PasswellLog inStart free
Microsoft

AZ-104 prep

For administrators who run Azure day to day: identities, governance, storage, compute, networking, monitoring and backup.

Start freeUnlock everything · $29

The real exam

QuestionsUsually 40 to 60, including at least one case study
Time100 minutes (about 120 minutes seat time)
Pass mark700 on a 1 to 1000 scale
Fee$165 US (regional pricing applies)
FormatPearson VUE test centre or online proctored
Open bookMicrosoft Learn is available in a split screen during the exam, with no extra time
Question typesMultiple choice, drag and drop, build list, hot area, Yes/No series, case studies
Validity12 months, renewed free with an online assessment on Microsoft Learn
Retakes24 hours after the first fail, then 14 days; at most 5 attempts in 12 months

What you get

44
lessons
6
hours of reading
280
original questions
5
full mock exams

Mocks follow the real rules: 50 questions in 100 minutes, flag and review.

Syllabus

Manage Azure identities and governance23%

Entra users and groups, RBAC, Azure Policy, locks, tags, subscriptions, management groups and cost control (20 to 25%).

Implement and manage storage18%

Storage accounts, redundancy, SAS and keys, firewalls, blob tiers and lifecycle, Azure Files, AzCopy (15 to 20%).

Deploy and manage Azure compute resources24%

ARM and Bicep, VMs, availability sets and zones, scale sets, containers and App Service (20 to 25%).

Implement and manage virtual networking20%

VNets, peering, routes, NSGs and ASGs, Bastion, endpoints, Azure DNS and load balancing (15 to 20%).

Monitor and maintain Azure resources15%

Azure Monitor metrics, logs, KQL, alerts, Network Watcher, Azure Backup and Site Recovery (10 to 15%).

Course outline

  1. Microsoft Entra users, groups and access to the tenant · 3 lessons
  2. Governance: access, policy and cost · 4 lessons
  3. Implement and manage storage · 5 lessons
  4. Deploy compute: templates and virtual machines · 4 lessons
  5. Containers and App Service · 4 lessons
  6. Virtual networks, peering and routing · 3 lessons
  7. Secure access, name resolution and load balancing · 4 lessons
  8. Monitor and maintain Azure resources · 5 lessons
  9. Weak spots · 7 lessons
  10. Worked scenarios · 4 lessons
  11. Exam day · 1 lessons

Try a question

You are creating a dynamic user group in Microsoft Entra ID. The group must contain only users whose department is Sales and whose country is UK. Which membership rule should you use?
A. (user.department -eq "Sales") -or (user.country -eq "UK")
B. (user.department -eq "Sales") -and (user.country -eq "UK")
C. user.department == "Sales" && user.country == "UK"
D. (device.department -eq "Sales") -and (device.country -eq "UK")
Show answer
Answer: B. Dynamic membership rules use the syntax object.property -operator "value", with -and/-or to combine expressions. A rule cannot mix user and device properties. Use the rule builder's Validate rules tab to test a rule against sample users before saving.
Your service desk team must be able to reset passwords for non-administrator users in your Microsoft Entra tenant. They must not be able to create or delete users. Which Microsoft Entra role should you assign, following the principle of least privilege?
A. Global Administrator
B. User Administrator
C. Privileged Authentication Administrator
D. Helpdesk Administrator
Show answer
Answer: D. Pick the narrowest Entra role that covers the task. Helpdesk Administrator resets passwords and invalidates refresh tokens for non-admins. User Administrator adds full user and group management. Remember that Entra roles control the directory, while Azure RBAC roles control Azure resources.

Passwell is not affiliated with Microsoft. Microsoft and Azure are trademarks of the Microsoft group of companies. All questions and lessons are original. Facts checked 2026-11-14.