AZ-104 appears in more UK cloud job specifications than any other Microsoft certification, yet the majority of candidates who fail do so not because the material is beyond them but because they prepared for the wrong exam. They revised as though AZ-104 were a harder AZ-900, heavy on theory, light on the command line, with no real hands-on time in the portal. The result is a predictable set of failures: full marks on identity concepts, then dropped points on the networking and storage questions that require you to know not just what something does but how it behaves when you configure it incorrectly. For an engineer with AZ-900 or equivalent foundation knowledge, this exam is absolutely within reach in four to six weeks. The question is whether you spend those weeks on the material that actually gets tested.
This guide is written for cloud engineers who already have the foundational knowledge and want a clear, honest account of what the AZ-104 demands, where candidates lose marks, and how to build a study plan that reflects the real structure of the exam rather than an optimistic approximation of it.
What the Exam Actually Looks Like
AZ-104 is delivered via Pearson VUE, either at a test centre or through OnVUE online proctoring. Microsoft advertises 100 minutes of exam time for AZ-104, though sittings that include a lab component run to 120 minutes exam time with 140 minutes total seat time. You will see the confirmed duration when you launch the exam. For non-lab sittings, plan for roughly 120 minutes of total seat time to account for the NDA agreement, tutorial and post-exam survey.The pass mark is 700 out of 1000 on a scaled score. Microsoft uses scaled scoring, which means the 700 figure does not translate to a clean percentage of questions correct. Aim to understand the material well rather than calculating how many you can afford to miss.
The question count is no longer published by Microsoft, but passer reports since the April 2025 skills refresh describe 40 to 60 items. Formats include single-answer multiple choice, multi-select, drag-and-drop ordering, hotspot questions, build-list items, and scenario-based repeated question sets. Most sittings include one or two case studies embedded within the main exam clock rather than separately timed. Live performance-based lab components appear intermittently, Microsoft includes them at their discretion and removes them during Azure service disruptions, so treat them as a realistic possibility rather than a guaranteed format.
The exam’s five measured domains carry the following weightings: identity and governance at 20 to 25 per cent, storage at 15 to 20 per cent, compute at 20 to 25 per cent, virtual networking at 15 to 20 per cent, and monitoring and maintenance at 10 to 15 per cent. The April 2026 refresh, which shipped on 17 April 2026, left these weightings unchanged. Based on analysis by Microsoft MVP Mark O’Shea ahead of the update, it is a minor revision, the objectives are consistent with the post-2023 overhaul and nothing has been removed. The practical change is an increased emphasis on PaaS workloads within existing compute objectives, with Azure Container Apps and Azure Container Instances weighted more heavily relative to pure virtual machine administration. Candidates coming from an IaaS background should factor this in when allocating their study time.
The UK exam price sits at approximately £106 to £115 depending on the reseller; confirm the current GBP figure at Pearson VUE checkout rather than relying on any third-party quote. The certification is valid for 12 months and renews free of charge via an unproctored online assessment on Microsoft Learn. Book the exam under a personal Microsoft account rather than a work Entra ID account, if you leave your employer, work-account certification records are lost and cannot be recovered.
Domain by Domain: Where the Marks Come From
Identity and Governance (20 to 25 per cent)
This is the domain that underpins every other area of the exam, and it is where most candidates either win or lose the overall result. The core topics are Microsoft Entra ID user and group management (member versus guest accounts, Security versus Microsoft 365 group types, assigned versus dynamic membership rules), licence assignment, external B2B users, and self-service password reset configuration.
The heavyweight topic is Azure RBAC. You need to be able to read and interpret custom role definitions in JSON, including the Actions, NotActions, DataActions and AssignableScopes properties. Understand that RBAC assignments are additive, a user gets the union of all roles assigned to them, and that a deny assignment overrides allow regardless of other role assignments. NotActions is not a deny; it removes permissions from the Actions set but does not block them if another role grants them. Role assignment scope matters: management group, subscription, resource group and resource scopes all behave differently for inheritance purposes, and Entra ID directory roles such as Global Administrator are entirely separate from Azure RBAC roles. A Global Administrator does not automatically have any subscription access until they explicitly elevate through the “Access management for Azure resources” setting in Entra ID.
The Azure Managed Identity post on this blog covers the credential management patterns you will encounter in this domain in production depth, worth reading alongside your study guide to see how the concepts apply in real workloads.
Azure Policy is tested on effects (Deny, Audit, Append, Modify, DeployIfNotExists and AuditIfNotExists), assignment scope, compliance reporting and exemptions. Cost management covers budget alerts, cost analysis and Azure Advisor recommendations. Round out this domain with resource locks, tag management, resource groups, subscription management and management group hierarchy.
