Microsoft Certified - Azure Administrator Associate (AZ-104) Study Guide

The Microsoft Certified: Azure Administrator Associate certification enables you to learn how to implement, manage, and monitor your or your organization’s Microsoft Azure environment while leveraging the tools and services available on Azure. This is an intermediate level certification, so I would recommend you to set aside some time to study for the exam and practice using some of the services related to this exam - ‘Practice makes perfect In this study guide, I will share with you some of the useful resources you can use to guide you during your learning path to get this certification. NOTE This study guide is aligned with the content changes implemented on September 24, 2021. To understand the content changes done, please visit this link and download the exam skills outline.

Certification Path
 

Exam AZ-104: Microsoft Azure Administrator

The AZ-104 has a length of two hours. There are 50+ questions and you need a minimum of 700 of 1000 points to pass the exam.

The first place to go is the Microsoft Learn platform where a dedicated learning path is available, for free. Also, you should have a look at the Resources section in this study guide where you have useful resources to help you consolidate the knowledge that will help you get the exam and certification. If you prefer to watch videos, instead of reading, explaining these core concepts, and showing how to get prepared for the exam, then I invite you to have a look at the Microsoft Azure Administrator (AZ-104), available on Pluralsight.

Skills measured
 

Manage Azure identities and governance (15–20%)

Manage Azure Active Directory (Azure AD) objects

• Create users and groups
  • Creating a new user in Azure AD
  • Bulk create users in Azure Active Directory
  • Add or update a user’s profile information using Azure Active Directory
  • Add or remove group owners in Azure Active Directory
  • Bulk delete users in Azure Active Directory
  • Add or delete users using Azure Active Directory
  • Create a basic group and add members using Azure Active Directory
  • New-AzureADUser
  • New-AzureADGroup
  • New-AzureADMSGroup
• Create administrative units
  • Administrative units in Azure Active Directory
  • Manage administrative units in Azure Active Directory
• Manage user and group properties
  • Add or update a user’s profile information using Azure Active Directory
  • Edit your group information using Azure Active Directory
  • Bulk create users in Azure Active Directory
  • Powershell - Set-AzureADUser
  • Powershell - Set-AzureADGroup
  • Powershell - Set-AzureADMSGroup
• Manage device settings
  • Manage device identities using the Azure portal
  • How To: Manage stale devices in Azure AD
  • How to manage the local administrators group on Azure AD joined devices
• Perform bulk user updates
  • Bulk creation of new users
  • Bulk add group members in Azure Active Directory
• Manage guest accounts
  • What is guest user access in Azure Active Directory B2B?
  • Quickstart: Add guest users to your directory in the Azure portal
  • Restrict guest access permissions in Azure Active Directory
  • Add Azure Active Directory B2B collaboration users in the Azure portal
  • Manage guest access with Azure AD access reviews
• Configure Azure AD join
  • Azure AD joined devices
  • How To: Plan your hybrid Azure Active Directory join implementation
  • How to: Plan your Azure AD join implementation
  • Controlled validation of hybrid Azure AD join
  • Tutorial: Configure hybrid Azure Active Directory join for managed domains
• Configure self-service password reset
  • Plan an Azure Active Directory self-service password reset deployment
  • Tutorial: Enable users to unlock their account or reset passwords using Azure Active Directory self-service password reset
  • Customize the user experience for Azure Active Directory self-service password reset
  • How it works: Azure AD self-service password reset

Manage role-based access control (RBAC)

