Training course

This is a free, self-paced reading course for AZ-104: Microsoft Azure Administrator, the associate-level credential for the people who actually run an Azure environment day to day. It is written to be read straight through, in order, before you start drilling practice questions: the material builds the vocabulary and the mental model first, so that a wrong answer on a practice exam becomes a gap you can name rather than a fact you memorize.

The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain’s published weight. That structure is deliberate. It means the time you spend maps to the time the exam spends: identities and governance and compute together carry roughly half of AZ-104, and they carry roughly half of this course. Every lesson ends with its key terms and suggested further reading, so the course works as a reference after the first pass as well as a syllabus during it.

AZ-104 Associate level 5 modules Domain-weighted Self-paced Free account

What the course covers

Manage Azure identities and governance

Module 1 · 20-25%

Microsoft Entra users, groups, licenses, external users, and self-service password reset; Azure RBAC built-in roles, assignment scopes, and interpreting effective access; and subscription governance: Azure Policy, resource locks, tags, management groups, and cost control through budgets, alerts, and Advisor recommendations.

Implement and manage storage

Module 2 · 15-20%

Securing access with storage firewalls, virtual network rules, SAS tokens, stored access policies, access keys, and identity-based access for Azure Files; configuring storage accounts, redundancy options, object replication, and encryption; and managing blobs and file shares (tiers, soft delete, snapshots, versioning, and lifecycle management) with Storage Explorer and AzCopy.

Deploy and manage Azure compute resources

Module 3 · 20-25%

Automating deployment with ARM templates and Bicep; creating and operating virtual machines, encryption at host, moves, sizing, disks, availability zones and sets, and Virtual Machine Scale Sets; provisioning containers with Azure Container Registry, Container Instances, and Container Apps; and configuring App Service plans, scaling, certificates, custom DNS, and deployment slots.

Implement and manage virtual networking

Module 4 · 15-20%

Virtual networks, subnets, and peering; public IPs and user-defined routes; securing access with network security groups, application security groups, Azure Bastion, service endpoints, and private endpoints; plus Azure DNS, internal and public load balancers, and connectivity troubleshooting.

Monitor and maintain Azure resources

Module 5 · 10-15%

Azure Monitor metrics, logs, and KQL queries; alert rules, action groups, and alert processing rules; Insights, Network Watcher, and Connection Monitor; and protection: Recovery Services vaults, backup policies, restores, and regional failover with Azure Site Recovery.

How to use it

Read a module, then take the matching portion of the AZ-104 practice exam rather than waiting until you have finished everything. Reading a domain and immediately testing it exposes the difference between recognizing a term and being able to apply it, which is the difference AZ-104 actually measures. The exam assumes hands-on fluency, if you have never configured an RBAC scope, a storage redundancy option, an NSG rule, or a Recovery Services vault yourself, pair each module with a free-tier Azure subscription and build the thing as you read about it. The course modules themselves open once you are signed in to a free Certifym account.

For exam logistics (question count, timing, the scaled 700 cut score, pricing, and renewal) see the AZ-104 certification guide.

AZ-104: Microsoft Azure Administrator

One module per AZ-104 exam domain, weighted the way Microsoft weights them.

A self-paced reading course for AZ-104: Microsoft Azure Administrator, the associate-level credential for the people who run an Azure environment day to day. The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain's published weight, so the time you spend maps to the time the exam spends.

You work through Microsoft Entra identity and subscription governance, storage accounts and their access controls, compute — templates, virtual machines, containers, and App Service — virtual networking, and finally monitoring, backup, and disaster recovery. Every lesson ends with its key terms and further reading, so the course works as a reference after the first pass as well as a syllabus during it.

The course assumes you are comfortable with operating systems, networking, servers, and virtualization. It does not assume you already know Azure. Pair it with a subscription of your own and build what you read about — AZ-104 measures applied configuration skill, not recall. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation.

