AZ-104 Azure Administrator: A 30-Day Prep Guide

AZ-104 is Microsoft''s most valuable certification for hands-on cloud administrators. It is also the exam where over-preparation and under-labbing sink otherwise strong candidates. This 30-day plan is structured around what the 2026 exam actually scores heavily - identity, networking, and governance - and uses labs, not videos, as the primary study medium.

§What AZ-104 tests in 2026

§The 30-day plan

Days 1–5 - Identity and governance

Configure Entra ID (formerly Azure AD) users, groups and administrative units. Assign RBAC roles at three scope levels (management group, subscription, resource group) and watch permissions inherit or break. Enable a Conditional Access policy that blocks legacy authentication.

Days 6–10 - Storage

Deploy a Storage Account, then break it on purpose - generate a stored-access-policy SAS and revoke it. Move blobs between hot, cool and cold tiers using lifecycle management. This is where PBQs frequently test candidates.

Days 11–17 - Compute

Deploy VMs across zones, resize a running VM, attach and grow a managed disk, and set up backup with Recovery Services Vault. Build a VM Scale Set with autoscale rules and confirm scale-in policies. Add Azure Container Instances and App Service to your fluency list.

Days 18–24 - Networking

This is the domain that decides borderline scores. Configure two virtual networks, peer them, and force traffic through a firewall using UDRs. Layer NSGs at both subnet and NIC and understand how they evaluate. Add VPN Gateway (S2S) and Application Gateway with WAF.

Days 25–27 - Monitoring

Deploy Log Analytics, ship VM logs, and write five KQL queries - a simple time filter, a summarise, a join, a workspace-scoped query, and an alert rule.

Days 28–30 - Mocks and exam day

Two full-length timed mocks, one lab-focused mock. Fix your weakest area the day before. Sleep before you sit.

§Labs you cannot skip

• RBAC at three scopes plus custom role JSON
• Conditional Access with named locations
• Blob lifecycle policy across three tiers
• VM Scale Set with autoscale + Availability Zones
• VNet peering with UDR and NVA
• NSG rule evaluation traced end to end
• Application Gateway with WAF and backend health
• Log Analytics workspace with five KQL queries
• Azure Backup and restore for a VM
• Azure Policy assignment with remediation task

§Exam-day PBQ tactics

• Read the entire scenario before opening the portal simulator
• Never over-configure - extra settings usually cost points
• Use tags - case-sensitive naming trips candidates every window
• If the portal simulator is slow, use PowerShell / Azure CLI when the question allows

§Frequently asked questions

Is AZ-104 harder than AZ-900?

Significantly. AZ-900 is a broad fundamentals exam most candidates pass in under two weeks. AZ-104 is a hands-on administrator exam and expects genuine portal fluency.

How much lab time do I need?

Plan at least 40 hours in an Azure sandbox or personal subscription. Microsoft''s free-tier plus its $200 credit is enough if you shut down resources at the end of each session.

Do I need AZ-900 before AZ-104?

No. AZ-900 is not a prerequisite. If you already work with cloud daily, skip AZ-900 and go direct to AZ-104. If you are a beginner, AZ-900 provides a gentler on-ramp.

How does AZ-104 renew?

Microsoft role-based certifications renew for free through an annual online assessment on Microsoft Learn. AZ-104 is valid for one year after each renewal - set a reminder.