• Create a custom role
  • Azure custom roles
  • Create or update Azure custom roles using the Azure portal
  • Create or update Azure custom roles using Azure PowerShell
  • Create or update Azure custom roles using Azure CLI
• Provide access to Azure resources by assigning roles at different scopes
  • What is Azure role-based access control (Azure RBAC)?
  • Azure built-in roles
  • Tutorial: Grant a user access to Azure resources using the Azure portal
  • Tutorial: Grant a group access to Azure resources using Azure PowerShell
  • Assign a user as an administrator of an Azure subscription
  • Add or change Azure subscription administrators
  • Classic subscription administrator roles, Azure roles, and Azure AD roles
  • List Azure role assignments using the Azure portal
  • Elevate access to manage all Azure subscriptions and management groups
• Interpret access assignments
  • Quickstart: Check access for a user to Azure resources
  • List Azure role assignments using the Azure portal
  • Understand Azure deny assignments
  • List Azure deny assignments using the Azure portal Manage subscriptions and governance
• Configure Azure policies
  • What is Azure Policy?
  • Quickstart: Create a policy assignment to identify non-compliant resources
  • Tutorial: Create and manage policies to enforce compliance
  • Quickstart: Create a policy assignment to identify non-compliant resources using Azure PowerShell
  • Quickstart: Create a policy assignment to identify non-compliant resources with Azure CLI
  • Quickstart: Create a policy assignment to identify non-compliant resources using Python
• Configure resource locks
  • Understand resource locking in Azure Blueprints
  • Lock resources to prevent unexpected changes
• Apply and manage tags on resources
  • Resource naming and tagging decision guide
  • Use tags to organize your Azure resources and management hierarchy
  • Tag support for Azure resources
  • Tutorial: Manage tag governance with Azure Policy
• Manage resource groups
  • What is Azure Resource Manager?
  • Manage Azure Resource Manager resource groups by using the Azure portal
  • Manage Azure resources by using Azure CLI
  • Move resources to a new resource group or subscription
  • Move a VM to another subscription or resource group
  • Azure Resource Manager resource group and resource deletion
• Manage subscriptions
  • Pay for your Azure subscription by invoice
  • Create an additional Azure subscription
  • Export and view your top-level Subscription information
  • Add or change Azure subscription administrators
  • Cancel your Azure subscription
  • Transfer billing ownership of an Azure subscription to another account
  • Pluralsight - Managing Microsoft Azure Subscriptions
• Manage costs
  • What is Azure Cost Management + Billing?
  • How to optimize your cloud investment with Azure Cost Management
  • Quickstart: Explore and analyze costs with cost analysis
• Configure management groups
  • What are Azure management groups?
  • Quickstart: Create a management group
  • Quickstart: Create a management group with Azure PowerShell
  • https://docs.microsoft.com/en-us/azure/governance/blueprints/overview

Implement and manage storage (15–20%)

Secure storage

• Configure network access to storage accounts
  • Require secure transfer to ensure secure connections
  • Manage storage account access keys
  • Configure Azure Storage firewalls and virtual networks
  • Prevent anonymous public read access to containers and blobs
• Create and configure storage accounts
  • Storage account overview
  • Create a storage account
  • Upgrade to a general-purpose v2 storage account
  • Manage the default access tier of an Azure Storage account
• Generate shared access signature (SAS) tokens
  • Grant limited access to Azure Storage resources using shared access signatures (SAS)
  • Create a user delegation SAS
  • Create a service SAS
  • Delegate access with a shared access signature
  • Create an account SAS
  • Getting Started with Shared Access Signatures (SAS)
• Manage access keys
  • Manage storage account access keys
  • Manage storage account keys with Key Vault and the Azure CLI
• Configure Azure AD authentication for a storage account
  • Authorize access to blobs using Azure Active Directory
  • Choose how to authorize access to blob data in the Azure portal
  • Authorize access to data in Azure Storage
• Configure access to Azure Files
  • Part three: configure directory and file level permissions over SMB
  • Overview of Azure Files identity-based authentication options for SMB access

Manage storage

• Export from Azure job
  • What is Azure Import/Export service?
  • Azure Import/Export system requirements
  • Use the Azure Import/Export service to export data from Azure Blob storage
• Import into Azure job
  • Use the Azure Import/Export service to import data to Azure Blob Storage
  • Use Azure Import/Export service to import data to Azure Files
  • Setting up the Azure Import/Export Tool v1
• Install and use Azure Storage Explorer
  • Get started with Storage Explorer
  • Quickstart: Use Azure Storage Explorer to create a blob
• Copy data by using AZCopy
  • Get started with AzCopy
  • azcopy copy
  • azcopy sync
  • azcopy make
  • Transfer data with AzCopy and file storage
• Implement Azure Storage replication
  • Azure Storage redundancy
  • Change how a storage account is replicated
• Configure blob object replication
  • Object replication for block blobs

