Microsoft AZ-104: Complete Azure Administrator Certification Guide for 2025

Cloud infrastructure knowledge is no longer optional for security professionals — it is the battleground. The Microsoft AZ-104 certification validates that you can manage Azure identities, networking, storage, compute, and monitoring at an enterprise level. Whether you are pursuing a cloud security role, preparing for penetration testing engagements against Azure environments, or simply future-proofing your career, AZ-104 gives you the technical foundation that employers and bug bounty programs increasingly demand.

What Is the Microsoft AZ-104 Certification?

The Microsoft Certified: Azure Administrator Associate exam (exam code AZ-104) is a mid-level certification from Microsoft that validates your ability to implement, manage, and monitor an organization's Microsoft Azure environment. It is the successor to the older AZ-103 and sits at the Associate tier — one step above the AZ-900 Fundamentals and a prerequisite or complementary cert to higher-level paths like the AZ-500 (Azure Security Engineer).

Passing AZ-104 proves you can:

• Manage Azure Active Directory (Entra ID) users, groups, and roles
• Deploy and manage virtual machines, containers, and web apps
• Configure virtual networks, VPNs, and Network Security Groups (NSGs)
• Implement storage accounts, blob access policies, and data redundancy
• Set up monitoring, alerts, and backup solutions across resources

> Note: Microsoft retired AZ-103 in 2020. All current candidates should register for AZ-104. The exam costs approximately $165 USD and is available through Pearson VUE, either in-person or online proctored.

Why AZ-104 Matters for Cybersecurity Professionals

Here is the reality: most enterprise targets in 2025 run significant workloads in Azure. If you are doing red team work, cloud penetration testing, or bug bounty hunting against enterprise targets, not understanding Azure architecture puts you at a serious disadvantage.

The AZ-104 curriculum maps directly to attack surfaces that security researchers exploit:

• Identity and Access Management (IAM) — misconfigured role assignments are one of the top Azure vulnerabilities
• Storage account permissions — publicly accessible blobs have leaked sensitive data in dozens of disclosed bug bounty reports
• Network Security Groups — overly permissive inbound rules expose services that should never be public
• Key Vault access policies — improperly scoped secrets access is a common privilege escalation path

For a complete guide, see our Bug Bounty Hunting Guide which covers how cloud misconfigurations translate into real-world findings and payouts.

Even if your goal is purely defensive — SOC analysis, cloud security architecture, or compliance — AZ-104 gives you the vocabulary and mental model to work effectively with Azure environments.

AZ-104 Exam Overview: What You Need to Know

Exam Domains and Weightings

Microsoft publishes a skills outline for every exam. As of the current version, AZ-104 covers five functional groups:

Exam Format

• Questions: 40–60 (mix of multiple choice, drag-and-drop, case studies, and "hot area" UI simulations)
• Duration: 130 minutes
• Passing score: 700 out of 1000
• Languages: Available in multiple languages including English, Japanese, Korean, and Chinese

> Important: Microsoft regularly updates exam content. Always download the official skills measured document from learn.microsoft.com before you start studying — not from a third-party summary.

Step-by-Step Study Plan for AZ-104

This is the study framework that consistently works for candidates with 3–6 months of general IT experience targeting a 6–8 week preparation window.

Week 1–2: Build the Foundation

Start with Microsoft Learn's free AZ-104 learning path. It is not exciting, but it is accurate. Do not skip it. Simultaneously, spin up a free Azure account — you get $200 in credits for 30 days and access to always-free services afterward. Hands-on time in the portal is non-negotiable.

Priority topics for the first two weeks:

• Azure Resource Manager (ARM) and resource hierarchy (Management Groups → Subscriptions → Resource Groups → Resources)
• Azure Active Directory vs. on-premises AD — understand the distinction cold
• Role-Based Access Control (RBAC) — built-in roles, custom roles, scope inheritance

Week 3–4: Networking and Storage Deep Dive

Networking trips up more candidates than any other domain. Invest extra time here.

Networking must-knows:

• VNet peering vs. VPN Gateway vs. Azure ExpressRoute
• NSG rule priority and default rules
• Azure DNS — public vs. private zones
• Load Balancer vs. Application Gateway vs. Azure Front Door

Storage must-knows:

• Storage account types (General Purpose v2, Blob, File)
• Access tiers: Hot, Cool, Archive
• Shared Access Signatures (SAS tokens) — understand the security implications
• Azure Files vs. Blob Storage vs. Table Storage

Week 5–6: Compute, Monitoring, and Practice Exams

Focus on VMs (availability sets vs. availability zones vs. scale sets), App Service Plans, and AKS basics. Then shift 50% of your time to practice exams.

Recommended practice exam sources:

• MeasureUp (official Microsoft partner)
• Whizlabs AZ-104
• Tutorials Dojo (Jon Bonso's practice tests — excellent quality)

Aim for consistent 85%+ scores on practice exams before booking the real one. If you are scoring in the 70s, keep drilling the weak domains.