Storage (15 to 20 per cent)
Storage is the most memorisation-intensive domain and arguably the one where exam questions are most deliberately designed to catch candidates who learned the concepts without testing them. You need to know storage account kinds, GPv2 is the default for most workloads, with Premium BlockBlob, FileStorage and PageBlob available for specific scenarios, access tiers (Hot, Cool, Cold, Archive), and the full matrix of redundancy options: LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS.
The conversion rules are a consistent source of lost marks. There is no direct migration path between GRS and ZRS or between GZRS and LRS. Two-step conversions require a 72-hour wait between steps. Archive-tier blobs must be rehydrated before they can be migrated to a different redundancy tier. Boot diagnostics must be disabled before converting a storage account from LRS to ZRS. LRS that resulted from a geo-failover cannot be converted back to zone-redundant storage. Premium SSD Azure Files shares support only LRS and ZRS, never GRS, and Azure Files shares do not support read-access geo-redundant variants under any configuration.
SAS token types are examined closely. Account SAS, Service SAS, and the Entra-signed User Delegation SAS all have different creation mechanisms and revocation approaches. User Delegation SAS is the recommended modern approach because it is tied to Entra credentials rather than storage account keys, and a stored access policy can revoke a Service SAS without rotating the key. Blob lifecycle management, soft delete for blobs and containers, blob versioning, snapshots, and the AzCopy and Storage Explorer tooling round out this domain.
Compute (20 to 25 per cent)
Compute is the largest domain and the one most affected by the April 2026 update’s shift toward PaaS workloads. Virtual machine fundamentals remain heavily tested: sizing families, disk types (Standard HDD, Standard SSD, Premium SSD, Premium SSD v2 and Ultra, with Ultra unavailable as an OS disk and Premium requiring “s”-series VM sizes), disk encryption, and moving VMs across resource groups, subscriptions and regions.
The availability constructs are examined in combination. Availability sets use fault domains (default 2, maximum 3) and update domains (default 5, maximum 20) to provide a 99.95 per cent SLA; availability zones provide a 99.99 per cent SLA. These two are mutually exclusive at VM creation, a VM joins one or the other, never both. Virtual Machine Scale Sets with flexible orchestration mode cover scaling and management scenarios.
ARM template and Bicep knowledge has increased in emphasis since the 2023 overhaul. Expect questions that ask you to read, interpret, modify or deploy templates in either format, and to export or decompile existing deployments. The exam tests Bicep specifically, not just conceptual awareness but whether you can read a Bicep file and identify what it will deploy.
On containers, Azure Container Registry, Azure Container Instances and Azure Container Apps are all in scope, alongside App Service plans, deployment slots, TLS and custom domain configuration, and VNet integration for App Service. The slot swap behaviour is a reliable source of dropped marks: a swap moves all application settings and connection strings unless they are explicitly marked as deployment slot settings (sticky), in which case they stay with the slot rather than following the swap.
Virtual Networking (15 to 20 per cent)
Networking is the domain that causes the most failures relative to its weighting. Candidates who can pass the compute and identity sections confidently are often underprepared for the specificity required here.
VNet and subnet configuration is foundational. VNet peering is non-transitive, peering A to B and B to C does not give A access to C without a direct peering or a hub gateway. The “Allow gateway transit” and “Use remote gateway” settings on peering configurations are tested directly, particularly in hub-and-spoke scenarios where spoke VNets need access to on-premises networks via the hub’s VPN gateway.
NSG rule evaluation follows a strict order: rules are evaluated by priority with lower numbers evaluated first, and processing stops at the first match. The default rules at priorities 65000, 65001 and 65500 are frequently tested through scenario questions where candidates need to trace whether traffic will be allowed or denied. Inbound NSG evaluation processes the subnet NSG before the NIC NSG; outbound goes NIC before subnet. The AllowVnetInBound default rule at priority 65000 permits traffic from any address space in the VNet, from peered VNets, and from on-premises networks connected via VPN or ExpressRoute, a scope that surprises candidates who assume it covers only the local VNet.
Private endpoints deserve close attention. A private endpoint places a NIC with a private IP address into your VNet and maps it to a specific PaaS resource, with DNS resolution handled through private DNS zones following the privatelink subdomain pattern. The Azure Private Endpoints architecture guide on this blog covers the DNS integration in production detail, the exam tests this at the level of zone naming and linkage, not just conceptual understanding.
The load balancing decision matrix is examined through scenario questions. Azure Load Balancer handles Layer 4 regional traffic; Application Gateway handles Layer 7 HTTP/HTTPS with WAF capability; Azure Front Door handles Layer 7 at global scale; Traffic Manager uses DNS-based routing for global distribution. Basic-tier Load Balancer and Basic public IPs were retired on 30 September 2025, any question or study material still referencing the Basic Load Balancer SKU as a viable current option is out of date. VPN gateway Basic SKU is policy-based only, capped at ten tunnels, has no BGP support, no active-active configuration and no SLA, and it cannot be resized; you must delete and recreate to change SKU.
