How to Pass the Azure Administrator (AZ-104)
Manage Azure identities, governance, and resources.
Identity, networking, compute, storage — the AZ-104 tests operational command of Azure. We train the muscle memory for resource management decisions.
Exam Fee
$165
Questions
50
Duration
150 min
Pass Score
70%
AZ-104 tests how you configure Azure, not whether you know it exists
Every question assumes you can name the relevant service. What it actually scores is whether you understand how to configure it correctly and at which boundary. Azure Policy, RBAC, NSG, and Conditional Access all control access or compliance in different ways, and the exam routinely presents scenarios where the right service applied at the wrong scope is a wrong answer. Administrator-level certification means knowing that assigning a built-in RBAC role at the resource group is often the precise answer, and that a management group assignment to solve a single-subscription problem is scope overreach.
Full Certification Title
Microsoft Certified: Azure Administrator Associate
Exam Domains
Top Traps by Frequency
Whether declarative simplicity—one Bicep file plus environment-specific parameter files—outweighs the apparent modularity benefit of nested or linked ARM templa...
Whether to use a single Bicep file with environment-specific parameter files or a nested/linked ARM template set to satisfy repeatable, environment-separated de...
Whether to replace imperative New-Az* resource-creation cmdlets with a single New-AzResourceGroupDeployment call targeting an ARM template, accepting the declar...
Whether to assign an Azure Policy (DeployIfNotExists, CanNotDelete lock) once at the Production management group scope — which cascades to all current and futur...
Assign the Azure Policy definition at the Management Group that contains only the production subscriptions, not at the Tenant Root Group and not individually at...
Assign a deny-effect Azure Policy definition at the Production management group scope — not at each subscription individually and not at the tenant root managem...
Top Patterns by Frequency
Whether to use Entra ID dynamic group membership rules (requires P1/P2 license) or Azure PowerShell-scripted static group membership (works on free tier) when t...
Select the narrowest built-in RBAC role scoped to the subscription that grants sufficient Azure Policy management permissions without also conferring general re...
Should network-isolation for the storage account be enforced at the NIC or subnet layer (NSG) or at the storage account layer (storage firewall virtual network ...
Whether to configure customer-managed keys (CMK) backed by a Key Vault with RBAC authorization enabled, versus enabling only platform-managed SSE (satisfies enc...
Assign the Azure Policy definition at the Management Group that contains only the production subscriptions, not at the Tenant Root Group and not individually at...
Whether to assign an Azure Policy definition once at the management group scope—where it cascades automatically to all child subscriptions—or once per subscript...
Training Methodology
CloudReflex uses adaptive micro-scenario training that target your specific weakness profile. Each session adapts difficulty based on your accuracy, focusing on the traps and patterns where you lose the most points.
Learn more about the methodology →Ready to train for the AZ-104?
200 scenario questions. Pattern recognition and trap analysis. $12.99 one-time, lifetime access.