AZ-104: Azure Administrator — PowerShell Prep

Exam facts

AZ-104 is a scenario-heavy exam. Expect roughly 40–60 questions in about 120 minutes, with a passing score of 700 out of 1000. Question formats include multiple choice, case studies, drag-and-drop, and yes/no statements. The exam tests the Az PowerShell module, not the retired AzureRM module — if you see AzureRM cmdlets in old blog posts, ignore them.

PowerShell is one tool the exam tests, not the whole exam. Many tasks are also doable in the Azure portal and Azure CLI. This track covers the PowerShell side thoroughly, but you should still know where each task lives in the portal, because some questions ask you to pick the right tool, not just the right command.

How to use this track

Work through the domains in the order below, but if you have not installed the Az module yet, start with Domain 6 first — it covers installation, sign-in, and subscription context, which every other domain assumes. Each domain section follows the same pattern: what the exam tests, a command table, runnable examples, an exercise, and the exam traps.

Suggested study order: Domain 6 (setup) → Domain 1 (governance) → Domain 4 (networking) → Domain 3 (compute) → Domain 2 (storage) → Domain 5 (monitoring). Networking before compute matters because every VM you deploy needs a virtual network, a subnet, and a network security group first.

Domain 1: Manage Microsoft Entra users and groups and governance — 20–25%

This is the highest-value domain per question. The exam tests role-based access control (RBAC) more than any other PowerShell topic: who can do what, at which scope, and how to verify it. Scope is the concept that trips up most candidates. An assignment at subscription scope applies to everything in that subscription; an assignment at resource group scope applies only to that group; an assignment at resource scope applies to one resource. The exam loves questions where the correct answer changes because the scope is wrong.

Governance also covers Azure Policy, resource locks, tags, and management groups. Policy enforces rules (for example, only certain VM sizes allowed). Locks prevent accidental deletion or modification. Tags organize resources for cost tracking and ownership. Management groups sit above subscriptions and let you apply policy and RBAC across many subscriptions at once. Know the difference: policy prevents non-compliant resources from being created, while a lock prevents an existing resource from being changed or deleted.

Exam trap — lock inheritance: Locks are inherited down the hierarchy. A ReadOnly lock on a resource group locks every resource inside it, even if those resources have no lock of their own. And a lock on a parent does not block a lock on a child — but the most restrictive lock wins. If a question says "a user cannot delete a VM even though they are Owner," check for a CanNotDelete lock on the resource group before anything else.

# Assign Reader at resource group scope, then verify it
New-AzRoleAssignment -SignInName "priya@contoso.com" -RoleDefinitionName "Reader" -ResourceGroupName "rg-web"
Get-AzRoleAssignment -SignInName "priya@contoso.com" -ResourceGroupName "rg-web" |
  Select-Object DisplayName, RoleDefinitionName, Scope

# Protect a production resource group from deletion, then tag it
New-AzResourceLock -LockName "NoDelete" -LockLevel CanNotDelete -ResourceGroupName "rg-prod"
New-AzTag -ResourceId (Get-AzResourceGroup -Name "rg-prod").ResourceId `
  -Tag @{ Environment = "Production"; Owner = "platform-team" }

Exercise: Scoped RBAC

1. Create a resource group named rg-rbac-lab.
2. Assign the Contributor role to a test user at that resource group scope only.
3. Run Get-AzRoleAssignment for that user and confirm the Scope ends at rg-rbac-lab, not at the subscription.
4. Remove the assignment, then try assigning Reader at subscription scope and compare the Scope value. Explain why the subscription-scope assignment is the riskier choice.

Domain 2: Implement and manage storage — 15–20%

Storage questions focus on the blob lifecycle: create an account, create a container, upload blobs, control access, and manage keys. The exam tests the difference between storage account kinds (StorageV2 is the current general-purpose kind), access tiers (Hot, Cool, Cold, Archive), and redundancy options (LRS, GRS, ZRS). Know that changing the access tier does not move data instantly for Archive — rehydration takes hours, and the exam uses that as a distractor.

Shared access signatures (SAS tokens) are the most-tested storage security topic. A SAS token grants time-limited, permission-limited access to a container or blob without sharing account keys. The exam tests which permissions a SAS token needs (read, write, list, delete) and what happens when it expires. Key rotation is the other security topic: when a key is compromised, regenerate it, and remember that applications using the old key break until they are updated.

Exam trap — storage account naming: Storage account names must be 3–24 characters, lowercase letters and numbers only, and globally unique across all of Azure. A name with uppercase letters, hyphens, or underscores fails at creation. If a question shows a storage account creation failing, check the name first — it is the most common cause and the easiest to miss.