Module 1: Manage Azure identities and governance 24% of exam

The heaviest domain on AZ-104, and the one the rest of the exam assumes. You start with Microsoft Entra ID itself — tenants, users, groups, licenses, external collaboration, and self-service password reset — then move to Azure role-based access control, where the work is understanding how role definitions, scopes, and inheritance combine into effective access.The second half is subscription governance: the management group, subscription, and resource group hierarchy; Azure Policy for enforcing standards across it; resource locks for protecting what must not be deleted; tags for cost attribution and automation; and Cost Management budgets, alerts, and Azure Advisor recommendations for keeping spend under control.

1.1 Microsoft Entra ID, tenants, and Azure subscriptions 5 min Free preview
1.2 Creating and managing Microsoft Entra users 5 min 🔒
1.3 Groups, membership types, and license management 5 min 🔒
1.4 External users and B2B collaboration 5 min 🔒
1.5 Self-service password reset 5 min 🔒
1.6 Azure RBAC and built-in roles 5 min Free preview
1.7 Role assignment scopes and inheritance 5 min 🔒
1.8 Interpreting effective access 5 min 🔒
1.9 Management groups, subscriptions, and resource groups 5 min 🔒
1.10 Implementing and managing Azure Policy 5 min 🔒
1.11 Resource locks 5 min 🔒
1.12 Applying and managing tags 5 min 🔒
1.13 Managing costs with budgets, alerts, and Advisor 5 min 🔒

Module 2: Implement and manage storage 19% of exam

Storage on AZ-104 is really two subjects. The first is access: storage firewalls and virtual network rules, shared access signature tokens and the stored access policies that make them revocable, account keys and their rotation, and identity-based access for Azure Files. The second is configuration: account kinds, redundancy options, object replication, and encryption.The module finishes with the data itself — blob containers and file shares, access tiers, soft delete, snapshots, versioning, and lifecycle management — and with the tools you use to move data around, Azure Storage Explorer and AzCopy. Most exam items in this domain are configuration questions with one correct setting, so the lessons are written to pin down exactly what each option does and what it does not.

2.1 Storage accounts: kinds, performance tiers, and endpoints 5 min 🔒
2.2 Storage redundancy and object replication 5 min 🔒
2.3 Storage account encryption 5 min 🔒
2.4 Access keys, shared access signatures, and stored access policies 5 min 🔒
2.5 Storage firewalls, virtual network rules, and private access 5 min 🔒
2.6 Blob containers and access tiers 5 min 🔒
2.7 Data protection: soft delete, snapshots, and versioning 5 min 🔒
2.8 Blob lifecycle management 5 min 🔒
2.9 Azure Files shares and identity-based access 5 min 🔒
2.10 Managing data with Storage Explorer and AzCopy 5 min 🔒

Module 3: Deploy and manage Azure compute resources 24% of exam

The other heavy domain. It opens with automated deployment — reading and modifying ARM templates, working in Bicep, and the export and decompile paths between them — because templates are how the rest of the domain is delivered in practice.The bulk of the module is virtual machines: creating and sizing them, managed disks, encryption at host and the other disk encryption options, moving machines between resource groups, subscriptions, and regions, availability sets and availability zones, and Virtual Machine Scale Sets with autoscale. It closes with the platform compute services AZ-104 expects you to configure from the portal — Azure Container Registry, Container Instances and Container Apps, and App Service plans with certificates, custom domains, networking, backup, and deployment slots.

3.1 Reading and modifying ARM templates 5 min 🔒
3.2 Bicep and converting between formats 5 min 🔒
3.3 Deploying templates and managing deployment history 5 min 🔒
3.4 Creating virtual machines and choosing sizes 5 min 🔒
3.5 Managed disks: types, sizing, and operations 5 min 🔒
3.6 Virtual machine encryption at host and disk encryption 5 min 🔒
3.7 Moving virtual machines between groups, subscriptions, and regions 5 min 🔒
3.8 Availability sets and availability zones 5 min 🔒
3.9 Virtual Machine Scale Sets 5 min 🔒
3.10 Azure Container Registry 5 min 🔒
3.11 Azure Container Instances and Azure Container Apps 5 min 🔒
3.12 App Service plans and scaling 5 min 🔒
3.13 App Service configuration: TLS, custom domains, networking, backup, and slots 5 min 🔒

