The AZ-104 (Microsoft Azure Administrator) fails more candidates than most people expect. Not because the content is impossibly complex, but because the exam is a scenario-based application test — and most candidates prepare for a knowledge test instead.
That gap is where first-attempt failures happen. Here's how to close it.
Why candidates fail the AZ-104 first time
Ask anyone who's failed AZ-104 and the pattern is consistent: they understood the services, but couldn't work through the scenarios.
AZ-104 questions don't ask you to define RBAC or name the Azure storage tiers. They put you in a real-world situation — a multi-subscription environment, a hybrid network setup, a cost-management problem — and ask what you would actually do. The right answer requires understanding how Azure services interact, not just what they are.
The second trap is breadth. AZ-104 covers five domains across a wide range of Azure services: identities, governance, storage, compute, networking, and monitoring. Candidates who study linearly often arrive at exam day with strong coverage of identities and weak coverage of networking and monitoring — and those gaps are expensive.
What the exam actually looks like
40–60 questions. 150-minute time limit. Passing score: 700 out of 1000.
Question types include:
- Multiple choice (single and multiple answer)
- Case studies — a longer scenario followed by multiple related questions
- Lab tasks (in some versions) — you interact directly with the Azure portal
Case studies are the most demanding. They give you a business scenario with technical requirements, constraints, and sometimes contradictory objectives — and ask you to choose the solution that satisfies everything. Candidates who haven't practised working through layered requirements under time pressure find these the hardest part.
Five domains:
| Domain | Weight |
|---|---|
| Manage Azure Identities & Governance | 15–20% |
| Implement & Manage Storage | 15–20% |
| Deploy & Manage Azure Compute Resources | 20–25% |
| Implement & Manage Virtual Networking | 15–20% |
| Monitor & Maintain Azure Resources | 10–15% |
Compute is the heaviest domain by weight. Networking generates the most failed questions. Both require hands-on practice, not just reading.
The five areas that decide your result
1. RBAC and governance (Identities & Governance domain)
Role-Based Access Control is one of the highest-frequency topics on AZ-104. You need to know the built-in roles (Owner, Contributor, Reader, User Access Administrator), where they apply (subscription, resource group, resource), and how inheritance works down the scope hierarchy. More importantly: given a business requirement, which role assignment satisfies least privilege?
Management groups, subscriptions, resource groups, and how policies and RBAC assignments propagate through that hierarchy — this is tested repeatedly and across multiple scenario types.
2. Virtual networking (Networking domain)
The domain that catches the most candidates out. Virtual networks, subnets, Network Security Groups (NSGs), peering, VPN gateways, Azure Bastion, load balancers, and DNS.
NSG rule priority is a common question trap — lower numbers take priority, and a Deny rule blocks traffic regardless of any Allow rules at higher numbers. Know this cold before exam day.
VNet peering is not transitive — VNet A peered with VNet B and VNet B peered with VNet C does not mean A can reach C. This produces a category of scenario questions where the answer hinges on whether you know this limitation.
3. Storage (Storage domain)
Storage account tiers (Hot, Cool, Cold, Archive), access tiers vs account tiers, replication options (LRS, ZRS, GRS, GZRS), and when to use each. Blob storage lifecycle policies. Azure Files vs Blob vs Table vs Queue — and which workload fits which.
The cost optimisation questions are common here: a scenario with specific access patterns and a requirement to minimise cost. Know which tier applies for data accessed monthly vs quarterly vs almost never.
4. Compute (Compute domain)
Virtual machines — sizes, availability options (availability sets vs availability zones), scale sets, and the difference between them. Azure App Service plans. Azure Container Instances. Azure Kubernetes Service basics.
VM backup and disaster recovery (Azure Backup, Azure Site Recovery) also appear in this domain. Know the difference between backup (data recovery) and site recovery (failover to another region).
5. Monitoring and alerting (Monitor domain)
Azure Monitor, Log Analytics workspaces, alerts, diagnostic settings, and Azure Advisor recommendations. Lighter than the other domains by weight, but the questions are precise — know where to look for specific metrics, how to configure an alert rule, and what Azure Monitor can and can't do.
The study approach that works
Use the portal, not just reading material. AZ-104 tests administration — the ability to actually configure Azure resources, not just describe them. Every concept you study, try to find it in the portal. Create a storage account. Set up a VNet and a subnet. Assign a role. Check what happens when you peer two VNets. The questions will feel much more familiar if you've actually clicked through these workflows.
A free Azure account gives you $200 of credit and access to always-free services. Use it throughout your study.
Practise scenario questions early. Don't wait until you've finished the course. Start answering scenario questions after each domain section. Getting questions wrong early shows you where your understanding has gaps before you've built false confidence.
Track domain accuracy explicitly. After each practice session, know your score by domain — not just your total. If you're at 80% on Identities but 50% on Networking, the right move is more Networking practice, not more Identities review.
Know the "which is cheapest" and "which meets all requirements" patterns. AZ-104 has a category of questions that give you several valid solutions and ask which one is cheapest, or which one satisfies all the stated requirements. These questions require reading carefully — often one option fails a constraint that's easy to overlook.
Hands-on practice that actually helps
Microsoft Learn — the free official learning paths mapped directly to AZ-104 objectives. Each module includes sandbox exercises. Work through the Administrator learning path; the sandboxes are the closest free substitute for a live Azure environment.
Create resources and delete them. The cycle of creating a resource, configuring it, testing it, and cleaning it up is more valuable than any amount of reading. Spend at least 20 hours in the Azure portal during your prep.
Practise NSG rules deliberately. Create two VMs, configure NSG rules, test what traffic gets through. Break it, fix it. NSG questions on AZ-104 are specific and the portal is the fastest way to build intuition for how rules interact.
The week before the exam
By this point your weak domains should be identified and closed. The final week is consolidation.
Run two full timed practice exams — 60 questions, 150 minutes, no pausing. Review every wrong answer for reasoning, not just the correct answer. Then drill your lowest-scoring domain for the remaining days.
Review:
- RBAC scope hierarchy and role assignments
- NSG rule priority and traffic flow logic
- VNet peering limitations (non-transitive)
- Storage tier use cases and replication options
- Which resource goes in which scope (subscription vs resource group)
Sleep before the exam. AZ-104 case studies require sustained concentration.
On exam day
- Read case study requirements carefully before looking at answers. List the requirements mentally or on scratch paper, then eliminate options that fail any of them.
- For "which role satisfies least privilege" questions: start with Reader and work up. The answer is always the minimum role that allows the stated action.
- For networking questions: trace the traffic path mentally. Source → NSG → Subnet → NSG → Destination. Where does a Deny rule block it?
- Flag and skip questions you're uncertain about. Return with fresh eyes after you've answered everything you're confident on.
How long does it take?
With Azure experience: 4–6 weeks of focused study and hands-on practice.
Without Azure experience: 8–10 weeks, with significant time in the portal.
AZ-104 is achievable on the first attempt for almost anyone who prepares deliberately. The candidates who fail are usually the ones who read a lot and clicked around the portal very little — or who practised questions but never looked at why they got things wrong.
Get hands-on. Track your weak domains. Practise case studies specifically. That's the formula.
Know where you're weak before the exam does
ExamCoach gives you adaptive AZ-104 practice questions across all five exam domains — tracked by accuracy after every session, so you always know which areas to focus on next.
Free to start. No credit card.
Start your AZ-104 Daily Quiz →
ExamCoach covers AZ-104, AZ-305, AZ-204, AWS CLF-C02, CCNA, CISSP, CompTIA Security+, CFA Level 1, and more.