# Create a storage account, container, and upload a file
New-AzStorageAccount -ResourceGroupName "rg-web" -Name "stwebapp001" `
  -Location "East US" -SkuName "Standard_LRS" -Kind "StorageV2"
$ctx = (Get-AzStorageAccount -ResourceGroupName "rg-web" -Name "stwebapp001").Context
New-AzStorageContainer -Name "uploads" -Context $ctx -Permission Off
Set-AzStorageBlobContent -File "C:\data\report.pdf" -Container "uploads" `
  -Blob "report.pdf" -Context $ctx

# Generate a read-only SAS token valid for one hour
New-AzStorageBlobSASToken -Container "uploads" -Blob "report.pdf" `
  -Permission r -ExpiryTime (Get-Date).AddHours(1) -Context $ctx

Exercise: Storage with lifecycle

1. Create a StorageV2 account with Standard_LRS redundancy.
2. Create a container with private (Off) access and upload a file to it.
3. Generate a SAS token with read-only permission and a 1-hour expiry, then use the SAS URL to download the file.
4. Rotate key2 with New-AzStorageAccountKey and confirm the old key2 value no longer works. Explain why key rotation must be coordinated with applications.

Domain 3: Deploy and manage Azure compute resources — 20–25%

Compute is the largest hands-on domain. The exam tests the full VM lifecycle: create, start, stop, restart, resize, snapshot, and delete. It also tests managed disks, availability sets versus availability zones, Virtual Machine Scale Sets, App Service plans, and container instances. The single most important distinction in this domain is the difference between stopping a VM from inside the operating system and stopping it with PowerShell — they are not the same, and the billing consequence is the exam's favorite trap.

Disk management is the second pillar. Know the disk SKUs (Standard HDD, Standard SSD, Premium SSD, Ultra Disk) and when each fits. Know that you attach data disks with Add-AzVMDataDisk and that snapshots capture a point-in-time copy for backup or for creating new disks. For App Service, know the plan tiers (Free, Shared, Basic, Standard, Premium) and that deployment slots exist only on Standard and above — a question that asks for a staging slot on a Free plan is testing whether you know that limit.

Exam trap — stopped versus deallocated: Stop-AzVM deallocates the VM: Azure releases the hardware, stops billing for compute, and the VM loses its dynamic public IP unless it is static. Stopping from inside the OS (Start menu shutdown) only stops the OS — Azure still reserves the hardware and still bills you for compute. If a question says "a VM is stopped but still incurring compute charges," the answer is almost always that it was stopped from inside the OS, not deallocated.

# Create a VM, then check its power state (the -Status flag is required)
New-AzVM -ResourceGroupName "rg-web" -Name "web01" -Location "East US" `
  -Image "Win2022Datacenter" -Size "Standard_B2s" `
  -VirtualNetworkName "vnet-web" -SubnetName "subnet-web"
Get-AzVM -ResourceGroupName "rg-web" -Name "web01" -Status |
  Select-Object Name, PowerState

# Stop (deallocate) a VM, resize it, and restart it
Stop-AzVM -ResourceGroupName "rg-web" -Name "web01" -Force
$vm = Get-AzVM -ResourceGroupName "rg-web" -Name "web01"
$vm.HardwareProfile.VmSize = "Standard_B4ms"
Update-AzVM -ResourceGroupName "rg-web" -VM $vm
Start-AzVM -ResourceGroupName "rg-web" -Name "web01"

Exercise: VM lifecycle

1. Deploy a VM with a public IP and confirm it is running with Get-AzVM -Status.
2. Stop it with Stop-AzVM and confirm the PowerState shows deallocated.
3. Resize it to a larger SKU with Update-AzVM, then start it again.
4. Take a snapshot of its OS disk, then delete the VM. Check whether the disk and NIC still exist — explain why Remove-AzVM does not delete them by default.

Domain 4: Implement and manage virtual networking — 20–25%

Networking questions test whether you can build a working topology: a virtual network with address space, subnets, a network security group with rules, a public IP, a network interface, and the VM that ties them together. The exam also tests DNS (Azure DNS zones and records), VNet peering, VPN Gateway, load balancers, and private endpoints. The rule that governs almost every NSG question is priority order, and the rule that governs peering questions is that peering is non-transitive.

NSG rules are evaluated by priority number, lowest first, and the first matching rule wins. Default rules exist at the bottom (priority 65000 and above) and allow VNet-to-VNet traffic while denying all other inbound traffic. A custom allow rule at priority 100 beats a custom deny rule at priority 200, even if the deny rule is listed first in the portal. Subnet changes are another trap: you modify a subnet object in memory, then you must call Set-AzVirtualNetwork to persist the change — without that call, nothing is saved.