Configure Azure files and Azure Blob Storage

• Create an Azure file share
  • Create an Azure file share
  • Quickstart: Create and manage Azure file shares with Windows virtual machines
• Create and configure Azure File Sync service
  • Planning for an Azure File Sync deployment
  • Tutorial: Extend Windows file servers with Azure File Sync
  • Deploy Azure File Sync
• Configure Azure Blob Storage
  • Introduction to Azure Blob storage
  • Quickstart: Upload, download, and list blobs with the Azure portal
  • Quickstart: Use Azure Storage Explorer to create a blob
  • Manage Azure Blob Storage resources with Storage Explorer
• Configure storage tiers
  • Access tiers for Azure Blob Storage - hot, cool, and archive
  • Performance tiers for block blob storage
• Configure blob lifecycle management
  • Configure a lifecycle management policy

Deploy and manage Azure compute resources (20–25%)

Automate deployment of virtual machines (VMs) by using Azure Resource Manager templates

• Modify an Azure Resource Manager template
  • Understand the structure and syntax of ARM templates
  • Quickstart: Create and deploy ARM templates by using the Azure portal
  • Resource group deployments with ARM templates
  • Resource iteration in ARM templates
• Configure a virtual hard disk (VHD) template
  • Create a VM from a VHD by using the Azure portal
  • Upload a generalized Windows VHD and use it to create new VMs in Azure
  • Create a Windows VM from a specialized disk by using PowerShell
• Deploy from a template
  • Create a Windows virtual machine from a Resource Manager template
  • Virtual machines in an Azure Resource Manager template
• Save a deployment as an Azure Resource Manager template
  • Use Azure portal to export a template
  • Use Azure PowerShell to export a template
  • Use Azure CLI to export a template
• Deploy virtual machine extensions
  • Azure virtual machine extensions and features
  • Custom Script Extension for Windows
  • Use the Azure Custom Script Extension Version 2 with Linux virtual machines

Configure VMs

• Configure Azure Disk Encryption
  • Overview of managed disk encryption options
  • Azure Disk Encryption for Windows VMs
  • Azure Disk Encryption for Linux VMs
• Move VMs from one resource group to another
  • Move a Windows VM to another Azure subscription or resource group
  • Move Azure resources across resource groups, subscriptions, or regions
• Manage VM sizes
  • Sizes for virtual machines in Azure
  • Resize virtual machines
  • Resize a virtual machine using the Azure portal or PowerShell
• Add data disks
  • Attach a managed data disk to a Windows VM by using the Azure portal
  • Attach a data disk to a Windows VM with PowerShell
  • Use the portal to attach a data disk to a Linux VM
  • Add a disk to a Linux VM
• Configure networking
  • What is Azure Virtual Network?
  • Quickstart: Create a virtual network using the Azure portal
  • Quickstart: Create a virtual network using PowerShell
  • How to open ports to a virtual machine with the Azure portal
  • Network security groups
  • Virtual Network service endpoints
• Redeploy VMs
  • Redeploy Windows virtual machine to new Azure node
  • Redeploy Linux virtual machine to new Azure node
  • Redeploy a VM in a lab in Azure DevTest Labs
• Configure high availability
  • Availability options for Azure Virtual Machines
  • Create and deploy virtual machines in an availability set using Azure PowerShell
• Deploy and configure scale sets
  • What are virtual machine scale sets?
  • Quickstart: Create a Windows virtual machine scale set with an ARM template
  • Quickstart: Create a virtual machine scale set in the Azure portal
  • Tutorial: Create a virtual machine scale set and deploy a highly available app on Windows with Azure PowerShell