Monitoring and Maintenance (10 to 15 per cent)
This is the smallest domain and should deliver solid marks for anyone who has worked with Azure Monitor. Metrics are numeric, near real-time and retained for 93 days by default. Logs are stored in Log Analytics workspaces and queried with KQL. You need enough KQL to read and interpret queries at the level of basic filtering, summarisation and time-windowing, not to write complex analytical queries from scratch. Alert rules, action groups and alert processing rules are tested, as are VM Insights, Storage Insights, Network Insights, Network Watcher tools (IP flow verify, NSG diagnostics, Connection Monitor), and Application Insights.
Backup covers both the Recovery Services vault (VMs, files, SQL in VMs, Azure Files) and the newer Backup vault (blobs, managed disks, PostgreSQL Flexible Server). Azure Site Recovery for cross-region VM disaster recovery rounds out the domain, along with backup report configuration.
Building Your Study Plan
The realistic time commitment for an engineer with AZ-900 and genuine hands-on Azure exposure is 60 to 80 focused hours spread across four to six weeks. That figure rises to eight to twelve weeks if your Azure experience is limited to the portal or if your background is predominantly Microsoft 365 rather than infrastructure administration.
Work through the domains in a logical build order rather than the order they appear on the skills outline. Start with identity and governance, since RBAC and subscription scope underpin every other domain. Move to storage next, it is discrete, memorisation-friendly and builds confidence. Compute follows naturally, then networking as the highest-difficulty domain, with monitoring and backup as consolidation in the final week before the exam.
Aim for a 50/50 split between structured study and hands-on lab work, shifting toward 70 per cent labs in the final two weeks. The exam is scenario-based and tests behaviour under misconfiguration as much as correct configuration, you cannot develop that instinct from videos or reading alone. Candidates who memorise portal workflows without the equivalent PowerShell and Azure CLI commands consistently report being caught out; Microsoft mixes both syntaxes in the same exam and tests invalid parameter combinations as frequently as correct ones.
Microsoft’s Learn sandbox, embedded directly in each learning path module, is free and requires no credit card. The official MicrosoftLearning/AZ-104-MicrosoftAzureAdministrator GitHub repository mirrors the instructor-led AZ-104T00 lab exercises and provides a structured lab sequence across all five domains. Supplement with an Azure free account or a pay-as-you-go subscription with a budget alert set at a low threshold, most of the lab exercises cost very little in practice, and resource locks prevent accidental over-provisioning.
If your employer has a Microsoft Enterprise Agreement, ask whether it includes access to the Enterprise Skills Initiative. ESI commonly includes lab environments and a 50 per cent exam discount voucher, which reduces the UK cost from around £110 to approximately £55.
Official Microsoft Learn Paths
Microsoft publishes six free learning paths that map directly to the AZ-104 exam domains. These are the authoritative starting point for each area of the syllabus and include embedded sandbox exercises you can complete without an Azure subscription. Work through them in the order below, which reflects the recommended study sequence rather than the order they appear in Microsoft’s navigation.
- AZ-104: Prerequisites for Azure administrators
- AZ-104: Manage identities and governance in Azure
- AZ-104: Implement and manage storage in Azure
- AZ-104: Deploy and manage Azure compute resources
- AZ-104: Configure and manage virtual networks for Azure administrators
- AZ-104: Monitor and back up Azure resources
The Resources That Actually Work
The single most efficient free resource for AZ-104 is John Savill’s Study Cram video, approximately four hours long and available on his YouTube channel. It covers all five domains in sufficient depth to identify gaps and is current as of April 2026. His AZ-104 whiteboard diagram, available in the johnthebrit/CertificationMaterials GitHub repository, functions as a revision reference throughout your study period.
Tim Warner’s timothywarner/az104 GitHub repository provides structured four, eight and twelve-week study plans, scenario question banks, cheat sheets and troubleshooting references. It was last updated in April 2025 and remains accurate for the current objectives.
For video courses, Scott Duffy’s and Alan Rodrigues’s Udemy offerings are the most cited by passers. Both are updated regularly, Scott Duffy’s course reached v6.0 in May 2025 and Alan Rodrigues’s reached v10.0 in October 2025, and both typically drop to £12 to £15 in Udemy’s near-permanent sale pricing. For practice exams, Tutorials Dojo by Jon Bonso offers the closest match to the real exam’s scenario style and is priced at approximately $15. MeasureUp is Microsoft’s official practice test partner and carries more weight if you are preparing for an employer-sponsored sitting. Whizlabs provides both question banks and lab environments if you want a bundled option.
The mark O’Shea resource guide at intunedin.net is worth bookmarking for ongoing exam intelligence, it is maintained by a Microsoft MVP and was updated specifically to cover the April 2026 changes ahead of their release.
