZ-900, and 40-80 hours if you come from another cloud. The standard recipe is the Microsoft Learn AZ-104 learning path (about 60 hours of content), the official Practice Assessment, and at least three end-to-end cycles of hands-on work in the Azure portal (provisioning a VM, building a VNet, and doing Storage operations). Three to four months of focused study is enough to reach passing range. For working professionals studying evenings and weekends, a six-month plan is realistic.

How much hands-on practice do I need?

Every pass report has one thing in common: the candidate had built and torn down a VM, VNet, and Storage Account in the portal at least once. Concretely: (1) create a Resource Group, spin up a VM, and successfully RDP/SSH into it; (2) build a VNet, split it into two subnets, and confirm VM-to-VM connectivity; (3) create a Storage Account and upload/download a file to a Blob; (4) take at least one VM snapshot with Azure Backup. A new Azure account comes with $200 USD / 30 days of free credit, so there is no additional cost.

What is the exam fee and how do you pay?

$165 USD / JPY 21,103 (incl. tax), paid by credit card through Pearson VUE is the standard. The Associate tier has no direct free-voucher route like Microsoft Virtual Training Day for Fundamentals, but you can still get discounts or free attempts through Microsoft Reactor free hands-on events, Cloud Skills Challenge completion vouchers, enterprise Microsoft Azure Pass agreements, or completion vouchers from training courses that include AZ-104. The step-up cost works out to JPY 13,200 for AZ-900 plus JPY 21,103 for AZ-104.

How does certification renewal work?

AZ-104 is valid for 12 months, and you can renew via a free renewal assessment on Microsoft Learn starting 6 months before expiry. The renewal assessment is dramatically simpler than the live exam: about 25 questions, open-book (you can reference Microsoft Learn), and with a lower passing score. If you let it expire, you have to pass the full exam again ($165 USD), so setting a reminder and renewing on time is essential. Credly also sends email expiry notifications.

What certification should I take after AZ-104?

It depends on your direction. To become an architect, go for AZ-305 (Solutions Architect Expert) and its design-judgment focus. For DevOps, AZ-400 (DevOps Engineer Expert) covers CI/CD, IaC, and SRE practices. For network specialization, AZ-700 (Network Engineer Associate). For security, SC-200 / SC-300 / SC-500. If you want to combine with data, pair with a data Associate such as DP-203 / DP-700. AZ-104 is the foundation for every advanced Azure certification, so it leaves you with the widest set of post-cert options.

Check what you learned with practice questions

Practice with certification-focused question sets

View Azure exam prep page

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

Azure

AZ-900 Azure Fundamentals: Complete Exam Guide (2026)

Pass AZ-900 — cloud concepts, Azure architecture, management...

Azure

Azure Certification Roadmap: Which Cert to Take Next (2026)

Choose your Azure certification path — Fundamentals, Associa...

Azure

AI-901 Azure AI Fundamentals (Beta): Complete Guide (2026)

Pass AI-901 — Microsoft Foundry, generative AI, responsible ...

Azure

Microsoft Entra ID Fundamentals for Azure Certs (2026)

Entra ID basics every cert candidate needs — tenants, identi...