Exam trap — NSG priority and persistence: Lower priority number wins, and evaluation stops at the first match. A deny rule at priority 4096 never fires if an allow rule at priority 100 already matched the same traffic. Separately, adding a subnet configuration to a VNet object in memory does nothing until you run Set-AzVirtualNetwork. If a question says "the subnet was added but does not appear in the portal," the missing Set-AzVirtualNetwork call is the answer.

# Build a VNet with two subnets, then persist it
$vnet = New-AzVirtualNetwork -ResourceGroupName "rg-web" -Name "vnet-web" `
  -Location "East US" -AddressPrefix "10.0.0.0/16"
Add-AzVirtualNetworkSubnetConfig -Name "subnet-web" -AddressPrefix "10.0.1.0/24" -VirtualNetwork $vnet
Add-AzVirtualNetworkSubnetConfig -Name "subnet-db" -AddressPrefix "10.0.2.0/24" -VirtualNetwork $vnet
$vnet | Set-AzVirtualNetwork

# Create an NSG that allows HTTP and denies everything else inbound
$nsg = New-AzNetworkSecurityGroup -ResourceGroupName "rg-web" -Name "nsg-web" -Location "East US"
$nsg | Add-AzNetworkSecurityRuleConfig -Name "AllowHTTP" -Priority 100 `
  -Direction Inbound -Access Allow -Protocol Tcp `
  -SourceAddressPrefix "*" -SourcePortRange "*" `
  -DestinationAddressPrefix "*" -DestinationPortRange 80
$nsg | Add-AzNetworkSecurityRuleConfig -Name "DenyAllInbound" -Priority 4096 `
  -Direction Inbound -Access Deny -Protocol "*" `
  -SourceAddressPrefix "*" -SourcePortRange "*" `
  -DestinationAddressPrefix "*" -DestinationPortRange "*"
$nsg | Set-AzNetworkSecurityGroup

Exercise: NSG lockdown audit

1. Create an NSG with an allow rule for port 3389 from your corporate range only, and a deny-all-inbound rule at priority 4096.
2. Add a second allow rule for port 3389 from 0.0.0.0/0 at priority 200. Explain which rule wins for traffic from outside the corporate range, and why.
3. Remove the overly broad rule and verify the NSG only allows 3389 from the corporate range.
4. Peer two VNets and confirm that a third VNet peered to only one of them cannot reach the other — proving peering is non-transitive.

Domain 5: Monitor and maintain Azure resources — 10–15%

Monitoring is the smallest domain by weight but the easiest to score points in, because the workflow is consistent: collect data into a Log Analytics workspace, set diagnostic settings on resources to send logs there, create action groups that define who gets notified, and create alert rules that fire when a metric crosses a threshold. The exam tests which piece does which job — a common distractor is confusing an action group (the notification target) with an alert rule (the condition that triggers).

Backup is the other half of this domain. Azure Backup uses Recovery Services vaults. You create a vault, enable backup protection on a VM, and the backup policy controls schedule and retention. The exam tests the difference between an on-demand backup (triggered manually) and a scheduled backup (triggered by policy), and what happens to a VM's backup data when the VM itself is deleted (the backup data remains in the vault until the vault is deleted or the backup item is explicitly removed).

Exam trap — action group versus alert rule: An action group does not detect anything. It only defines what happens when an alert fires (email, SMS, webhook, ITSM ticket). An alert rule defines the condition (for example, CPU above 80 percent for 5 minutes) and points at an action group. If a question says "no notification was sent even though CPU exceeded the threshold," check whether the alert rule exists and is enabled — the action group alone never fires.

# Create a Log Analytics workspace and send VM diagnostics to it
New-AzOperationalInsightsWorkspace -ResourceGroupName "rg-web" -Name "law-web" `
  -Location "East US" -Sku "PerGB2018"
$vmId = (Get-AzVM -ResourceGroupName "rg-web" -Name "web01").Id
$wsId = (Get-AzOperationalInsightsWorkspace -ResourceGroupName "rg-web" -Name "law-web").ResourceId
Set-AzDiagnosticSetting -ResourceId $vmId -WorkspaceId $wsId -Enabled $true

# Create an action group and a CPU alert that notifies it
$receiver = New-AzActionGroupReceiver -Name "OnCall" -EmailReceiver -EmailAddress "oncall@contoso.com"
New-AzActionGroup -ResourceGroupName "rg-web" -Name "ag-oncall" -ShortName "oncall" -Receiver $receiver
Add-AzMetricAlertRuleV2 -Name "HighCPU" -ResourceGroupName "rg-web" `
  -TargetResourceId $vmId -Condition (New-AzMetricAlertRuleV2Criteria -MetricName "Percentage CPU" -TimeAggregation Average -Operator GreaterThan -Threshold 80) `
  -ActionGroupId (Get-AzActionGroup -ResourceGroupName "rg-web" -Name "ag-oncall").Id

Exercise: Backup enablement

1. Create a Recovery Services vault in the same region as your VM.
2. Enable backup protection on the VM with the default policy.
3. Trigger an on-demand backup and check its job status with Get-AzRecoveryServicesBackupJob.
4. Explain what happens to the backup data if you delete the VM but keep the vault.

