AZ-104 Cheat Sheet: Azure Administrator Quick Reference

AZ-104 is an operational exam — it tests whether you can pick the right tool AND the right configuration detail. This sheet organizes the repeated distinctions. Work the AZ-104 question bank and mock exam for applied practice.

RBAC & identity

• Owner = everything + grant access | Contributor = manage all, can't grant | Reader = view | User Access Admin = manage access only
• RBAC is additive: effective = union of all assignments at all scopes; no 'most restrictive wins'
• Scope chain: management group → subscription → resource group → resource; inherits downward
• Dynamic groups, Conditional Access = P1 | PIM, Identity Protection = P2
• SSPR for synced users needs password writeback via Entra Connect — classic gotcha
• Managed identity = credential-free resource auth (system-assigned dies with resource; user-assigned is reusable)

Governance

• Policy = enforce config rules; Initiative = grouped policies assigned once; remediation tasks fix existing non-compliance
• Locks: CanNotDelete / ReadOnly — override ALL permissions including Owner; inherit downward
• Management groups = governance above subscriptions; up to 6 levels deep
• Moving resources: most move between RGs/subscriptions — validate dependencies, expect downtime planning

Storage

• Account kinds: GPv2 (default, all standard) | FileStorage (premium files) | BlockBlobStorage (premium block blobs)
• LRS = 1 DC | ZRS = zones, 1 region | GRS = + paired region (secondary NOT readable) | RA-GRS = readable secondary | GZRS = both
• Access tiers: Hot → Cool → Cold → Archive; lifecycle policies automate transitions by age
• SAS types: user-delegation (Entra-signed, best) > service SAS > account SAS; stored access policy = instant revocation
• Soft delete = undelete window; versioning = every version kept; immutability = WORM compliance
• Azure Files: SMB/NFS shares, NTFS ACLs need identity-based auth; File Sync = on-prem cache + cloud tiering
• AzCopy = CLI copy | Import/Export = ship disks | Data Box = appliance | File Sync = ongoing sync

Compute

• Availability: sets (fault+update domains, 1 DC) → zones (DC-level, regional) → region pairs (regional DR)
• VMSS: Uniform = identical fleet managed as group; Flexible = individual control + orchestration
• Bastion = browser RDP/SSH, no VM public IP | JIT access = time-limited port opening
• Custom Script Extension vs Run Command — both execute remotely; extension is deploy-time, Run Command is on-demand
• App Service: plan tier sets scale ceiling; deployment slots = swap for zero-downtime + rollback
• ACI = run one container fast (per-second billing) | AKS = orchestrated container fleets
• ARM modes: Incremental (default) = add/update only; Complete = DELETES unlisted resources
• Resize = brief deallocation; dynamic public IPs released on deallocate

Networking

• NSG: lowest priority number wins, first match stops; stateful (return traffic auto-allowed); subnet + NIC attachment
• VNet peering: non-transitive, non-overlapping CIDRs, cross-region (global) + cross-subscription OK; transitive needs hub NVA/gateway
• Private endpoint = service's private IP in YOUR VNet | service endpoint = service stays public-addressed but backbone-only
• Load balancing: LB = L4 regional | App Gateway = L7 regional + WAF + path routing | Front Door = L7 global | Traffic Manager = DNS-level
• NAT gateway = static egress IP + huge SNAT port pool; default outbound access is ephemeral (being phased out)
• Private DNS zone + VNet link + autoregistration = internal name resolution
• VPN Gateway = encrypted over internet (S2S needs local network gateway); ExpressRoute = private dedicated
• Network Watcher: IP flow verify = 'which NSG rule blocks this flow'; NSG diagnostics; connection troubleshoot

Monitoring & backup

• Metrics = fast numeric time series (93d default) | Logs = KQL in Log Analytics, richer, pricier
• Alert rule (WHEN) + action group (WHO/HOW) — separate objects
• Activity Log = control-plane audit (who deleted what, 90 days) | diagnostic settings route data-plane logs
• VM insights needs Azure Monitor Agent — platform metrics alone don't see guest OS
• Azure Backup: Recovery Services vault + policy (schedule+retention) — data protection
• Site Recovery: replication + failover — business continuity during regional loss