Azure Administrator Associate: Operating Azure with Current AZ-104 Skills

Microsoft Certified: Azure Administrator Associate remains an active intermediate credential in 2026 and is earned through AZ-104. Microsoft’s current study guide, updated for skills measured as of April 17, 2026, covers five major areas: identities and governance, storage, compute, virtual networking, and monitoring and maintenance. The certification renews on a 12-month cycle, reflecting the pace at which Azure administration changes.

The credential belongs to the wider Microsoft certification ecosystem and builds naturally on concepts introduced in Azure Fundamentals. AZ-900 helps candidates understand the platform; AZ-104 expects them to operate it. For administrators who later move into architecture, Azure Solutions Architect Expert is a current progression and uses the AZ-305 design exam. Microsoft describes Azure administrators as professionals who implement, manage, and monitor Azure environments while collaborating with networking, security, database, application, and DevOps specialists. Preparation should therefore be hands-on and cross-service.

Identity and governance define who can act and where standards apply

The current AZ-104 blueprint places significant weight on Microsoft Entra users and groups, Azure role-based access control, subscriptions, management groups, policies, locks, tags, budgets, and related governance. Candidates should be able to distinguish identity administration from access to Azure resources. A user can exist in Entra ID without having permission to manage a subscription, while a role assignment can grant access only at a specific scope.

The article on Azure RBAC is directly relevant. In a lab, create users and groups, assign built-in roles at resource-group scope, review inherited permissions, and remove access. Then add a policy and a resource lock so you can observe how authorization, governance, and change protection differ. These are separate control mechanisms even when they affect the same resource.

Storage administration is about access, durability, and lifecycle

AZ-104 candidates should be able to create and configure storage accounts, control network access, manage keys and shared access signatures, use identity-based access where appropriate, configure redundancy, and administer Azure Files and Blob Storage. The current objectives also include features such as object replication, encryption, lifecycle management, versioning, soft delete, snapshots, and data movement with tools such as AzCopy or Storage Explorer.

The article on shared access signatures in Azure Storage provides useful depth. Practice creating a narrowly scoped SAS and compare it with role-based access. Then enable lifecycle rules and recovery features and test deletion and restoration. Storage questions become easier when candidates understand the security and durability consequence of each setting rather than memorizing a portal sequence.

Compute administration spans virtual machines, containers, and App Service

The current exam expects administrators to deploy and manage virtual machines, Virtual Machine Scale Sets, Azure Container Instances, Azure Container Apps, Azure Container Registry, and App Service. Candidates should understand sizing, disks, availability, scaling, TLS, custom domains, deployment slots, backups, networking, and the operational differences among these compute models.

Build the same simple application in more than one compute form if possible. A VM exposes operating-system administration; a container removes some host management; App Service shifts even more platform responsibility to Azure. This comparison helps candidates decide which settings exist because of the service model. The article on Azure VM data disks is useful for VM operations, while container deployment and Azure storage provides broader managed-service context.

ARM templates and Bicep make repeatable deployment part of administration

AZ-104 now expects candidates to interpret, modify, and deploy Azure Resource Manager templates or Bicep files. An administrator does not need to become a full infrastructure-as-code specialist, but should understand declarative deployment, parameters, resource dependencies, and the benefit of storing configuration in a repeatable form. Manual portal work is useful for exploration; repeated production deployment should be reproducible.

Take a small resource group and export or write an infrastructure definition for it. Change a parameter, deploy into a second environment, and compare the result. Then introduce an invalid reference and examine the deployment error. The lesson is not simply syntax. It is learning to treat infrastructure as a desired state that can be reviewed, repeated, and corrected instead of a collection of undocumented clicks.

Virtual networking should be troubleshot as a path

The networking domain includes virtual networks, subnets, peering, public IP addresses, user-defined routes, network security groups, application security groups, Bastion, service endpoints, private endpoints, DNS, and load-balancing or gateway concepts. Candidates should understand how these controls interact and how to isolate connectivity failures.

Draw the traffic path before changing configuration. Identify source and destination addresses, route selection, security rules, name resolution, endpoint type, and service listener. The article on Azure logging and monitoring is useful during diagnosis because network problems often require evidence from several services. A correct NSG rule does not help if DNS points to the wrong endpoint or a route sends traffic elsewhere.

