How to Pass AZ-104: The 6-Week Administrator Plan

AZ-104 is a real jump from AZ-900 — it expects operational fluency, not vocabulary. Candidates who've actually deployed VMs, configured NSGs, and broken a storage firewall in the portal pass much more reliably than pure-readers. Six weeks at ~1–1.5 hours/day is realistic with a free Azure account (the $200 credit covers everything you'll practice). Coming from AWS? Your architecture knowledge transfers, but Azure's identity model, networking names, and portal workflows need dedicated reps.

Week 1 — Identity & governance

• Entra ID operations: users, groups (assigned vs dynamic), guest B2B, administrative units
• RBAC deep-dive: built-in roles, custom role JSON, scope levels, additive model — do the lab
• Policy: definitions vs initiatives, effects (deny/audit/append/modify/deployIfNotExists), remediation
• Management groups, locks, tags, moving resources between subscriptions
• License gates: P1 (dynamic groups, CA) vs P2 (PIM, Identity Protection) — memorize this table

Week 2 — Storage

• Account kinds + what each unlocks; redundancy options including the RA-GRS readable-secondary nuance
• Access control lab: account key vs SAS types vs stored access policy — create, revoke, observe
• Access tiers + lifecycle policies; soft delete/undelete flow
• Azure Files: mount a share, identity-based auth for ACLs, File Sync concept
• Transfer tools: AzCopy a large folder, know when Import/Export or Data Box wins instead

Week 3 — Compute (biggest domain)

• Deploy VMs: sizes, disks, availability sets vs zones; resize one and watch the deallocation/IP release
• Scale sets uniform vs flexible; extensions and Run Command
• Bastion setup — RDP without public IPs
• App Service: deploy an app, create a staging slot, swap — this is a guaranteed exam scenario
• ACI vs AKS lab: run one container in each; know when each is the right answer
• ARM templates: deploy from a template, understand incremental vs complete mode

Week 4 — Virtual networking

• Build a 2-VNet design: subnets, CIDR, NSG rules with priority ordering — then break it and trace with IP flow verify
• Peer the VNets; test transitivity yourself (it fails — that's the lesson)
• Private endpoint vs service endpoint — configure both, feel the difference
• Load balancers: internal LB, then Application Gateway with path rules
• DNS: private zone + VNet link; NAT gateway for outbound
• VPN Gateway S2S concepts + ExpressRoute positioning (hands-on S2S optional — it's slow)

Week 5 — Monitoring, backup + first full mock

• Monitor: metrics vs logs; write a KQL query; build a metric alert + action group
• Activity Log vs diagnostic settings — find a deletion event in the log
• VM insights: enable, look at dependency maps
• Backup: Recovery Services vault, policy, backup + restore a VM
• Site Recovery concepts: replication, test failover vs real failover
• Timed full mock exam — expect networking and governance gaps to surface

Week 6 — Targeted review + exam tactics

• Redo every wrong question; drill the 'which tool/service' distinctions (LB vs AppGW vs Front Door, SAS types, alert types)
• Case-study practice: AZ-104 case studies eat time — read the requirements list FIRST, then the scenario
• Portal muscle memory: know where RBAC assignments, NSG rules, backup policies, and locks live in the UI
• Final mock: target 80%+ before booking

The traps that fail AWS-trained candidates

• RBAC is additive — there's no 'deny overrides allow' like IAM's evaluation logic (denies need Policy/deny assignments)
• NSGs are stateful; unlike AWS NACLs, return traffic is auto-allowed — the security-group model maps closer
• Resource groups ≈ nothing in AWS — a lifecycle/management container that isn't a VPC or an account
• Management groups ≈ AWS OUs but above subscriptions; Azure Policy ≈ SCP + Config rules combined
• AZ-104 is operational (configure/fix), SAA is design (choose architecture) — study for implementation detail
• Case studies dominate time — budget 2 minutes/question max on non-case items

What 'ready' looks like

You're ready when the tool-distinction questions are automatic: RBAC vs Policy vs locks, private vs service endpoint, LB vs App Gateway vs Front Door, Backup vs Site Recovery, metric vs log vs activity-log alert. If you can configure each of the five domains' core tasks in the portal without docs, the exam is passable — aim for consistent 80%+ on timed mocks before booking.