Table of Contents
- The Five AZ-104 Objective Areas and Their Current Weightings
- Exam Facts, and the One Figure Worth Checking
- Identity and Governance Now Opens the Exam
- Compute Is the Other Heavyweight, and It Expects Templates
- What Changed in the Networking Area
- Monitoring and Maintenance: The Smallest Area, Not the Easiest
- Turning the Weightings Into a Study Plan
- Who the Certification Is Actually For
- Frequently Asked Questions About AZ-104
- Conclusion
The Five AZ-104 Objective Areas and Their Current Weightings
AZ-104 publishes five objective areas, each with a weighting expressed as a band. Two areas sit at 20 to 25 percent, two at 15 to 20 percent, and one at 10 to 15 percent, which makes the exam broad rather than concentrated.
| Objective Area | Weight | What it covers |
|---|---|---|
| Manage Azure identities and governance | 20% to 25% | Microsoft Entra users and groups, licences, external users and self-service password reset; built-in roles and assignments at different scopes; Azure Policy, resource locks, tags, resource groups, subscriptions and cost management |
| Deploy and manage Azure compute resources | 20% to 25% | ARM templates and Bicep files, virtual machines including disks, sizes, availability zones and scale sets, containers through Azure Container Registry, Container Instances and Container Apps, and App Service with plans, certificates, custom DNS, backup and deployment slots |
| Implement and manage storage | 15% to 20% | Storage firewalls, SAS tokens, stored access policies, access keys and identity-based access for Azure Files; storage accounts, redundancy, object replication and encryption; file shares, blob containers, tiers, soft delete, lifecycle management and versioning |
| Implement and manage virtual networking | 15% to 20% | Virtual networks, subnets, peering, public IPs and user-defined routes; NSGs and application security groups, effective security rules, Azure Bastion, service and private endpoints; Azure DNS and load balancing |
| Monitor and maintain Azure resources | 10% to 15% | Azure Monitor metrics, log settings, log queries, alert rules and action groups, Monitor Insights, Network Watcher and Connection Monitor; Recovery Services and Backup vaults, backup policies, restore operations and Azure Site Recovery failover |
Identity and compute together carry 40 to 50 percent of the exam. That is the single most useful fact in the blueprint, and it is the opposite of the intuition many candidates arrive with, which treats Azure administration as primarily a networking job.
The full objective list alongside practice material sits in the AZ-104 exam resources, which is worth reading before allocating any study time.
Exam Facts, and the One Figure Worth Checking
AZ-104 is a 40 to 60 question exam scored out of 1000 with a pass mark of 700, priced at $165 USD. The question count is a range because Microsoft varies the paper, and the score is scaled rather than a straight percentage.
| Parameter | Detail |
|---|---|
| Exam Name | Microsoft Certified – Azure Administrator Associate |
| Exam Code | AZ-104 |
| Number of Questions | 40 to 60 |
| Duration | 100 minutes, per Microsoft’s current exam page |
| Passing Score | 700 out of 1000 |
| Exam Price | $165 USD, varying by country or region |
| Languages | English, Chinese (Simplified), Chinese (Traditional), Korean, Japanese, French, Spanish, German, Portuguese (Brazil), Italian |
| Recommended Training | AZ-104T00-A: Microsoft Azure Administrator |
| Scheduling | Pearson VUE |
The duration is the figure to confirm for yourself. Microsoft’s own exam page currently states that you have 100 minutes to complete the assessment, while a number of secondary sources still quote 120. Check the official AZ-104 exam page before you plan your pacing, because 20 minutes across 50 questions is a meaningful difference.
A scaled score of 700 out of 1000 is not 70 percent of the questions. Microsoft scales results so that papers of differing difficulty are comparable, which means no source can honestly tell you how many questions you must answer correctly.