One firm boundary: avoid brain-dump sites. They publish questions obtained in violation of Microsoft’s NDA. Microsoft monitors these sites actively, and candidates identified as having used them can be decertified and permanently banned from future Microsoft exams. The only protection against that outcome is using resources that generate original questions mapped to the official objectives.
Why AZ-104 Pays in the UK Market
IT Jobs Watch data for early 2026 puts the UK median for the Azure Administrator job title at £50,000 permanent, with a contract day rate of approximately £613. That understates the real value of the certification because it tracks a specific job title rather than the broader set of roles where AZ-104 is a stated or implied requirement.
Azure Infrastructure Engineers earn £55,000 to £75,000 in the UK permanent market. Senior Cloud Engineers command £68,000 to £80,000. Azure Platform Engineers, particularly those holding SC clearance, reach £65,000 to £90,000 permanent and £600 to £800 per day on contract. London adds roughly 10 to 20 per cent to permanent salaries and 15 to 25 per cent to day rates.
The sectors with the highest demand for AZ-104-certified engineers in 2026 are financial services (Barclays, HSBC, Lloyds, NatWest, Legal and General, Aviva), public sector via G-Cloud 14 (DWP, HMRC, MoJ, Home Office), NHS and healthcare trusts, defence contractors (BAE Systems, Leonardo, Babcock, Thales UK), major retailers (Tesco, Sainsbury’s, John Lewis, Ocado), the Microsoft-aligned consultancy market (Avanade, Accenture, Capgemini, Deloitte) and managed service providers including Softcat, Computacenter, Bytes and Node4.
On the certification pathway, AZ-104 remains a required prerequisite for the AZ-305 Azure Solutions Architect Expert, the badge that unlocks the £80,000 to £110,000 architect salary band, and satisfies the prerequisite for AZ-400 DevOps Engineer Expert alongside AZ-204.
Exam Day: Protecting the Marks You Have Earned
Budget roughly 90 seconds to two minutes per multiple-choice question and apply a strict rule of never spending more than two minutes on a single item. Submit your best answer, flag the question, and move on. Case studies are the most common cause of time overruns, read the questions first, then locate only the specific facts needed in the case text. Several recent passers have described completing the exam with five minutes or fewer to spare after reading case studies in full rather than scanning them for relevant detail.
Once you complete a section or case study, you cannot return to it. Review flagged items within each section before you submit it, not at the end of the exam. Never leave a flagged question unanswered, the answer recorded at the time the section closes is the one that counts.
Microsoft Learn documentation is accessible in a split pane during most role-based exams including AZ-104, but the exam clock continues to run while you use it. Treat it as a tiebreaker for questions where you are uncertain rather than a substitute for preparation. Run through the exam sandbox at aka.ms/examdemo before your sitting date, it replicates the actual exam interface and saves several minutes of orientation on the day.
Microsoft’s retake policy allows a second attempt 24 hours after the first, with a 14-day wait between any subsequent attempts and a maximum of five attempts within any rolling 12-month window from the first sitting. Each retake is charged at full price unless you purchased a Microsoft Exam Replay bundle.
Next Steps
- Book the exam under a personal Microsoft account before you start studying; a non-refundable booking date concentrates study effort
- Run the official Microsoft Learn Practice Assessment to baseline your current knowledge across all five domains
- Work through the Microsoft Learn learning paths for all five domains in the build order above, completing the embedded sandbox exercises as you go
- Clone the MicrosoftLearning/AZ-104-MicrosoftAzureAdministrator repository and complete the lab exercises for the identity, storage and networking domains before anything else
- Add the Tim Warner AZ-104 GitHub repository study plan to your reading list and use the scenario question bank to test application rather than recall
- Watch John Savill’s Study Cram in the week before the exam as a revision pass, not as first exposure to the material
- Complete two full timed Tutorials Dojo practice exams in the 48 hours before sitting, treat any sub-80 per cent result as a flag to revisit the relevant domain rather than an indicator you are not ready
- Run the exam UI sandbox at aka.ms/examdemo so the interface is familiar before you sit
Useful Links
- Microsoft Certified: Azure Administrator Associate, official certification page
- AZ-104 official study guide, skills measured and objectives
- MicrosoftLearning AZ-104 lab repository
- John Savill’s AZ-104 Study Cram (YouTube)
- John Savill CertificationMaterials GitHub, AZ-104 whiteboard diagram
- Tim Warner AZ-104 GitHub, study plans, cheat sheets and scenario questions
- Tutorials Dojo AZ-104 practice exams by Jon Bonso
- MeasureUp AZ-104 official practice test
- IT Jobs Watch, Azure Administrator UK salary and contract rate data
- intunedin.net AZ-104 resource guide, April 2026 update by Mark O’Shea
