AZ-104 exam map

What AZ-104 certifies

AZ-104 certifies an administrator — somebody who operates an Azure estate rather than designing one. That shows up in the wording of the objectives: they are overwhelmingly verbs you perform, not judgements you defend. Configure, manage, create, troubleshoot, interpret. Where a design exam asks which architecture is right, this one asks which setting you would change and where you would change it.

Read that as a study instruction. Being able to describe a service is not the bar; being able to say which blade, scope or command changes its behaviour is.

The blueprint

The order worth taking

1. Unit 1, identities and governance. Scope is the idea the rest of the exam assumes you already have.
2. Unit 4, networking. It is the largest question surface in this bank and the one most often failed on a path question rather than a knowledge question.
3. Unit 3, compute. The widest unit by objective count. Long, but each sub-area is self-contained.
4. Unit 2, storage. Two clean families of question, quick to consolidate once units 1 and 4 are solid.
5. Unit 5, monitoring and recovery. Smallest by weight, and the one candidates most often leave short.

Units 1 and 4 first is a deliberate inversion of the published order. Scope and network paths are the two ideas that other units silently depend on, so learning them late means re-reading everything that assumed them.

What this hive gives you

The flashcard deck pins to objective depth rather than topic depth, so coverage is verifiable one objective at a time — every one of the 82 has its own collection. The six mocks share no question with each other and each carries one complete case study, so they can be sat as six independent attempts.

Check yourself

Traps that span the whole exam

Every one of those is a reading failure rather than a knowledge failure, which is why working questions beats re-reading notes once you are past the first pass.

Unit 1 roadmap — Manage Azure identities and governance

What this unit is really testing

Unit 1 is about who may act, where they may act, and what the platform will let them leave behind. Almost every question resolves to a scope question: an assignment made at the wrong level is the single most common way an administrator grants too much or too little. Read every stem for the scope first — management group, subscription, resource group, resource — and only then for the permission.

The order to work through it

1. Start with identity objects, because everything else is granted to one: users, groups, and how membership is decided.
2. Move to Azure role-based access control, and hold the distinction between directory roles and resource roles firmly. They are two systems that share a portal.
3. Finish with governance, which is the widest surface: policy, locks, tags, resource groups, subscriptions, cost control and management groups.

Topic map

Every objective title below is quoted from Microsoft's skills-measured outline, as of 2026-04-17.

Manage Microsoft Entra users and groups

AZ104-U1.T1 · 5 objectives

• Create users and groups
• Manage user and group properties
• Manage licenses in Microsoft Entra ID
• Manage external users
• Configure self-service password reset (SSPR)

Manage access to Azure resources

AZ104-U1.T2 · 3 objectives

• Manage built-in Azure roles
• Assign roles at different scopes
• Interpret access assignments

Manage Azure subscriptions and governance

AZ104-U1.T3 · 7 objectives

• Implement and manage Azure Policy
• Configure resource locks
• Apply and manage tags on resources
• Manage resource groups
• Manage subscriptions
• Manage costs by using alerts, budgets, and Azure Advisor recommendations
• Configure management groups

Traps

Check yourself

Are you ready to move on?

• You can state this unit's published range without looking it up.
• You can name every sub-area and say what separates it from its neighbours.
• You can explain each trap above to somebody else, in your own words.
• You have worked the unit's 99 bank questions and can say why the wrong options are wrong.

When all four are true, take a blueprint-weighted mock rather than more of this unit. A mock is the only asset here that tells you how this unit performs against the other four under time.

Unit 1 capstone — Onboarding an acquired subsidiary

The brief

Contoso has acquired Northwind, a 400-person business with its own Microsoft Entra tenant. Northwind's staff keep their existing sign-ins for at least a year. Their engineering contractors need to look at one Contoso resource group and nothing else. Contoso's own service desk must be able to grant access to Northwind staff — but only inside the subscription set aside for the integration, and without becoming able to change resources. Finance has been surprised by cloud spend twice this year and wants it not to happen again. Nothing in the production resource group may be deleted while the migration runs, and every resource created during it must be attributable to a cost centre.