Create and configure containers

• Configure sizing and scaling for Azure Container Instances
  • What is Azure Container Instances?
  • Azure Container Instances and container orchestrators
• Configure container groups for Azure Container Instances
  • Azure Container Instances and container orchestrators
• Configure storage for Azure Kubernetes Service (AKS)
  • Azure Kubernetes Service
  • Kubernetes core concepts for Azure Kubernetes Service (AKS)
  • Tutorial: Deploy an Azure Kubernetes Service (AKS) cluster
• Configure scaling for AKS
  • Scale the node count in an Azure Kubernetes Service (AKS) cluster
  • Scaling options for applications in Azure Kubernetes Service (AKS)
• Configure network connections for AKS
  • Network concepts for applications in Azure Kubernetes Service (AKS)
  • Configure Azure CNI networking in Azure Kubernetes Service (AKS)
• Upgrade an AKS cluster
  • Azure Kubernetes Service (AKS) node image upgrade

Create and configure Azure App Service

• Create an App Service plan
  • Azure App Service plan overview
  • Manage an App Service plan in Azure
• Configure scaling settings in an App Service plan
  • Scale up an app in Azure App Service
  • Get started with Autoscale in Azure
• Create an App Service
  • Quickstart: Deploy an ASP.NET web app
  • Configure an App Service app in the Azure portal
• Secure an App Service
  • Add a TLS/SSL certificate in Azure App Service
  • Set up Azure App Service access restrictions
  • How to use managed identities for App Service and Azure Functions
  • Encryption at rest using customer-managed keys
• Configure custom domain names
  • Buy a custom domain name for Azure App Service
  • Configure a custom domain name in Azure App Service with Traffic Manager integration
• Configure backup for an App Service
  • Back up your app in Azure
  • Restore an app in Azure
• Configure networking settings
  • Integrate your app with an Azure virtual network
• Configure deployment settings
  • Deployment Best Practices

Configure and manage virtual networking (25–30%)

Implement and manage virtual networking

• Create and configure virtual networks, including peering
  • What is Azure Virtual Network?
  • Create, change, or delete a virtual network
  • Virtual network traffic routing
  • Virtual network peering
  • Create, change, or delete a virtual network peering
  • Tutorial: Connect virtual networks with virtual network peering using the Azure portal
• Configure private and public IP addresses
  • Public IP addresses
  • Private IP addresses
  • Create, change, or delete an Azure public IP address
  • Add, change, or remove IP addresses for an Azure network interface
  • Configure a private IP address for a VM using the Azure portal
• Configure user-defined network routes
  • Virtual network traffic routing
  • Diagnose a virtual machine routing problem
• Implement subnets
  • Add, change, or delete a virtual network subnet
• Configure endpoints on subnets
  • Virtual Network service endpoints
• Configure private endpoints
  • What is Azure Private Endpoint?
  • Create a Private Endpoint for a secure connection to Azure Cognitive Search
  • Integrate Key Vault with Azure Private Link
• Configure Azure DNS, including custom DNS settings and private or public DNS zones
  • What is Azure DNS?
  • Overview of DNS zones and records
  • Overview of reverse DNS and support in Azure

Secure access to virtual networks

• Create security rules
  • Network security groups
  • How network security groups filter network traffic
  • Create, change, or delete a network security group
• Associate a network security group (NSG) to a subnet or network interface
  • Create, change, or delete a network security group
• Evaluate effective security rules
  • Diagnose a virtual machine network traffic filter problem
• Implement Azure Firewall
  • What is Azure Firewall?
  • Azure Firewall features
  • Deploy an Azure Firewall with Availability Zones using Azure PowerShell
• Implement Azure Bastion
  • What is Azure Bastion?
  • Connect to a Windows virtual machine using Azure Bastion
  • Quickstart: Configure Azure Bastion from VM settings

Configure load balancing

• Configure Azure Application Gateway
  • What is Azure Application Gateway?
  • Application gateway components
  • How an application gateway works
• Configure an internal or public load balancer
  • What is Azure Load Balancer?
  • Azure Load Balancer algorithm
  • Use a public Standard Load Balancer in Azure Kubernetes Service (AKS)
  • Quickstart: Create a public load balancer to load balance VMs using Azure PowerShell
  • Quickstart: Create an internal load balancer to load balance VMs using the Azure portal
• Troubleshoot load balancing
  • Troubleshoot Azure Load Balancer
  • Troubleshoot common Azure deployment errors with Azure Load Balancer

