AZ-104 Study Plan: Domain-by-Domain Schedule and Common Exam Traps

Start with the weights, not the product list

Microsoft publishes the skills measured and their weights in the AZ-104 study guide. The version currently shown is "Skills measured as of April 17, 2026". A score of 700 or greater is required to pass, according to the same page.

Two points follow from this. Compute and identity together make up a large share of the exam, so they deserve the most hands-on time. And monitoring, the smallest domain, is still worth a few focused sessions because backup and recovery sit inside it.

The study guide also notes that most questions cover generally available features, and that the exam may include Preview features if they are commonly used. It further states that the bullets under each skill illustrate how the skill is assessed, and that related topics may appear.

A five-week plan

This plan assumes some Azure exposure and about eight to ten hours a week. Stretch it to eight weeks if you are new to the portal, PowerShell and the Azure CLI, which the study guide lists as experience you should have.

Week 1: Identities and governance

• Create users and groups in Microsoft Entra ID, manage licenses and external users, and configure self-service password reset.
• Assign built-in roles at each scope and read an existing assignment to work out what a user can do.
• Practice Azure Policy, tags, resource locks, management groups, and budgets and alerts.

Week 2: Storage

• Build storage accounts with different redundancy settings and encryption options.
• Create shared access signature tokens and stored access policies, and compare them with access keys and identity-based access.
• Configure blob tiers, lifecycle management, versioning, soft delete, and Azure Files snapshots.

Week 3: Compute

• Read and modify ARM templates and Bicep files, deploy them, and export a deployment as a template.
• Create VMs, resize them, manage disks, place them in availability zones or sets, and deploy a Virtual Machine Scale Set.
• Provision Azure Container Registry, Container Instances and Container Apps, then App Service plans, scaling, deployment slots and custom DNS names.

Week 4: Virtual networking

• Build virtual networks, subnets, peering and user-defined routes.
• Write network security group rules, evaluate effective rules, and set up Azure Bastion, service endpoints and private endpoints.
• Configure Azure DNS and an internal and a public load balancer, then troubleshoot each.

Week 5: Monitoring, backup and review

• Query logs in Azure Monitor, create alert rules, action groups and alert processing rules, and use Network Watcher and Connection monitor.
• Create a Recovery Services vault and a Backup vault, apply a backup policy, restore, and run a Site Recovery failover.
• Spend the second half of the week on timed practice questions and rework every miss in the portal.

Common traps by domain

Identities: roles add up, and locks sit above them

Azure RBAC is an additive model, so effective permissions are the sum of your role assignments. The Azure RBAC overview gives the example of Contributor at subscription scope plus Reader on a resource group: the Reader assignment changes nothing. A question that asks you to "restrict" a user by adding a lower-scope Reader role is testing exactly this. Roles are assigned at four scope levels: management group, subscription, resource group and resource.

Resource locks work differently. The resource lock documentation says a lock overrides user permissions and applies across all users and roles. Locks are inherited from the parent scope, and the most restrictive lock in the chain wins. Only Owner and User Access Administrator, among the built-in roles it names, plus some specialized roles, can create or delete locks.

Locks: ReadOnly blocks more than you expect

The same page warns that a ReadOnly lock can break operations that look like reads, because it blocks the POST method to the Resource Manager API. Examples listed there include listing storage account keys, starting or restarting a VM when the lock is on its resource group, and scaling an App Service plan. It also states that locks apply to control plane operations, not data plane operations, so a lock on a storage account does not by itself protect the data inside it. If a scenario question asks why an admin "with full rights" cannot do something, check for a lock first.

Storage: read access is not the same as geo-replication

The Azure Storage redundancy page is the place to settle the LRS, ZRS, GRS and GZRS differences. Two details recur in questions:

• With GRS or GZRS, data in the secondary region is not available for read or write unless there is a failover. Read access to the secondary requires RA-GRS or RA-GZRS.
• Replication to the secondary region is asynchronous, so a regional failure can lose recent writes.

The page also notes that the redundancy setting is shared by every service in a storage account, and that the archive tier is not supported on ZRS, GZRS or RA-GZRS accounts. Azure Files does not support RA-GRS or RA-GZRS. These constraints make good "which option meets the requirement" questions.

Compute: know what you can change after creation

The skills list includes moving a VM to another resource group, subscription or region, and managing VM sizes and disks. Practice these in the portal rather than reading about them. Questions in this area often hinge on a single constraint, such as availability zone placement or whether a size change needs a restart, so run each operation at least once and note what the portal warns you about.

Networking: rule order and defaults

The network security group overview explains how rules are processed. Priorities run from 100 to 4096, lower numbers are processed first, and processing stops once traffic matches a rule. You cannot create two rules with the same priority and direction. Azure's default rules use priority 65000 and above, so your custom rules are always evaluated first, and you cannot remove the defaults but you can override them.

Other facts that show up in troubleshooting questions: NSGs are stateful, so a reply to allowed traffic does not need its own rule; removing a rule does not drop existing connections, only new ones; and security admin rules from Azure Virtual Network Manager are evaluated before NSG rules. When a question gives you a table of rules and asks whether traffic is allowed, sort by priority and stop at the first match.

Monitoring: vault type and alert plumbing

The skills list names both a Recovery Services vault and an Azure Backup vault, and asks you to configure Site Recovery for Azure resources and perform a failover. Learn which workload goes in which vault from the Azure Backup documentation, and be able to describe the chain of metric or log query, alert rule, action group and alert processing rule.

How to use practice questions

Do not treat practice questions as a memory test. After each miss, name the exact fact you lacked, then reproduce it in a sandbox subscription. The guide's own advice is to train and get hands-on experience before sitting the exam, and Microsoft offers a free practice assessment linked from the study guide. Use a short timed set at the end of each week, and a longer one at the end of week five.

Try 20 questions free

→ Take the free AZ-104 practice test: 20 questions, no signup, and your score as soon as you submit.

This article is not affiliated with or endorsed by Microsoft.