AZ-104 Microsoft Azure Administrator Certification

Explore the Azure portal through an initial tour, learn to navigate resources, subscriptions, and costing, and get familiar with Azure services like SQL Database, Azure Cosmos DB, and virtual machines.

Learn to deploy and connect to an Azure virtual machine, inspect deployment details and linked resources, and resize hardware to enable stable remote access.

Connect to a Linux machine from macOS using SSH, obtain the public IP address, and access the Linux web VM via the Azure portal with your username and password.

Learn to deploy a linux VM on Azure using ssh keys, generate a key pair with public and private keys, download and secure the private key, and connect via ssh.

Learn how to add data disks to Azure VMs, choose among standard hdd, standard ssd, premium ssd, and ultra disk, and understand iops and throughput for production workloads.

Discover how to use customer managed keys in Azure Key Vault to enable server-side encryption for data disks, including creating an encryption key and configuring RBAC.

Learn to automate post deployment with custom script extensions on Azure VMs, installing IIS on Windows or nginx on Linux during VM creation.

Understand how Azure Boot Diagnostics captures console output for Linux and screenshots for Windows during VM boot, helping administrators diagnose boot and kernel failures.

Create an Azure virtual machine scale set with uniform orchestration, using Ubuntu Server 24.0 and standard_b-1s, and configure per-VM networking and public IPs.

Explore configuring and scaling an Azure virtual machine scale set, adding manual and automatic rules based on CPU metrics, with min and max instance counts and monitoring integration.

Learn to create an Azure virtual machine scale set with flexible orchestration mode, apply allocation strategies (lowest price, capacity optimization, prioritizing size), and manage individual VMs alongside the scale set.

Upgrade your Azure App Service plan to standard to enable deployment slots, create a staging slot, deploy a new version, and swap traffic between production and staging with rollback capability.

Learn to deploy a two-container Azure container group with PHP and MySQL using a deployment.yaml in Azure container registry, exposed via a public IP on port 80.

Explore Azure fundamentals, including regions, subscriptions, resource groups, and RBAC, then deploy and manage virtual machines, containers, web apps, and container services.

Learn how IP addresses identify devices on a network, distinguish the network and host portions, and use CIDR blocks to allocate ranges for IPv4 and IPv6.

Carve a large IP space into smaller, routable blocks using CIDR blocks and subnet masks, and learn how 32-bit masks split network and host portions.

Learn to create an Azure virtual network from the wizard, define a private IP address space like 10.0.0.0/16, create a subnet 10.0.0.0/24, and understand network and subnet basics.

Explore the distinction between private IP addresses, not routable over the public internet, and public IP addresses, routable on the global internet, including subnet ranges and static IP lifecycles.

Install nginx on a web server and configure an NSG inbound rule to allow port 80 from the internet to the private VM, illustrating Azure NAT and default deny behavior.

Learn how network security groups evaluate inbound and outbound rules by priority, where the first matching rule denies traffic such as port 80, and default rules have fixed priorities.

Explore inter-VM communication within a virtual network using private IPs. See how default VNet rules enable internal access between database and web servers on port 80 via NAT.

Demonstrates outbound security rules in a network security group, including a deny all outbound rule, and the stateful nature that allows inbound responses.

Install the MySQL server on the database machine, bind to the private IP, restart the service, and configure a DB admin user with network security groups for secure two-tier connectivity.

Create a single network security group to control web and database subnet traffic, attach it to both subnets, and define inbound and outbound rules for internet and mysql access.

Connect isolated virtual networks with virtual network peering to enable traffic across networks via the Microsoft backbone, using a simple two-way wizard to link dev and test.

Create an empty Azure Bastion subnet in dev network and deploy Azure Bastion in basic tier to securely connect internal VMs via portal without public IPs; delete Bastion when finished.

Explore the NSG diagnostic utility to understand and debug network security group rules, using a database server example to check TCP traffic on port 3306 and view additional details.

Learn to configure NSG flow logs and virtual network flow logs for a subnet, store data in an Azure storage account, and analyze it with a Log Analytics workspace.

Create a user defined route in a route table to send traffic via the central zero one VM, enabling IP forwarding on the NIC and OS, and verify with curl.

Provision a standard regional Azure load balancer with a public ip and a vm scale set backend pool, configure a tcp port 80 health probe, and test the front-end ip.

Learn fundamentals of the domain name system, including mapping domain names to IP addresses, DNS query flow, and the role of authoritative name servers, in preparation for Azure DNS services.

