An Eight-Week Study Plan for the Microsoft AZ-104 Azure Administrator Exam

AZ-104 is the exam that punishes readers. It certifies that you can administer Azure, and Microsoft writes the questions accordingly: you get a scenario, a set of constraints, and four ways to solve it that all sound like real Azure services. People who spent two months watching videos walk in, hit the first case study, and realize they have never actually created a VNet peering or assigned a role at the resource-group scope. That is the failure mode this plan is built to prevent.

The mechanics: 40 to 60 questions, about 100 minutes of question time, and a passing score of 700 out of 1000. The voucher is $165 USD in the US, and pricing varies by country, so check Microsoft's official page for yours. Question formats include multiple choice, drag and drop, and case studies. There are no live labs on the exam currently, which is ironic, because hands-on time is still the only reliable way to prepare for it. For a fuller read on the difficulty curve, see is the AZ-104 exam hard.

One prerequisite check before week one: this plan assumes you already know what a resource group is and can navigate the portal without a map. If Azure is brand new to you, start with AZ-900, the Azure Fundamentals exam first, then come back. Eight weeks is enough to pass AZ-104 from a fundamentals base. It is not enough to learn cloud computing from zero and pass an administrator exam.

Budget your hours against the weights#

Here are the official domains and weights from Microsoft's study guide.

Identities and compute can each be a quarter of your exam. Together with networking, the top three domains cover as much as 70% of the questions. That is why this plan gives identities and compute two weeks each while monitoring gets one. Spending equal time per domain is the most common way to waste two months.

Weeks 1 and 2: Identities and governance#

Start with the highest-weighted domain while your energy is fresh.

• Microsoft Entra ID: users, groups (assigned versus dynamic), guest accounts, self-service password reset, and device registration basics.
• Role-based access control (RBAC): built-in roles versus custom roles, and, critically, scope. Know what happens when a role is assigned at the subscription level versus a resource group versus a single resource, and how deny assignments and inheritance interact.
• Subscriptions and management groups: how the hierarchy works and where policy and RBAC attach to it.
• Azure Policy: definitions, initiatives, assignments, and effects (audit versus deny versus deployIfNotExists). The exam loves asking whether Policy or RBAC solves a given requirement. RBAC controls who can act; Policy controls what is allowed to exist.
• Resource locks (ReadOnly versus CanNotDelete) and how they trump RBAC permissions.
• Tags: how they apply, what inherits, and how they interact with Policy for enforcement.

Lab work: create a test user and group, assign a built-in role at two different scopes, write one custom policy assignment, and put a lock on a resource group, then try to delete something inside it. End week two with 25 to 30 practice questions on this domain only.

Week 3: Storage#

• Storage accounts: kinds, performance tiers, and replication options (LRS, ZRS, GRS, RA-GRS). Know which redundancy survives which failure, because drag-and-drop questions on this are common.
• Blob storage: access tiers (hot, cool, archive), lifecycle management rules, and soft delete.
• Azure Files: SMB shares, identity-based access, and when Files beats Blob for a requirement.
• Access control: storage account keys, shared access signatures (account versus service SAS, stored access policies), and Entra ID authorization. Expect questions that ask for the least-privileged way to grant time-boxed access, and the answer is almost never "hand over the account key."
• Network access: firewalls, private endpoints, and service endpoints on a storage account.

Lab work: create a storage account, upload blobs, move one through tiers, generate a SAS with an expiry, and mount an Azure Files share. One focused week is enough if all of it is hands-on.

Weeks 4 and 5: Compute#

The second heavyweight domain, and the one with the most surface area.

• Virtual machines: sizes and resizing, disks (OS versus data, disk types), images, and extensions.
• Availability: availability sets (fault and update domains), availability zones, and which option protects against which failure. This is classic drag-and-drop material.
• VM Scale Sets: scaling policies, instance management, and when a scale set beats individual VMs.
• App Service: plans and tiers, deployment slots, custom domains, and autoscale rules. Know what a slot swap actually does.
• Containers: Azure Container Instances for quick single-container workloads, and container groups. You need to know when ACI is the right answer versus a VM or App Service, more than deep Kubernetes internals.
• ARM templates and Bicep: read a template and identify what it deploys, understand parameters and outputs, and know the deployment modes (incremental versus complete). You do not need to author complex templates from memory, but you must not be surprised by JSON on screen.