Private access patterns require understanding service endpoints and private endpoints

Azure administrators increasingly need to reduce unnecessary public exposure. Service endpoints and private endpoints both help workloads reach platform services more securely, but they work differently. Candidates should understand which mechanism extends virtual-network identity to a service and which places a private IP interface for the service inside a virtual network. That distinction affects DNS, routing, and access design.

Build a storage or other supported PaaS scenario and restrict public access. Test connectivity from an allowed subnet and from an untrusted location. If using a private endpoint, inspect DNS resolution and confirm that the service name resolves to the expected private address. These exercises turn abstract security features into observable network behavior and prepare candidates for the troubleshooting emphasis of the administrator role.

Monitoring and recovery are part of daily operations

AZ-104 includes Azure Monitor, alerts, Log Analytics concepts, Network Watcher, backup, and Site Recovery-related operational skills. Administrators should know how to create meaningful alerts, inspect logs and metrics, configure backups, and validate recovery. Monitoring should answer whether a resource is healthy, not merely whether it exists.

Create an alert for a useful condition, generate the condition, and confirm notification or action behavior. Configure a backup for a supported workload and perform a restore into a safe location. The broader discussion of Azure File Sync and hybrid storage is useful for understanding how availability and data-management choices extend beyond one resource. Recovery becomes real only when it has been tested.

Cost management belongs in the administrator’s operating routine

Administrators influence cloud spend through resource size, storage tier, redundancy, uptime, scaling, unused assets, network design, and data retention. The current objective set includes budgets, alerts, and Azure Advisor recommendations because cost is not only a finance responsibility. An engineer who can create resources but cannot identify waste is not fully operating the environment.

Use a lab subscription to review cost analysis, create a budget, tag resources, and identify items that can be stopped or deleted. Connect cost to technical behavior: a VM left running, an oversized disk, excessive log retention, or unexpected data movement all have different remedies. The article on Azure subscription management provides additional governance context.

Preparation should cycle through deploy, secure, monitor, break, and recover

The AZ-104 preparation path and Azure Administrator study material can help organize topics, but the official 2026 study guide should control final coverage. Avoid studying each domain as though it were independent. An application can depend on identity, storage, networking, compute, and monitoring at the same time.

A strong final lab creates a small environment, applies governance, deploys storage and compute, configures private and public connectivity, enables monitoring, and protects data. Then break one layer at a time. Remove a role assignment, change a route, block traffic, delete a file, misconfigure DNS, or exceed a planned threshold. Diagnose the symptom from evidence and restore the intended state. That operational cycle is closer to the real Azure Administrator role than memorizing portal screens.

Administrative tooling should also be practiced across interfaces. The Azure portal is valuable for exploration, but Azure CLI, PowerShell, Cloud Shell, Storage Explorer, and template-based deployment make repeated work faster and easier to document. Perform the same task—such as creating a resource group, reviewing a role assignment, or inspecting a virtual network—through more than one interface. The objective is not memorizing every command; it is understanding the underlying resource model well enough to move between tools.

Change management is an underrated AZ-104 skill because many outages are introduced by administrators rather than by platform failure. Before modifying a production-like resource, identify dependencies, export or record the current state, plan validation, and know the rollback path. Use locks, backups, deployment history, and infrastructure definitions where appropriate. After the change, verify user-facing behavior rather than assuming a successful deployment message means the service is healthy.

Finally, practice permission and network troubleshooting together. A storage account can be unreachable because the identity lacks data-plane access, because a firewall blocks the client, because a private endpoint resolves incorrectly, or because the application uses an expired credential. Build scenarios where only one layer is wrong and compare the errors. AZ-104 rewards administrators who can isolate these overlapping control planes quickly and fix the correct one without weakening unrelated security.

Before scheduling AZ-104, rebuild a representative environment from a clean subscription or sandbox and keep a runbook of the verification steps. If the environment can be recreated, secured, monitored, and recovered without relying on remembered screenshots, the underlying administration skills are much more likely to survive both exam updates and real operational change.