Domain 6: Setup and context — Az module, subscriptions, and resource groups

Every other domain assumes this foundation, so learn it first even though it is listed last. Install the Az module from the PowerShell Gallery, sign in with Connect-AzAccount, and confirm which subscription and tenant you are operating in before running any command that creates or modifies resources. Most "I created a resource but cannot find it" problems are subscription-context problems: the resource went to a different subscription than the one showing in the portal.

Contexts are how PowerShell tracks which subscription you are working in. Get-AzContext shows the current context; Set-AzContext switches it. When you work with multiple subscriptions, save contexts with Save-AzContext so you can switch back without signing in again. Resource groups are the deployment and lifecycle boundary: deleting a resource group deletes everything in it, which is both the fastest cleanup tool and the most dangerous command in this track.

Exam trap — AzureRM versus Az: The AzureRM module was retired. The exam expects Az cmdlets, and any question mentioning AzureRM is either historical or a distractor. If a script uses Login-AzureRmAccount or New-AzureRmResourceGroup, it will not run on a current system. The Az equivalents are Connect-AzAccount and New-AzResourceGroup. Also note that Get-AzVM without -Status does not show power state — the exam tests that flag explicitly.

# Install the Az module, sign in, and confirm your context
Install-Module Az -Scope CurrentUser -Repository PSGallery -Force
Connect-AzAccount
Get-AzContext | Select-Object Name, Account, Tenant

# Switch subscriptions, create a resource group, and verify it
Get-AzSubscription | Select-Object Name, Id, State
Select-AzSubscription -SubscriptionName "Visual Studio Enterprise"
New-AzResourceGroup -Name "rg-web" -Location "East US" -Tag @{ Project = "AZ104Lab" }
Get-AzResourceGroup -Name "rg-web" | Select-Object ResourceGroupName, Location, Tags

Exercise: End-to-end lab — deploy a 2-tier web app

This single scenario exercises four domains at once and is the closest thing on this page to an exam simulation.

1. Create a resource group rg-2tier in East US.
2. Build a VNet vnet-2tier (10.1.0.0/16) with two subnets: subnet-web (10.1.1.0/24) and subnet-db (10.1.2.0/24). Persist with Set-AzVirtualNetwork.
3. Create an NSG that allows HTTP (80) and HTTPS (443) inbound, denies all other inbound traffic, and associate it with subnet-web.
4. Deploy a VM into subnet-web with a public IP, then confirm its power state with Get-AzVM -Status.
5. Create a StorageV2 account and a container, upload a file, and generate a read-only SAS token for it.
6. Assign Reader at the rg-2tier scope to a test user and verify with Get-AzRoleAssignment.
7. Clean up by removing the resource group — and confirm that the VNet, VM, storage account, and role assignment scope all disappear with it.

Exam tips

Read every question twice and underline the scope, the SKU, and the verb. AZ-104 questions are precise: "at the resource group scope" versus "at the subscription scope" changes the answer, "Standard_B2s" versus "Standard_D2s_v3" changes the answer, and "create" versus "list" changes the cmdlet entirely. When two answers look similar, the one that matches the stated scope and the stated permission level is usually correct.

For scenario questions, work backwards from the constraint. If the scenario says "minimize cost," the answer involves deallocation, a lower tier, or LRS redundancy. If it says "minimize downtime," the answer involves availability zones, scale sets, or a load balancer. If it says "least privilege," the answer is the narrowest role at the narrowest scope — Reader at resource group scope beats Contributor at subscription scope every time.

Time management matters. Flag case studies and come back to them after the short questions. A single case study can eat ten minutes if you let it, and the short questions are worth the same marks. If you finish early, use the remaining time to re-check questions where you hesitated between two cmdlets — those are the ones where a second read catches a scope or parameter mistake.

Commands quick reference

All cmdlets on this page, grouped by domain, for night-before revision.

Keep going

After this track, work through the Azure PowerShell track for deeper hands-on lessons, and the Entra PowerShell track for identity topics that overlap with Domain 1. Each command page linked above has its own examples and exercises — use them to drill the cmdlets you are weakest on before booking the exam.