The short version
AZ-104 has five domains. Identities and governance and compute are the heaviest at 20-25% each, storage and networking follow at 15-20% each, and monitoring and backup is 10-15%. The weightings come from the study guide Microsoft labels “Skills measured as of April 17, 2026”, and they are ranges, so a given exam can lean either way.
| Domain | Weighting |
|---|---|
| Manage Azure identities and governance | 20-25% |
| Implement and manage storage | 15-20% |
| Deploy and manage Azure compute resources | 20-25% |
| Implement and manage virtual networking | 15-20% |
| Monitor and maintain Azure resources | 10-15% |
Manage Azure identities and governance (20-25%)
What it covers. Three groups of skills: Microsoft Entra users and groups (creating them, properties, licenses, external users, self-service password reset), access to Azure resources (built-in roles, assigning roles at different scopes, interpreting assignments), and subscriptions and governance (Azure Policy, resource locks, tags, resource groups, subscriptions, cost alerts, budgets, Advisor recommendations, and management groups).
In practice. You answer who may do what, where, and how to stop mistakes. A request such as “the audit team must see everything in one subscription but change nothing” is a role and scope question. “Nobody may create resources outside West Europe” is a policy question.
Typical traps.
- Mixing up Microsoft Entra roles with Azure roles. They are separate systems with separate scopes.
- Forgetting inheritance: a role, lock, or tag at a higher scope affects everything below it, but a tag on a resource group is not automatically copied onto its resources.
- Confusing policy effects. Deny blocks, audit only reports, and some effects change or add settings.
- Assuming a budget stops spending. A budget sends alerts.
What to practice. Assign a role at three scopes and read the result. Add a CanNotDelete lock and see which actions still work. Build a policy assignment with a deny effect and trigger it on purpose.
Implement and manage storage (15-20%)
What it covers. Access to storage (firewalls and virtual networks, shared access signatures, stored access policies, access keys, identity-based access for Azure Files), storage accounts (creation, redundancy, object replication, encryption, Storage Explorer and AzCopy), and Azure Files and Blob Storage (shares, containers, tiers, soft delete, snapshots, lifecycle management, versioning).
In practice. You decide how an application or person reaches data and how long and how safely it is kept. A tight requirement such as “read access from the secondary region at any time” or “block access except from one subnet” picks the option for you.
Typical traps.
- The three SAS types look alike. Know which one is signed with an account key and which uses Microsoft Entra credentials, and which can cover several services.
- Redundancy names are easy to mix. Ask where the copies live and whether the secondary is readable.
- Tiers have conditions, such as rehydrating archived data before reading it.
- Soft delete, versioning, and snapshots protect against different mistakes.
What to practice. Create each kind of SAS and test it. Move a blob between tiers. Write a lifecycle rule. Restore a deleted container and a deleted file share.
Deploy and manage Azure compute resources (20-25%)
What it covers. Templates (interpreting, modifying, and deploying ARM templates and Bicep files, exporting and converting), virtual machines (creation, encryption at host, moving, sizes, disks, availability zones and sets, scale sets), containers (Azure Container Registry, Container Instances, Container Apps, sizing and scaling), and Azure App Service (plans, scaling, certificates and TLS, custom DNS, backup, networking, deployment slots).
In practice. You build workloads and keep them available. Many questions describe a symptom or a requirement and ask which service or setting fits: a nightly job, an app that scales to zero, a web app needing a staging slot.
Typical traps.
- Choosing a service by name familiarity. Container Instances, Container Apps, and App Service all run containers but suit different needs.
- Overlooking settings fixed at creation, such as a scale set’s orchestration mode.
- Forgetting that some App Service features depend on the plan tier.
- Misreading templates. Know the default deployment mode and what the other mode does to resources not in the template.
What to practice. Edit a Bicep parameter and redeploy. Resize a VM. Add a deployment slot and swap it. Scale a container app by rule.
Implement and manage virtual networking (15-20%)
What it covers. Virtual networks (subnets, peering, public IP addresses, user-defined routes, troubleshooting connectivity), secure access (network security groups, application security groups, effective rules, Azure Bastion, service endpoints, private endpoints), and name resolution and load balancing (Azure DNS, internal and public load balancers, troubleshooting).
In practice. You make traffic go where it should and nowhere else. Questions often give two or three subnets and a requirement, and you work out which rule, route, or endpoint solves it.
Typical traps.
- Peering is not transitive. Traffic does not pass through a middle network by itself.
- Service endpoints and private endpoints both lock down PaaS access, but they differ in how the service is addressed.
- NSG rules are evaluated by priority, lowest number first, and rules at subnet and interface level combine.
- Public and internal load balancers solve different problems, and SKUs matter.
What to practice. Peer two networks and test. Read effective security rules for a network interface. Create a private endpoint and look at the DNS record it needs. Use Network Watcher to test a flow.
Monitor and maintain Azure resources (10-15%)
What it covers. Monitoring (metrics, log settings, querying logs, alert rules, action groups, alert processing rules, Insights for VMs, storage, and networks, Network Watcher, Connection Monitor) and backup and recovery (Recovery Services vault, Backup vault, policies, backup and restore operations, Site Recovery and failover, reports and alerts).
In practice. You notice problems early and recover from bad ones. It is the smallest domain, but its questions are very specific.
Typical traps.
- Metrics and logs answer different questions and live in different places.
- The two vault types protect different workloads. Check which one the scenario needs.
- A test failover is not a real failover.
- An alert rule alone notifies nobody; the action group does.
What to practice. Send resource logs to a workspace, run a simple query, create an alert with an action group, run a backup and a restore, and try a test failover.
More guides for AZ-104
- AZ-104 Exam Format, Scoring and Retakes
- Is AZ-104 Hard? An Honest Difficulty Check
- AZ-104 Prerequisites and Self-Check
- AZ-104 Renewal and Retakes Explained
- Is AZ-104 Worth It? An Honest Look
- AZ-104 Cheat Sheet: Key Facts to Review
- AZ-104 vs AZ-305: Which First?
- AZ-104 vs AZ-400: Which First?
- AZ-104 vs AZ-802: Which First?
Next step
Use this page to rank your own strengths, then build your plan on the study plan page. To see how these topics appear in questions, try the sample questions, or take the AZ-104 practice tests and check which domain labels your misses fall under.