Map a domain to an Azure VM by configuring DNS A records to point the domain to the VM's public IP, enabling access to nginx.

Design a private dns foundation in Azure VNets by building a 3-machine setup with Windows Server 2025, including a domain controller, DNS server, and a web server running IIS.

Install the Active Directory Domain Services role on a domain controller VM, promote it to a domain controller, and configure a private Cloud Hub Learning.com DNS forest.

Configure an internal private domain by setting a domain controller as the vnet dns server, joining machines to cloud learning.com, and managing forward lookup zones and A records.

Configure a MySQL database on a VM in an Azure virtual network, enable private connectivity from an Azure web app, and deploy a PHP application that connects securely.

Enable private communication between an Azure web app and its database by implementing virtual network integration. Create an empty subnet, delegate it, connect the app, and verify domain access.

Configure a custom domain for Azure web apps on the paid App Service tier, validate ownership with DNS A and TXT records, and enable https with a managed certificate.

Create an Azure storage account via the wizard, set resource group and location, choose locally redundant storage, enable encryption with Microsoft managed keys, and access blob, file, and queue services.

Learn to use Azure blob storage to store unstructured data like images and videos as objects by creating a container in a v2 storage account, uploading files as block blobs.

Explore Azure storage authorization techniques for blob service access, from anonymous access to storage account keys, and learn how shared access signatures provide temporary, fine-grained permissions.

Use the Azure Storage Explorer to securely connect to storage accounts, browse containers, upload, download, rename, delete, and generate shared access signatures.

Learn to use azure storage explorer on macOS to connect to a storage account with account key, then manage containers, upload and download objects, and file shares, queues, and tables.

Grant blob-level access with shared access signatures by generating tokens to provide time-bound, IP-restricted read permissions for specific blobs.

Learn to generate and use a container-level shared access signature to grant read and list permissions for blobs, test via URL and Azure Storage Explorer, and understand credential limits.

Create a storage account level shared access signature to grant blob service, containers, and objects with read and list permissions, start and expiry times, and IP restrictions.

Explore access tiers in Azure blob storage, including hot, cool, cold, and archive, and learn how to optimize costs by moving objects over time and managing minimum storage durations.

Explore blob snapshots in Azure storage accounts to capture read-only, point-in-time copies for backup and restoration, and promote a snapshot to the current blob version when needed.

Learn how Azure storage object replication copies block blobs asynchronously from source to destination storage account. Enable change feed and blob versioning on both accounts, and create replication rules.

Create a managed Azure file share with no server to manage and use access tiers like transaction optimized, hot, and cool to map the share to drive via a script.

Learn how to connect to an Azure storage file share from macOS by copying a script, mounting the share via terminal, and accessing images and scripts folders.

Take snapshots of the entire Azure file share to create a read-only copy. Restore a deleted file from the snapshot with options to copy and rename or overwrite.

Learn to use the AzCopy command line tool to copy blobs and files to and from an Azure storage account, create containers with SAS authentication, and perform recursive transfers.

Create a simple PowerShell script in Visual Studio Code to define and deploy an Azure resource group using variables, and authenticate with a device code before running the New-AzResourceGroup command.

Create an Azure virtual network with PowerShell by defining name, resource group, location, and address space 10.0.0.0/16 using New-Azure Virtual Network, run the VNet.ps1 script, and verify in the portal.

Create a network interface in Azure using PowerShell by defining the name, resource group, location, and IP configuration, then place it in a subnet of the existing virtual network.

Deploy an Azure web app with PowerShell by creating a free-tier app service plan and a Linux-based web app in a resource group located in Central US, using PHP 8.3.

Use the Azure CLI to create a resource group, log in with az login, and run az group create in a VS Code PowerShell wrapper, exploring parameter forms.

Create a network interface with Azure CLI, attach a public IP, and assign it to a subnet in a VNet.

Deploy an Ubuntu server 24.04 VM with a dedicated network interface in a virtual network, add an availability set and a 16 GB data disk, and configure SSH access.

Set up Visual Studio Code with the Azure Resource Manager extension, create a local templates folder, and begin building ARM templates in JSON with the ARM language server.

Build a simple ARM template in VS Code to deploy an Azure resource group, exploring the resources section, name, location, and API version, with a hands-on RG 104 example.

Learn how to deploy multiple storage accounts in a single arm template using a resource copy loop, with copy index-based dynamic naming and string functions like concat.

Deploy a public IP address with an ARM template by editing public IP.json, using resource group location, static allocation, and standard skew, and validate deployment through Azure.

