The five AZ-104 exam domains, one card each - the summary to read before a quiz run, and the thing to re-read after getting one wrong. Percentages are the domain's weight in the exam outline.
1. Manage Azure Identities & Governance
20-25%
Who can do what, and the rules that keep the environment compliant.
- Microsoft Entra ID: users & groups (Assigned vs Dynamic), B2B guests, devices, SSPR, bulk CSV operations.
- RBAC scope: Management group → Subscription → Resource group → Resource (inherits down). Assignment = principal + role + scope.
- Core roles: Owner (full + grant access), Contributor (full, no access grant), Reader (view), User Access Administrator (access only).
- Azure Policy: enforces rules (allowed regions/SKUs, required tags). Effects: Deny, Audit, Append, DeployIfNotExists, Modify. Initiatives group policies.
- Locks: CanNotDelete & ReadOnly, inherit to children. Tags: metadata, not inherited by default.
- Editions: Conditional Access needs P1; PIM & risk policies need P2. Cost Management budgets alert on spend.
Must remember: Permissions are cumulative, but a deny assignment overrides any allow - even Owner.
2. Implement & Manage Storage
15-20%
Durable object, file and blob storage with the right cost and access model.
- Account: StorageV2 is the default. Performance Standard (HDD) vs Premium (SSD).
- Redundancy: LRS (1 datacenter) → ZRS (3 zones) → GRS (geo-paired) → GZRS. RA- variants add secondary read access.
- Blob tiers: Hot → Cool (30d) → Cold (90d) → Archive (offline - rehydrate before reading).
- Lifecycle rules auto-tier/delete by age; soft delete recovers deleted data.
- Access: SAS types - account, service, user-delegation (Entra-backed, most secure). Restrict by IP, time, permissions. Prefer identities over keys.
- Tools: Azure Files + File Sync for hybrid shares; AzCopy for bulk copy; Storage Explorer for browsing.
Must remember: Archive can't be read directly, and a user-delegation SAS beats key-based SAS for security.
3. Deploy & Manage Azure Compute Resources
20-25%
Run workloads on VMs, scale sets, containers and App Service.
- VM availability: Availability Set = fault/update domains, one datacenter (99.95%). Availability Zones = separate datacenters (99.99%).
- VMSS: identical VMs with autoscale. Scale up = bigger instance; scale out = more instances.
- Disks: Standard HDD/SSD, Premium SSD, Ultra. Encryption: SSE (default) or Azure Disk Encryption (BitLocker/DM-Crypt). Temp disk is ephemeral.
- IaC: ARM/Bicep. Incremental (default, additive) vs Complete (deletes resources not in the template, within that RG).
- Containers: ACI (single, serverless), AKS (orchestration + node pools), ACR (private image registry).
- App Service: plan sets the compute tier; deployment slots enable swap/rollback; Compute Gallery shares versioned images.
Must remember: Availability Set protects within one datacenter only; use Zones for datacenter-level resilience.
4. Implement & Manage Virtual Networking
15-20%
Connect, segment and secure resources - the domain most find hardest.
- VNets/subnets: private ranges 10/8, 172.16/12, 192.168/16. Azure reserves 5 IPs per subnet; a subnet lives in one VNet.
- Peering: non-transitive; overlapping address spaces can't peer; uses the Azure backbone.
- NSG: stateful; lower priority number wins; applied at subnet and/or NIC (both must allow). ASGs group VMs by workload.
- PaaS access: service endpoint (service keeps public IP) vs private endpoint / Private Link (private IP in your VNet).
- Access & DNS: Azure Bastion for portal RDP/SSH without a public IP; Azure DNS public/private zones; UDRs override system routes.
- Load balancing: Load Balancer = L4 (TCP/UDP); Application Gateway = L7 (URL routing, WAF, SSL offload).
Must remember: Peering is non-transitive and NSG priority is lowest-number-wins - the two most-tested facts here.
5. Monitor & Maintain Azure Resources
10-15%
Observe, alert on, back up and recover the environment.
- Azure Monitor: Metrics = numeric, near-real-time (alerts); Logs = KQL in a Log Analytics workspace (investigation).
- Alerts: signal + condition + action group (email/SMS/webhook/runbook). Metric alerts vs log (search) alerts.
- Activity Log: control-plane 'who did what'. Diagnostic settings route logs/metrics to Log Analytics, Storage or Event Hub.
- Azure Backup + Recovery Services vault: restore VMs/files; MARS agent for on-prem; soft delete protects backups.
- Azure Site Recovery (ASR): replicate + fail over whole workloads to a second region (disaster recovery).
- Network Watcher diagnoses connectivity; Application Insights monitors app performance.
Must remember: Backup restores data; Site Recovery fails over the running workload - don't confuse the two.