Essential Tools and Resources

Azure CLI

Azure CLI (az) is the command-line tool you will use constantly in the exam simulations and in real environments. Install it on your study machine:

# Install Azure CLI on Ubuntu/Debian
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Verify installation
az --version

# Log in to your Azure account
az login

# Set your default subscription
az account set --subscription "Your-Subscription-Name"

Azure PowerShell

Some tasks in the exam use PowerShell syntax. The Az module is the current standard:

# Install Az module (run as Administrator)
Install-Module -Name Az -AllowClobber -Scope CurrentUser

# Connect to Azure
Connect-AzAccount

# List all resource groups
Get-AzResourceGroup | Format-Table ResourceGroupName, Location

Azure Portal

Do not underestimate portal familiarity. Several exam questions are UI simulations where you must navigate the actual Azure portal interface. Spend at least a few hours per week in the portal — not just CLI.

Visual Studio Code + Azure Extensions

For writing ARM templates and Bicep files (tested in the exam), VS Code with the Azure Resource Manager Tools and Bicep extensions is the standard setup.

Practical Example: Deploying a Secure VM with Azure CLI

This example walks through creating a resource group, deploying a VM, and locking it down with an NSG — covering three exam domains in one workflow.

# Create a resource group
az group create \
  --name rg-study-lab \
  --location eastus

# Create a Virtual Network and subnet
az network vnet create \
  --resource-group rg-study-lab \
  --name vnet-lab \
  --address-prefix 10.0.0.0/16 \
  --subnet-name subnet-web \
  --subnet-prefix 10.0.1.0/24

# Create a Network Security Group
az network nsg create \
  --resource-group rg-study-lab \
  --name nsg-web

# Add an inbound rule: allow HTTPS, deny everything else
az network nsg rule create \
  --resource-group rg-study-lab \
  --nsg-name nsg-web \
  --name Allow-HTTPS \
  --priority 100 \
  --protocol Tcp \
  --destination-port-range 443 \
  --access Allow

# Deploy a VM (Ubuntu LTS, no public IP — accessed via Bastion)
az vm create \
  --resource-group rg-study-lab \
  --name vm-webserver \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --vnet-name vnet-lab \
  --subnet subnet-web \
  --nsg nsg-web \
  --public-ip-address "" \
  --admin-username azureadmin \
  --generate-ssh-keys

# Check the VM status
az vm show \
  --resource-group rg-study-lab \
  --name vm-webserver \
  --query 'provisioningState' \
  --output tsv

# Clean up when done (avoid charges)
az group delete --name rg-study-lab --yes --no-wait

Notice the --public-ip-address "" flag — deploying VMs without public IPs and requiring Azure Bastion for access is a security best practice that the exam tests and that comes up constantly in real cloud environments.

CyberVK's Azure labs let you run exercises exactly like this in a sandboxed environment with guided walkthroughs, so you are not burning through your free Azure credits on study exercises.

Common Mistakes to Avoid

Mistake 1: Memorizing Without Practicing

AZ-104 has a significant hands-on component. Candidates who only read documentation or watch videos routinely fail because the exam includes portal simulations and scenario-based questions that require genuine operational knowledge. Minimum 20 hours of hands-on lab time before exam day.

Mistake 2: Ignoring ARM Templates and Bicep

Deployment automation (ARM JSON templates and Bicep) shows up in the exam more than candidates expect. You do not need to write complex templates from scratch, but you need to read them, understand the dependsOn relationship, and know how to deploy them.

# Deploy an ARM template
az deployment group create \
  --resource-group rg-study-lab \
  --template-file ./azuredeploy.json \
  --parameters ./azuredeploy.parameters.json

Mistake 3: Confusing Azure AD (Entra ID) Concepts

Many candidates mix up Authentication vs Authorization, Azure AD B2B vs B2C, and Conditional Access scope. These are tested specifically. Write a one-page cheat sheet for identity concepts and review it daily.

Mistake 4: Skipping Azure Monitor and Log Analytics

Monitoring is only 10–15% of the exam, but candidates often drop easy points here. Know how to create diagnostic settings, route logs to a Log Analytics workspace, and write basic KQL queries:

// Find all failed login attempts in the last 24 hours
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize FailedAttempts = count() by UserPrincipalName, IPAddress
| order by FailedAttempts desc

This KQL knowledge also directly applies to threat hunting and SIEM work — it is one of the most transferable skills from the AZ-104 curriculum.

Mistake 5: Booking Too Early

Do not book the exam until you are consistently passing practice exams at 85%+. The exam fee is not refundable in most regions (Microsoft offers one free reschedule if done 6+ days before the exam date). Rushing costs you both money and momentum.

How AZ-104 Connects to Security Work

Once you hold AZ-104, the natural progression for security-focused practitioners is the AZ-500: Microsoft Azure Security Technologies exam. AZ-104 is not a formal prerequisite, but the operational knowledge from AZ-104 makes AZ-500 significantly more approachable.

From a bug bounty and penetration testing perspective, AZ-104 knowledge directly enables:

• Identifying overly permissive storage blob policies during recon
• Recognizing RBAC misconfiguration patterns in ARM template analysis
• Understanding attack paths through service principals and managed identities
• Evaluating network segmentation weaknesses in Azure architectures

The CyberVK platform offers cloud security modules that bridge the gap between AZ-104 operational knowledge and offensive security applications — helping you translate certification knowledge into actual findings.

Go Deeper

This article is part of our comprehensive Bug Bounty Hunting Guide series. Once you've mastered this topic, explore the full guide to level up your skills.

Ready to practice? CyberVK has hands-on labs and courses for every skill level. Start learning at cybervk.com