What they need

1. Northwind's 400 staff sign in with their existing credentials, without Contoso creating and managing 400 new accounts.
2. Northwind's contractors can read one Contoso resource group and nothing else.
3. The service desk can grant others access inside the integration subscription, but cannot change the resources in it.
4. Every resource created in the integration subscription carries a cost-centre tag, whether or not the person creating it remembers.
5. Nothing in the production resource group can be deleted during the migration.
6. Finance is told when the integration subscription passes 80% of its monthly budget.

Commit before you read on

Write down your answer to each of the 6 numbered requirements above — the mechanism, and the scope you would apply it at. Then open the working below and compare. Reading the reasoning beside the question is the one way to feel like you knew it without having known it.

▶Show the working

1. 400 staff, their own credentials

B2B collaboration guests.

The partner uses their own identity management, so there is no account lifecycle for Contoso to run. Guests appear in the directory as user objects whose user principal name contains the #EXT# identifier. Note the side effect to control deliberately: by default every user in the organization, including existing guests, can invite more guests. If that is not wanted, external collaboration settings are the place to restrict it — not a role assignment.

2. Contractors read one resource group

Reader, assigned at the resource group scope.

Reader grants viewing and no changes. The examinable half is the scope: assign it at the resource group, not the subscription, because lower levels inherit from higher levels and there is no way to subtract an inherited assignment lower down. Assign to a group rather than to each contractor — a group is a security principal, so one assignment does the work of many.

3. Service desk grants access but cannot change resources

User Access Administrator at the subscription scope.

This is the requirement that eliminates the two obvious answers. Contributor grants full access to manage all resources but explicitly not the ability to assign roles — so it fails the first half. Owner grants full access including role assignment — so it fails the second. Only the role that separates access management from resource management satisfies both.

4. Every resource carries a cost-centre tag

An Azure Policy assignment that requires — or appends — the tag.

Tagging the resource group does nothing for its contents: resources don't inherit the tags you apply to a resource group or a subscription. Policy is the mechanism that makes a tag arrive on the resource. And note what policy is doing here — governing the state a resource may be in, not anybody's access.

5. Nothing deletable in production

A CanNotDelete lock at the resource group scope.

The portal calls it Delete; the command line calls it CanNotDelete. It lets authorized users read and modify but not delete, it is inherited by everything in the scope including resources added later, and the most restrictive lock in the chain wins. It is a control-plane guard, so it does not protect data inside a resource — which is not what was asked for here.

6. Finance told at 80% of budget

A budget with an alert at the 80% threshold.

And the sentence that decides the wrong answers: notifications are triggered when thresholds are exceeded, resources aren't affected, and consumption isn't stopped. A budget notifies. If the stem had said "prevent overspend", no budget would answer it. Budgets are evaluated every 24 hours, so this is not a real-time control either.

The reasoning this unit rewards

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Lab — A budget notifies and stops nothing

The shortest lab in the set, and it exists for one sentence: resources aren't affected, and your consumption isn't stopped. Every learner nods at that and a third of them still answer 'budget' when a stem says 'prevent overspend'.

Before you start

A subscription you can read cost data on. A budget is a cost-management object and creates no billable resource.

Walkthrough

Did it teach you what it was meant to?

What goes wrong

Tear it down

Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Lab — Prove that inheritance only flows one way

The claim to make physical: you cannot narrow an inherited assignment from below. Everybody knows lower levels inherit from higher. Far fewer have watched an attempt to subtract fail.

Before you start

A subscription where you can create role assignments — that needs Owner or User Access Administrator on it. Resource groups and role definitions are free; nothing here deploys a billable resource.

Walkthrough

Did it teach you what it was meant to?

What goes wrong

Tear it down

Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Lab — Tags do not inherit, and a lock is not a permission

Two claims in one sitting: resources do not inherit a resource group's tags, and a lock stops a delete even when your role permits it. Both are one command away from being obvious.