Lab work: deploy a VM from the portal and a second one from a Bicep file, resize it, add a data disk, create an App Service with a staging slot and swap it, and run one container in ACI. Close week five with a mixed 30-question set on compute plus storage.

Week 6: Networking#

• VNets and subnets: address spaces, subnet sizing, and the reserved addresses in each subnet.
• Network security groups: rule priority, default rules, and evaluation at the subnet versus the NIC. Given a rule table and a blocked connection, you should be able to say why. That question shape appears constantly.
• VNet peering: regional and global, transitivity (there is none by default), and when peering beats a VPN.
• VPN Gateway: site-to-site versus point-to-site, and what each requires.
• Load balancing: Azure Load Balancer versus Application Gateway, which OSI layer each works at, and which requirement points to which service.
• Azure DNS: public and private zones, and the record types you would actually create.

Lab work: build two VNets, peer them, place VMs in each, and prove connectivity. Then write an NSG rule that blocks it and prove that too. Breaking things on purpose is the fastest way to learn rule evaluation.

Week 7: Monitoring, backup, and your first timed exams#

• Azure Monitor: metrics versus logs, alert rules, action groups, and dynamic thresholds.
• Log Analytics: workspaces and enough KQL to read a basic query and predict its output.
• Network Watcher: connection troubleshoot, IP flow verify, and packet capture, and which tool answers which "why can't A reach B" scenario.
• Azure Backup: Recovery Services vaults, backup policies, and restore options for VMs and files.
• Azure Site Recovery: what it replicates and how it differs from Backup. One protects data, the other keeps workloads running somewhere else.

Then, in the back half of the week, start full-length timed practice exams under real conditions: no notes, no pausing, the full question count against the clock. Score each attempt by domain and write down the weak ones. Those numbers set your week eight agenda.

Week 8: Practice, repair, logistics#

No new topics. Alternate full-length timed exams with targeted repair on your two weakest domains, and reread the explanations for every question you miss or guess on. For how many full attempts are actually worth taking before you book, we wrote about that here.

Logistics: book your slot early in the week so the date creates pressure, decide between a test center and online proctoring, and if online, run the system check days ahead. The day before is light review and sleep, not cramming. One post-pass note worth knowing now: the certification renews annually with a free online renewal assessment on Microsoft Learn, so budget a small refresh each year instead of a re-take.

The hands-on rule#

Every topic in this plan gets portal or CLI time. Not most topics. Every one. Microsoft gives you the tools to do this at no cost: a free Azure account comes with credits, and Microsoft Learn sandboxes give you a temporary real subscription inside many modules with nothing to clean up. Between the two, there is no financial excuse to prepare read-only.

The rule exists because AZ-104 questions describe situations, and situations are only recognizable if you have been in them. Reading that global VNet peering is non-transitive is a fact you will forget. Watching a ping fail between two spoke networks you peered yourself is a fact you will keep.

The practice-question ratio#

From week five onward, aim for roughly 60% of study time on questions and labs and 40% on reading, shifting to nearly all questions by week eight. A steady daily drill works better than weekend binges: 10 to 20 questions a day, every day, with every explanation read, including the ones you got right for the wrong reason.

What to drop if you fall behind#

Protect the two 20 to 25% domains (identities and compute), your networking labs, and your timed full-length exams. Trim from monitoring, which is 10 to 15% and heavily backfillable through practice questions, and from deep template authoring. Reading Bicep is testable; writing it fluently is a job skill you can build after the exam. Never cut lab time to make room for more reading. That trade always loses.

The trap that fails prepared candidates#

Memorizing portal screenshots instead of learning which service solves which requirement. The portal changes; blade names move; screenshots go stale. The exam does not ask where a button is. It asks things like "you need to grant a contractor write access to one storage container for two weeks with no standing credentials," and the answer is a SAS, not a role assignment, not an access key. Candidates who studied navigation blank on these, because they learned the map instead of the territory. Study by requirement: for each service, be able to say in one sentence what problem it solves that its neighbors do not.

Ready to start week one? Start a free practice test on ExamCoachAI. The free tier gives you 10 questions a day, enough to run the daily drilling this plan is built around.