Module 4: Implement and manage virtual networking 19% of exam

Virtual networks, subnets, and peering come first, because address planning and the non-transitive nature of peering shape every design that follows. Then public IP addresses and outbound connectivity, and user-defined routes for the cases where Azure's default routing is not what you want.The security half covers network security groups and application security groups, reading effective rules when traffic is not arriving, Azure Bastion for administrative access without public IPs, and the two ways to reach platform services privately — service endpoints and private endpoints. The module closes with Azure DNS public and private zones and with load balancing, including how to tell the four load balancing services apart and why health probes cause most distribution faults.

4.1 Virtual networks and subnets 5 min 🔒
4.2 Virtual network peering 5 min 🔒
4.3 Public IP addresses and outbound connectivity 5 min 🔒
4.4 System routes and user-defined routes 5 min 🔒
4.5 Network security groups and application security groups 5 min 🔒
4.6 Effective security rules and troubleshooting connectivity 5 min 🔒
4.7 Azure Bastion 5 min 🔒
4.8 Service endpoints and private endpoints 5 min 🔒
4.9 Azure DNS: public and private zones 5 min 🔒
4.10 Load balancing and troubleshooting distribution 5 min 🔒

Module 5: Monitor and maintain Azure resources 14% of exam

The lightest domain by weight and the one most often skipped, which is why it is worth reading carefully. The first half is Azure Monitor: the difference between metrics and logs, diagnostic settings and what they route where, querying a Log Analytics workspace with KQL, and building alert rules with action groups and alert processing rules. It closes with the curated Insights experiences and the network monitoring tools — Network Watcher, Traffic Analytics, and Connection Monitor.The second half is protection: Recovery Services vaults and Backup vaults, backup policies and the restore options for each workload type, and Azure Site Recovery for replicating machines to a second region and failing over to it. The exam draws a clear line between backup and disaster recovery, and so does the module.

5.1 Azure Monitor: metrics, logs, and diagnostic settings 5 min 🔒
5.2 Querying logs with Log Analytics and KQL 5 min 🔒
5.3 Alert rules, action groups, and alert processing rules 5 min 🔒
5.4 Insights, Network Watcher, and Connection Monitor 5 min 🔒
5.5 Recovery Services vaults and Azure Backup vaults 5 min 🔒
5.6 Backup policies, backup jobs, and restore 5 min 🔒
5.7 Azure Site Recovery and regional failover 5 min 🔒

Frequently asked questions about the AZ-104 training course

Is the AZ-104 training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official AZ-104 exam domain, in Microsoft’s published order, with each module weighted to the domain’s published percentage range. Within each module the material is broken into short lessons, followed by key terms and further reading.

Does this replace Microsoft’s official training?

No. Microsoft Learn publishes free official learning paths for AZ-104, and they are the authoritative source. This course is an independent study companion, written to be read quickly and to slot alongside practice questions, not a substitute for the official study guide.

Do I need Azure experience before starting?

The course assumes you are comfortable with operating systems, networking, servers, and virtualization. It does not assume you already know Azure. If you are new to the platform entirely, read the AZ-900 fundamentals material first.

What should I do after finishing the course?

Move to the AZ-104 practice exam and work until you are clearing 70% consistently across every domain rather than by leaning on your strong areas. Then book with Pearson VUE.

Is the course current with the latest AZ-104 outline?

The course is built against the outline as refreshed on April 17, 2026, which was a minor update, small refinements to VM configuration, container provisioning, networking, and monitoring topics, with no structural change to the five domains or their weightings. Microsoft can revise the outline at any time; verify the current study guide on Microsoft Learn before you sit the exam.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft®, Azure®, Microsoft Entra™, and AZ-104 are trademarks or registered trademarks of Microsoft Corporation. Use of these marks is solely to identify the certification for which these study materials are intended. The AZ-104 study guide and its skill outline are the property of Microsoft Corporation; candidates should review the official, current study guide directly on Microsoft Learn.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual Microsoft training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by Microsoft and may change; always verify current details on Microsoft Learn before scheduling your exam.