Before you start

A subscription and the ability to create policy assignments and locks on it. Everything created here is a governance object or an empty resource group; none of it is billable.

Walkthrough

Did it teach you what it was meant to?

What goes wrong

Tear it down

Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Lab — Watch a dynamic group fill itself in

The claim to make physical: membership type is decided once. A group that can carry Entra roles is forced to Assigned and can never become dynamic — and you find that out by trying it, not by reading it.

Before you start

An Azure subscription and the Groups Administrator or User Administrator role, which is what creating groups requires. Sign in with az login first. Directory objects are not billable resources.

Walkthrough

Did it teach you what it was meant to?

What goes wrong

Tear it down

Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Cram sheet — Manage access to Azure resources

Three objectives, twenty-five bank questions, and almost all of them turn on one of two things: the scope an assignment was made at, or the difference between what a role grants and what something else takes away.

The anatomy of an assignment

• A role assignment has exactly three elements: a security principal, a role definition, and a scope. Every RBAC question is really asking about one of the three.
• A security principal is a user, a group, a service principal, or a managed identity.
• Access is granted by creating an assignment and revoked by removing one. There is no deny switch in the middle of that, which is why the deny-assignment section below matters.

Scope: four levels, inherited downwards

• Scope can be set at four levels: management group, subscription, resource group, and resource.
• Lower levels inherit role permissions from higher levels. An assignment at the subscription reaches every resource group and resource beneath it, and there is no way to subtract from it with another role assignment.
• Because inheritance only flows one way, the fix for over-broad access is always to move the assignment down, never to add a narrower one alongside it.

The three roles you must be able to separate

The line between Owner and Contributor is role assignment, and it is the single most-tested distinction in this topic. If a stem says somebody must grant access to others, Contributor is wrong.

Deny assignments and custom roles

• A deny assignment blocks actions even if a role assignment grants them. Deny wins.
• You cannot create deny assignments yourself. They are created and managed by Azure — a deployment stack's deny settings are the one way an administrator causes one to exist.
• A tenant may hold up to 5,000 custom roles. (For Microsoft Azure operated by 21Vianet the limit is 2,000.) Custom roles can be shared between subscriptions that trust the same tenant.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Cram sheet — Manage Azure subscriptions and governance

The heaviest topic in the bank — fifty-nine questions across seven objectives — and the one where exact numbers earn marks. Locks, tags and management groups all have published limits, and the command line uses names the portal does not.

Locks: two levels, two sets of names

• Note the command-line spelling: CanNotDelete, with a capital N. It is a favourite of question writers precisely because the portal never shows it.
• A ReadOnly lock is described as similar to restricting all authorized users to the permissions the Reader role provides.
• Locks inherit downwards: apply one at a parent scope and every resource inside it inherits the same lock, including resources added later. The most restrictive lock in the chain takes precedence.
• Locks are a control-plane control. They protect a resource from changes but do not restrict how it performs its function — a ReadOnly lock on a database server still permits data to be written inside its databases.

Tags: the numbers

• Maximum 50 tag name-value pairs per resource, resource group, and subscription — each, not combined.
• Tag name limit 512 characters; tag value limit 256 characters. Storage accounts are the exception: their tag name limit is 128.
• Resources do not inherit tags applied to a resource group or a subscription. If a stem asks for inherited tagging, the answer is a policy that applies them, not the tag itself.
• Need more than 50? The documented workaround is a JSON string as a single tag value.

Management groups: the numbers

• A single directory supports 10,000 management groups.
• A management group tree supports up to six levels of depth — and that depth does not count the root.
• Each management group and each subscription supports only one parent.
• The root management group is named Tenant root group by default, its ID is the same value as the Microsoft Entra tenant ID, and it cannot be moved or deleted — unlike every other management group.