Monitor and troubleshoot virtual networking

• Monitor on-premises connectivity
  • Network Connectivity Monitoring with Connection Monitor
  • ExpressRoute Monitor
• Configure and use Azure Monitor for Networks
  • Network Performance Monitor solution in Azure
  • Monitor virtual machines with Azure Monitor: Configure monitoring
  • Tutorial: Monitor network communication between two virtual machines using the Azure portal
• Use Azure Network Watcher
  • What is Azure Network Watcher?
  • Quickstart: Diagnose a virtual machine network traffic filter problem using the Azure portal
• Troubleshoot external networking
  • Introduction to resource troubleshooting in Azure Network Watcher
• Troubleshoot virtual network connectivity
  • https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/troubleshoot-nat

Integrate an on-premises network with an Azure virtual network

• Create and configure Azure VPN Gateway
  • What is VPN Gateway?
  • Tutorial: Create and manage a VPN gateway using Azure portal
  • Configure a VNet-to-VNet VPN gateway connection by using the Azure portal
• Create and configure Azure ExpressRoute
  • What is Azure ExpressRoute?
  • ExpressRoute for Cloud Solution Providers (CSP)
  • ExpressRoute Global Reach
  • ExpressRoute connectivity models
• Configure Azure Virtual WAN
  • What is Azure Virtual WAN?
  • Azure Virtual WAN and supporting remote work

Monitor and back up Azure resources (10–15%)

Monitor resources by using Azure Monitor

• Configure and interpret metrics
  • Azure Monitor Metrics overview
  • Azure Monitor Metrics aggregation and display explained
• Configure Azure Monitor logs
  • Azure Monitor Logs overview
  • Azure Monitor Logs data security
• Query and analyze logs
  • Overview of Log Analytics in Azure Monitor
  • Sources of monitoring data for Azure Monitor
     
• Set up alerts and actions
   
  • Overview of alerts in Microsoft Azure
  • Understand how metric alerts work in Azure Monitor
     
• Configure Application Insights
  • What is Application Insights?
  • Application Insights for Azure cloud services
  • Azure Diagnostics extension overview
  • Install and configure Windows Azure diagnostics extension (WAD)

Implement backup and recovery

• Create a Recovery Services vault

  • Recovery Services vaults overview
  • Create and configure a Recovery Services vault
  • Recovery Services vaults overview
  • Monitor and manage Recovery Services vaults

• Create a Backup vault

  • Backup vaults overview
  • Back up Azure VMs in a Recovery Services vault
  • Manage Azure VM backups with Azure Backup service

• Create and configure backup policy

  • Azure Policy built-in definitions for Azure Backup
  • Manage Azure VM backups with Azure Backup service

• Perform backup and restore operations by using Azure Backup

  • What is the Azure Backup service?
  • Overview of Backup center
  • Support matrix for Azure Backup
  • Back up a virtual machine in Azure
  • Manage Azure VM backups with Azure Backup service
  • Perform actions using Backup center
  • Restore Azure file shares
  • Restore files to a virtual machine in Azure

• Perform site-to-site recovery by using Azure Site Recovery

  • About Site Recovery
  • Quickstart: Set up disaster recovery to a secondary Azure region for an Azure VM
  • Tutorial: Set up disaster recovery for Azure VMs
  • Monitor Site Recovery
  • Monitor and manage Recovery Services vaults
  • Back up Windows Server to Azure
  • Recover files from Azure to a Windows Server

• Configure and review backup reports

  • Overview of security features in Azure Backup
  • Configure Azure Backup reports
  • Email Azure Backup Reports

Additional resources

Below follows the list of additional resources that you should consider and a quick note to the Microsoft Learn collection shared there. I tried to extend the learning paths you have available on the exam’s page with some extra modules that I consider relevant to the exam.

Best of Luck and share your results with the community once you get certified! 😊💪

Resource

• Exam AZ-104: Microsoft Azure Administrator
• Microsoft Azure Administrator (AZ-104)
• Microsoft Learn Collection: Microsoft Certified: Azure Administrator Associate