Identity and Governance Now Opens the Exam
At 20 to 25 percent, identity and governance is joint largest, and it is the area that has grown. It covers two related but distinct jobs: managing who exists in the directory, and managing what they and their resources are allowed to do.
The directory half is Microsoft Entra work. Creating users and groups, managing their properties, handling licences, dealing with external users and configuring self-service password reset. None of it is conceptually difficult, and all of it is the sort of detail that is easy to lose marks on if you have never done it.
The governance half is where the marks concentrate. Azure Policy, resource locks, tags, resource groups and subscriptions, plus cost management through alerts, budgets and Azure Advisor. Role assignment at different scopes appears explicitly, and so does interpreting an existing assignment, which is a different skill from creating one.
The scope question that keeps appearing
Understand how a role assigned at management group, subscription, resource group and resource level inherits downward, and what happens when assignments overlap. Questions here typically describe a permissions situation and ask what a user can actually do, which is answerable only if inheritance is solid.
Compute Is the Other Heavyweight, and It Expects Templates
Deploy and manage Azure compute resources is also 20 to 25 percent, and it is the broadest area in the blueprint. Virtual machines, containers, App Service and infrastructure as code all sit inside it.
Templates come first for a reason. The objectives ask you to interpret an ARM template or a Bicep file, modify an existing one, deploy from it, and export a deployment as a template or convert between the two formats. Interpretation is the operative verb, so you need to read the syntax fluently rather than write it from scratch.
Containers now cover three services rather than one: Azure Container Registry, Container Instances and Container Apps, including sizing and scaling for the latter two. Container Apps is a relatively recent addition to this exam and is a common gap in older study material.
App Service brings its own list: plans and their scaling, certificates and TLS, custom DNS mapping, backup, networking settings and deployment slots. Deployment slots in particular are worth practising, because the swap behaviour is examinable and counterintuitive the first time.
What Changed in the Networking Area
Implement and manage virtual networking now sits at 15 to 20 percent. Older breakdowns placed the networking area considerably higher, so anyone working from a dated study plan is likely to be spending disproportionate time here.
The content itself is stable and practical. Virtual networks and subnets, peering, public IP addresses, user-defined routes and connectivity troubleshooting form the first block; NSGs, application security groups, effective security rules, Azure Bastion, and service and private endpoints form the second; Azure DNS and load balancing form the third.
Two objectives are explicitly about diagnosis rather than configuration: troubleshoot network connectivity, and troubleshoot load balancing. Those reward time spent breaking a working setup and reading what Azure reports, which is a different activity from building one correctly the first time.
Effective security rules deserve a session of their own
Evaluating effective security rules in NSGs is called out as its own objective. When rules exist at both subnet and network interface level, working out what traffic actually passes is a mechanical process, and it is much faster to learn it in the portal than from a diagram.
Monitoring and Maintenance: The Smallest Area, Not the Easiest
Monitor and maintain Azure resources is 10 to 15 percent, the smallest area, and it splits cleanly in two. One half is Azure Monitor: metrics, log settings, log queries, alert rules, action groups, alert processing rules, Monitor Insights, Network Watcher and Connection Monitor. The other half is backup and recovery.
The backup half names specific artefacts, and the distinction between a Recovery Services vault and an Azure Backup vault is exactly the kind of detail a question is built on. Backup policies, restore operations, Azure Site Recovery configuration and performing a failover to a secondary region are all listed individually.
Because the area is small, it is often the one candidates leave until last and then run out of time for. At 10 to 15 percent of a scaled exam it is worth roughly six or seven questions, which is more than enough to decide a marginal result.
Turning the Weightings Into a Study Plan
The bands make the plan arithmetic rather than guesswork, provided you start from the current numbers rather than an older set.
Split your time in the published proportions
Roughly a quarter each to identity and governance and to compute, a fifth each to storage and networking, and the remainder to monitoring. Then move time toward whichever area you consistently score worst on.
