*April 2026* AZ-104 Microsoft Azure Administrator

Learn how Azure accounts, subscriptions, and resource groups organize enterprise resources and billing under an Azure enterprise agreement, with governance through management groups, policy, and RBAC.

Explore how resource groups act as containers organizing resources by lifecycle and region, enabling role-based access control and policies that govern deletion and provisioning.

Discover resource groups and tagging in Azure portal. Create groups by subscription and region, manage tags like cost center and business owner, and explore policies, management groups, and lifecycle considerations.

Explore how Azure regions serve as resource locations with data centers, while availability zones offer fault-tolerant disaster recovery within a geography and support data residency and compliance.

Clarify the difference between tenants, subscriptions, and licensing models in Azure. Learn how to associate a subscription with an Azure AD tenant and understand licensing for SaaS, PaaS, and IaaS.

Explore core identity services in Azure, including Azure AD, Active Directory Domain Services, and Azure AD Domain Services, with authentication, single sign-on, app management, device management, and B2B/B2C.

Explore Entra ID features within Azure AD, including on-prem directories, sync options, and single sign-on, plus authentication and authorization concepts with OpenID Connect, OAuth 2.0, and SAML.

Microsoft renames Azure AD to Entra ID, part of the Entra identity and access solutions family, with Entra free, Entra P1, Entra P2, and Entra external ID updates.

Create a new Entra ID tenant in the Azure portal, configure the organization name, domain, and geographic location, and manage tenants, users, and subscriptions across multiple tenants.

Learn to create users and groups in an Azure tenant, assign them to groups or roles, and manage directory permissions with security groups and owners.

Explore Azure AD B2C and B2B, enabling customers to sign in with social or local accounts and external partners to access resources via invitations and self-service signups.

Apply conditional access to balance productivity and security by using signals like location, device, user groups, and app context, with Entra ID protection and Defender for cloud apps.

Organize Azure resources with resource groups as lifecycle-aligned containers from any region, then apply RBAC and policies, tag resources, and know that deleting a group removes all inside.

Learn to create resource groups in Azure portal, assign region metadata and tags like cost center and business owner, and govern identity and access management with management groups and policies.

Explore Azure resource locks that prevent accidental deletion by adding a protection layer before deleting resources. Choose cannot delete or read only, with read only being the most restrictive.

Explore resource locks in the Azure portal by applying delete and read-only locks to a resource group, demonstrating how locks prevent deletion while allowing changes.

Enforce governance in Azure by applying built-in or custom Azure policies, restricting actions across subscriptions or specific resource groups, created and then assigned via portal, ARM templates, or PowerShell.

Learn to govern Azure resources by creating resource groups, applying policy definitions and initiatives, and enforcing allowed locations across resource groups, subscriptions, and management groups.

Explore quotas, cost analysis, and tagging in the Azure portal, download cost reports, and plan a tagging strategy with environment, cost center, and security tags.

Master RBAC in Azure by mapping users, apps, and groups to roles such as owner, contributor, and reader, and exploring built-in and custom roles, scope, and actions.

Explore structured, semi-structured, and unstructured data in Azure storage and databases, including relational SQL data, NoSQL patterns, and blob storage, and learn how to tap insights from unstructured data.

Discover the benefits of Azure storage—durable, highly available, encrypted, and scalable—with replication options (LRS, ZRS, GRS, and read-only GRS) and core services (blobs, files, queues, tables, disks).

Create and manage a storage account in the Azure portal using storage v2, RA-GRS replication, hot storage, and public endpoints, then secure access with keys, SAS, RBAC, and private endpoints.

Demonstrates creating an Azure storage account with PowerShell, including resource group setup, location East US, and storage v2 by default. It also shows the kind option to use storage v1.

Learn to use azcopy to copy blobs between storage accounts and from local machines, covering download, version ten, Azure AD authentication, and SAS token requirements.

