AZ-104 Cheat Sheet: Key Facts to Review

The short version

This sheet is for the last pass before AZ-104, not for learning from zero. It lists the exam facts, then the ideas and look-alike pairs that decide many questions in each of the five domains. It follows the skills list Microsoft labels “Skills measured as of April 17, 2026”. It is a memory aid in our own words and does not claim to cover everything on the exam. Check the Microsoft study guide for the full list.

Exam facts at a glance

Item	What Microsoft publishes
Credential	Azure Administrator Associate, intermediate level
Time	100 minutes on the exam page
Questions	Number not published; Microsoft says most exams have 40 to 60
Passing score	700 on a scale of 1 to 1,000 (scaled, not 70 percent)
Penalty for guessing	None, so answer everything
Help during the exam	Microsoft Learn is available; the clock keeps running
Breaks	5 minutes built in; you cannot return to earlier questions after a break
Retakes	24 hours after the first fail, then 14 days; five tries in 12 months
Renewal	Every 12 months; free online assessment in a six-month window

Domain 1: identities and governance (20-25%)

Key concepts

Users and groups live in Microsoft Entra ID. Groups can be assigned licenses. External users are guests.
Azure roles are assigned to a person, group, or app at a scope: management group, subscription, resource group, or resource. Lower scopes inherit.
Azure Policy checks and enforces rules on resources. Locks stop deletion or change. Tags label resources for cost and order.
Budgets and cost alerts tell you about spending. Advisor gives recommendations.

Confusable pairs

Entra roles manage the directory. Azure roles manage resources. They are separate.
Policy decides what is allowed to exist. A role decides what a person may do.
Deny blocks a request. Audit only records it.
CanNotDelete lets you change a resource. ReadOnly blocks changes too.

Decision rules

“Everyone in a team needs the same access” points to a group, not individual assignments.
“Applies to all resources below” points to a higher scope.
“Must not be created in a region” points to a policy, not a role.

Traps

Tags on a resource group do not copy themselves to the resources inside.
A budget alerts; it does not stop spending.

Domain 2: storage (15-20%)

Key concepts

Storage account settings: redundancy, encryption, network rules, access keys.
Access can come from keys, SAS tokens, stored access policies, or identity. Network rules can limit access to chosen networks.
Blob features: tiers, soft delete, versioning, snapshots, lifecycle rules, object replication.
Azure Files: shares, snapshots, soft delete, identity-based access.

Confusable pairs

Locally redundant storage keeps copies in one location. Zone-redundant spreads across zones. Geo-redundant adds a distant region. “Read access” variants let you read the secondary.
A service SAS covers one service. An account SAS can cover several. A user delegation SAS is signed with Entra credentials instead of the account key.
Versioning keeps old versions of a blob. A snapshot is a point-in-time copy you create. Soft delete keeps deleted items for a period.
Hot, cool, cold, and archive trade storage cost against access cost and speed.

Decision rules

“Revoke access without rotating the key” points to a stored access policy.
“Move old data automatically” points to lifecycle management.
“Copy blobs to another account” points to object replication.

Traps

Archived blobs must be rehydrated before they can be read.
Rotating a key invalidates anything signed with it.

Domain 3: compute (20-25%)

Key concepts

ARM templates and Bicep describe resources as code. Know how to read parameters, variables, and resource blocks.
VMs: size, disks, availability zones versus availability sets, scale sets, encryption at host.
Containers: Container Registry stores images. Container Instances runs simple containers. Container Apps adds scaling rules.
App Service: plan (the compute), app, slots, scaling, certificates, custom names, backup.

Confusable pairs

Availability set protects against rack and update events in one datacenter. Availability zones protect against a datacenter failure.
Scale up changes size. Scale out changes count.
Incremental deployment mode leaves other resources alone. Complete mode removes resources not in the template.
A deployment slot swap exchanges staging and production content without taking the app down.

Decision rules

“Short-lived job, no orchestration” points to Container Instances.
“Scales on events or HTTP load, including to zero” points to Container Apps.
“Test before production, then switch” points to deployment slots.

Traps

Slots and some scaling options need a suitable plan tier.
Some choices are fixed when a resource is created.

Domain 4: virtual networking (15-20%)

Key concepts

Virtual networks hold subnets. Peering connects networks. User-defined routes override default routing.
NSGs filter traffic by priority; the lowest number is checked first. Application security groups let you refer to groups of VMs.
Bastion gives browser-based access to VMs without public IPs.
Azure DNS hosts zones. Load balancers spread traffic, public or internal.

Confusable pairs

Service endpoint: traffic to a PaaS service leaves over Microsoft’s backbone with a subnet identity. Private endpoint: the service gets a private IP in your network.
Public load balancer faces the internet. Internal faces a virtual network.
NSG on a subnet and NSG on a network interface both apply.

Decision rules

“Peering between A and C through B” does not work by itself; peering is not transitive.
“Why can’t this VM reach that one?” points to effective security rules and Network Watcher.
“PaaS reachable only by a private address” points to a private endpoint, plus the matching DNS record.

Traps

A missing DNS entry looks like a network block.
Address spaces that overlap cannot be peered.

Domain 5: monitoring and backup (10-15%)

Key concepts

Azure Monitor collects metrics and logs. Alert rules fire; action groups say who is told or what runs; processing rules can suppress or change alerts.
Insights give ready-made views for VMs, storage, and networks.
Backup uses a Recovery Services vault or a Backup vault, with policies for schedule and retention. Site Recovery replicates for failover.

Confusable pairs

Metrics are numbers over time. Logs are records you query.
Recovery Services vault and Backup vault support different workloads. Check which one the scenario needs.
Test failover leaves production alone. A real failover moves it.
Backup restores data. Site Recovery keeps a workload running elsewhere.

Decision rules

“Notify the on-call team” needs an action group.
“Investigate slow connectivity between two VMs” points to Connection Monitor.

Traps

An alert rule with no action group notifies nobody.

Common exam traps

Reading the answer you know before reading the requirement. One phrase often decides.
Picking a correct feature that solves a different problem.
Overlooking words such as “least administrative effort”, “cheapest”, or “without downtime”.
Spending too long on a single question. There is no guessing penalty, so move on and return.

Last-day checklist

Open the free exam sandbox once to see the interface.
Re-read the domain pairs above and say out loud how each pair differs.
Review your wrong answers from practice sets, not new material. The domains explained page helps with the details.
Check your appointment, ID, and test setup. Our exam day guide has the list.
Sleep. A rested head beats one more hour of reading.

More guides for AZ-104

Next step

Test what stuck with the sample questions, then run a full timed set from the AZ-104 practice tests. The AZ-104 overview lists all other guides.

Try the AZ-104 practice exams