Resource groups hold metadata, not resources' locations

• A resource group stores metadata about the resources, and the location you give it is where that metadata is stored — which is why the choice can matter for compliance.
• Resources inside a resource group can be in different regions. A resource group is not a region boundary, and a stem that implies otherwise is testing exactly this.
• Each resource belongs to exactly one resource group at a time; moving it is an explicit operation, not a property you edit.

Policy governs state; RBAC governs actions

This is the cleanest statement of the boundary, and it is worth memorising in the documentation's own terms:

• Azure Policy ensures that resource state is compliant to your business rules without concern for who made the change or who has permission to make a change.
• Azure RBAC focuses on managing user actions at different scopes.
• And the sentence that decides the hardest questions in this topic: even if an individual has access to perform an action, if the result is a non-compliant resource, Azure Policy still blocks the create or update. Permission is not sufficient. Compliance is a second gate.

Policy effects are evaluated in order

The order matters because an earlier effect can prevent a later one from ever firing:

1. disabled — checked first, to decide whether the rule is evaluated at all.
2. append and modify — either can alter the request, and that change may stop an audit or deny from triggering.
3. deny — evaluated before audit, which prevents double logging of a resource that was refused.
4. audit, then manual, then auditIfNotExists.

A policy assignment governs the state a resource may be in. It never grants, denies or interprets a person's access — that is RBAC's job, and mixing them is the most common wrong answer in this topic.

Budgets do not stop anything

• Notifications fire when a threshold is exceeded. Resources are not affected and consumption is not stopped. A budget is an alerting construct, not a spending cap.
• Cost and usage data is typically available within 8 to 24 hours, and budgets are evaluated against it every 24 hours. A budget is not a real-time control either.
• Budgets reset automatically at the end of each period — monthly, quarterly or annually — for the same amount. When a budget expires, it is automatically deleted.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Cram sheet — Manage Microsoft Entra users and groups

The examinable detail in this topic is rarely what a group is. It is what the platform refuses to let you change afterwards, what a feature costs in licensing, and which default is already switched on in a tenant nobody has configured.

Four user types, not two

A workforce tenant distinguishes where the account lives from what privileges it carries, and those are two independent axes rather than one:

External member is the one people forget. Such users authenticate with an external account but hold member access to your tenant, which is common in multitenant organizations. Guest and external are not synonyms.

Groups: the settings you cannot take back

• Creating a group needs at least the Groups Administrator or User Administrator role. Being a global reader or an owner of the resource is not enough.
• Turning on Microsoft Entra roles can be assigned to the group automatically selects Assigned as the membership type — and once that option is enabled, the membership type can no longer be changed. A role-assignable group is therefore never a dynamic group.
• Nesting is allowed for security groups, but a nested group does not gain access to resources and applications assigned to its parent. If the requirement is inherited access to an app, nesting is the wrong answer.

Dynamic membership is a licensed feature

• Dynamic membership groups require Microsoft Entra ID P1 — or an Intune for Education licence — for each unique user who is a member of one or more of them.
• The licences do not have to be assigned to those users individually; the organization simply has to hold enough of them to cover every such user. A thousand unique users across all dynamic groups means at least a thousand P1 licences.
• Device-based dynamic groups need no licence for the devices themselves.

External users

• A B2B guest signs in with their own credentials from their own organization, and appears in your directory as a user object whose user principal name contains the #EXT# identifier.
• By default, every user in the organization — including existing guests — can invite more guests. Restricting that is a configuration change, not the starting state.
• Two different settings are routinely confused. Cross-tenant access settings control whether users can authenticate with external Microsoft Entra tenants, inbound and outbound. External collaboration settings control which of your own users may send invitations at all.

Self-service password reset

• SSPR is not enabled for administrators by default — the tenant setting is for end users.
• If an Azure administrator role is assigned to the user, the strong two-gate password policy is enforced regardless of the tenant's own SSPR policy.
• The policy decides how many registered methods a reset needs — one or two — and a user who has not registered enough of them is told to contact an administrator rather than being let through.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.