Explore blob storage from a storage account perspective, including containers and blobs, GPv2 supports block and page blobs for images, videos, and VM disks, with hot, cold, and archive tiers.

Learn to manage Azure blob storage access by configuring container public levels and using SAS tokens and stored policies for granular, secure permissions.

Create and manage shared access signatures in the Azure portal. Configure blob service permissions, start and expiry times, allowed IPs, and signing keys, then govern SAS via Storage Explorer policies.

Explore how Azure Key Vault stores secrets and encryption keys, supports hardware security modules, and enables customer managed keys to wrap storage account encryption keys for storage service encryption.

Explore Azure import/export to migrate data, distribute content, back up, and recover data by shipping encrypted disks via the portal and a command-line tool.

Explore custom domains for azure storage and cdn by mapping a DNS CNAME record, choosing direct mapping with potential downtime or using the AZ verify subdomain to avoid downtime.

Learn to create an Azure storage account and a file share with a ten gig quota. Connect to file share from Windows using a PowerShell drive and the account key.

Demonstrates Azure File Sync to cache and archive files from a local server to an Azure File Share, enabling cloud-endpoint synchronization and disaster recovery across regions.

Explore Azure compute services and Azure virtual machines, from hypervisor-based virtualization to CPU, memory, and storage configurations, including burstable, general purpose, memory-optimized, and N series options such as SAP Hana.

Create a Windows virtual machine in the Azure portal, covering image, size, disks, networking, and security settings, plus management options like auto shutdown and backup.

Demonstrates deploying a Windows Server 2022 virtual machine in Azure using PowerShell, including setting up a resource group, virtual network, public IP, and RDP access via Cloud Shell.

Deploy a virtual machine with Azure CLI by following a deploy VM script from the AZ-104 GitHub repo, creating a resource group, VNet, NSG, and SSH access on Ubuntu.

Move resources between resource groups in the Azure portal and validate with ARM providers. Understand cross-subscription considerations and updates to resource IDs in scripts after transfer.

Attach a data disk to a Windows Server VM in the Azure portal, format it with disk management, assign a drive letter, and note how VM size limits iops.

Protect Azure virtual machines from planned maintenance, unplanned hardware issues, and outages using availability sets and zones, with fault domains and update domains.

Configure and compare Azure availability sets and availability zones for virtual machines, specifying fault domains, update domains, regions, and resource groups in the Azure portal.

Explore how Docker containers package software and dependencies to isolate apps on a shared OS, enabling microservices, horizontal scaling, and data decoupling with Azure Kubernetes Service.

Install Docker Desktop for Windows and Git for Windows, enable Hyper-V and container features. Switch to Linux containers and verify Docker and Git versions.

Clone the azure voting app from microsoft samples on github, build and run containers with docker compose, test locally, and prepare the app for azure kubernetes service (aks).

Create a private Azure container registry with the Azure CLI and log in to Azure. Tag and push local Docker images to the registry, then verify repositories.

Create an Azure Kubernetes Service cluster by configuring a service principal, setting up an Azure Container Registry, and granting access, then connect with kubectl to verify the single ready node.

Discover serverless computing as an abstraction of infrastructure that enables building apps with pay-per-use pricing and seamless integration of Azure Functions, Logic Apps, and Event Grid through triggers and actions.

Discover Azure app services, including web, mobile, logic, and API apps, built on PaaS with auto scaling, DevOps deployment, and integrated security features.

Create an app service plan in the Azure portal, choose a subscription and resource group, select OS and pricing tier, and review scaling, deployment slots, and Linux vs Windows considerations.

Monitor app service plans with CPU, memory, data in/out, HTTP queues, quotas, and diagnostic logs via Azure portal, Kudu, Visual Studio, CLI, and Application Insights.

Explore creating and deploying a web app with Azure App Service, following the lab guide to configure deployment slots, environment variables, certificate management, and GitHub CI/CD for monitoring and scaling.