Work in a real subscription
Almost every objective is a verb: create, configure, deploy, assign, interpret, troubleshoot. A free or pay-as-you-go subscription with careful cost alerts makes the whole blueprint testable, and cost management is itself an objective.
Read templates, do not just deploy them
The compute area asks you to interpret and modify ARM templates and Bicep files. Take an existing template, change a parameter, redeploy, and see what moves. That is faster than learning the schema abstractly.
Use the official study guide as the source of truth
Microsoft maintains a per-exam study guide that lists topic changes as they happen. The AZ-104 study guide is the place to confirm what has been added or removed since your material was written.
Start higher up the ladder if Azure is new to you
AZ-104 assumes working familiarity with the platform. Anyone coming to Azure cold usually gets more from the fundamentals exam first, and the AZ-900 certification updates cover what that level now includes.
Who the Certification Is Actually For
The credential is aimed at people who implement, manage and monitor an Azure environment as part of a larger infrastructure team, coordinating with networking, security, database and development colleagues rather than owning everything alone.
That framing matters when deciding whether to sit it. Developers, database administrators and security engineers all touch Azure, but AZ-104 examines the administration surface specifically, and someone whose Azure exposure is limited to deploying their own application will find most of the blueprint unfamiliar.
Cloud administration skills remain among the most broadly demanded in infrastructure work, and the Stack Overflow Developer Survey tracks platform adoption year on year, which is a more honest guide to where demand sits than any certification marketing. For a fuller view of the role the credential describes, the Azure Administrator role guide covers the day-to-day work rather than the exam.
One practical detail applies after you pass. Microsoft role-based certifications expire and must be renewed, which is done free through an online assessment on Microsoft Learn rather than by resitting the exam.
Frequently Asked Questions About AZ-104
How many questions are on the AZ-104 exam?
Between 40 and 60. Microsoft varies the paper, so the count is a range rather than a fixed number.
How long is the AZ-104 exam?
Microsoft’s current exam page states you have 100 minutes to complete the assessment. Some secondary sources still quote 120 minutes, so confirm it on the official page before planning your pacing.
What is the passing score for AZ-104?
Seven hundred out of 1000. That is a scaled score, not a percentage of questions answered correctly, so it does not translate into a fixed number of right answers.
How much does AZ-104 cost?
$165 USD, though Microsoft prices exams by the country or region where they are proctored.
Which objective area carries the most marks?
Two share the top position at 20 to 25 percent each: managing Azure identities and governance, and deploying and managing Azure compute resources. Together they are 40 to 50 percent of the exam.
Has the networking weighting changed?
Implement and manage virtual networking currently sits at 15 to 20 percent, lower than the figure many older study plans use. Anyone working from a dated breakdown is likely to be over-allocating time to it.
Does AZ-104 cover containers?
Yes, inside the compute area. It covers Azure Container Registry, provisioning containers with Azure Container Instances and Azure Container Apps, and managing sizing and scaling for both.
Do you need to write ARM templates or Bicep from scratch?
No. The objectives ask you to interpret a template or Bicep file, modify an existing one, deploy from it, and export or convert between the two formats. Reading fluency matters more than authoring.
In which languages is the exam offered?
English, Chinese in both Simplified and Traditional forms, Korean, Japanese, French, Spanish, German, Brazilian Portuguese and Italian.
Does the certification expire?
Yes. Microsoft role-based certifications need renewing, which is done at no cost by passing an online assessment on Microsoft Learn rather than by retaking the full exam.
Conclusion
AZ-104 is a broad exam with no dominant area and one commonly misquoted number. Forty to 60 questions, a scaled 700 out of 1000, $165, and five objective areas spread between 10 and 25 percent.
Plan from the current weightings rather than a remembered set: a quarter each to identity and compute, a fifth each to storage and networking, the rest to monitoring and backup. Then spend the time in a real subscription, because almost every objective in this blueprint is written as something you do rather than something you know.