Build a network interface in a virtual network using a JSON-based ARM template, configuring a dynamic private IP and linking to a subnet and public IP.

Create a secure string parameter for admin password in an ARM template, then deploy via PowerShell script to pass the password securely.

Learn how to pass parameter values from a separate JSON parameters file during an ARM template deployment, enabling environment-specific configurations like dev and staging.

Create a resource group in your subscription with a simple bicep file in VSCode, specifying name, East US location, and subscription scope, then deploy and verify the resource group.

Verify the completed deployment by confirming the network interface links to public IP and private subnet, then define a Bicep network security group with ssh rules for an ubuntu server.

Learn to deploy an availability set with two fault domains and five update domains using a Bicep file and attach a VM to the set.

Learn to design Azure infrastructure with Bicep, deploying virtual networks, subnets, and virtual machines while securing access with Azure Bastion, internal load balancers, and private endpoints.

Explore infrastructure with Bicep, deploying virtual networks, storage, subnets, and modules. Build Windows Server VMs, use Azure Key Vault and Bastion, with private IPs, internal load balancer, VNet peering.

Build infrastructure with bicep modules by creating a virtual network and subnets in VS Code, using parameters and modules to enable infrastructure as code.

Learn to build a virtual network with bicep modules and a dev parameters file, structuring vnet as an object with name, address prefixes, and subnets for environment deployments.

Attach a network security group to multiple subnets using a generic bicep module, employing a for loop and subnet blocks to link the NSG to two subnets in virtual network.

Deploy Windows Server 2025 VMs with bicep into existing Azure network and subnets, without public IPs, using key vault secrets for admin passwords, and scale with a count parameter.

Define outputs in Bicep modules to pass subnet ids back to main.bicep, using an output block and the subnet id function.

Deploy Windows VMs with Bicep, using for loops and module outputs to configure VNet subnets and NICs, while fetching admin passwords from Azure Key Vault.

Learn how to deploy custom script extensions with bicep to install a web server on Windows VMs, using a PowerShell script stored in a storage container and a SAS URL.

Deploy an internal load balancer with Bicep, using a private front-end IP, a back-end pool of VM NICs, a health probe, and load balancing rules.

Build a test network using bicep modules to deploy a virtual network and an Ubuntu Server VM, configure a private load balancer with http health checks, and enable vnet peering.

Learn to establish virtual network peering with Bicep modules, linking local and remote VNets to enable Bastion access and private IP address connectivity for an Ubuntu Linux VM.

Explore private endpoints that bring the storage blob service into your virtual network, assign a private IP, and use a private DNS zone for secure connectivity.

Azure storage encryption at rest uses server-side encryption by default with Microsoft managed keys, and supports customer managed keys from Azure Key Vault for blobs and files, plus encryption scopes.

Explore Microsoft Enter ID, a cloud identity and access management service formerly known as Azure Active Directory, handling authentication and authorization to secure Azure subscriptions, Microsoft 365, and SaaS apps.

Assign a role at the resource level using Azure RBAC, exploring resource group and subscription scopes and inheritance, with a hands-on example using the reader role on a virtual machine.

Explore assigning the contributor role at the resource group level to grant broad resource management, observe actions allowed and restricted, and see how adding multiple roles expands permissions across resources.

Explore Azure attribute based access control on top of role based access control to enforce fine grained permissions for storage blob data readers with conditional authorizations.

Explore assigning built-in Azure vm roles—vm user login, vm administrator login, and vm contributor—and manage access with Azure AD credentials and temporary access passes for secure login and vm management.

Learn to create Microsoft Entra ID custom roles by starting from scratch or cloning a custom role, with permissions set under roles and administrators, note this requires a premium license.

Invite external identities into Microsoft Entra ID, grant temporary access to resources using role-based access control, and manage invitations and acceptance across tenants.

Discover how to assign licenses to groups in Entra ID for group-based licensing, require P1+ subscriptions, and toggle service plans; nested groups do not grant licenses to their members.

Learn how to enable self-service password reset in Microsoft Entra, letting non administrator users change or reset passwords without helpdesk assistance, with Entra ID P1 licenses.

Explore resource tagging with key-value pairs added to resources, resource groups, and subscriptions to add business context. Filter costs by tags like environment and cost center.

Learn how management groups sit above multiple subscriptions to define a governance hierarchy, enable RBAC and policy inheritance to subscriptions, and manage costing and budgets per subscription.

Learn how management groups organize subscriptions under a tenant root group, create an information technology group, and apply the user access administrator role to all subscriptions.