AZ-104 study guide · 2026

The 5 AZ-104 domains, explained

5 domains and 15 official functional groups. Manage Azure identities and governance carries the most weight at 20–25%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
40–60 (varies)
Time
100 minutes
Passing score
700 / 1000
Outline
Skills measured as of 17 April 2026 (current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 20–25%
  2. 2 15–20%
  3. 3 20–25%
  4. 4 15–20%
  5. 5 10–15%
  1. 1 Manage Azure identities and governance
  2. 2 Implement and manage storage
  3. 3 Deploy and manage Azure compute resources
  4. 4 Implement and manage virtual networking
  5. 5 Monitor and maintain Azure resources

All 5 domains

15 official functional groups 80–105 hrs suggested study

  1. Domain 01 20–25%

    Manage Azure identities and governance

    This domain covers the administrator's control plane: managing Microsoft Entra users and groups, assigning access with Azure role-based access control, and governing subscriptions with Azure Policy, resource locks, tags and cost controls.

    Inside this domain

    • Manage Microsoft Entra users and groups
    • Manage access to Azure resources
    • Manage Azure subscriptions and governance

    Watch for Owner for resource management

    Functional groups
    3
    Questions est.
    9–14
    Study time est.
    20–25 hrs
  2. Domain 02 15–20%

    Implement and manage storage

    This domain covers administering Azure Storage: securing access with firewalls, SAS tokens and access keys, configuring storage accounts and redundancy, and managing Azure Files and Blob Storage with tiers, lifecycle, versioning and soft delete.

    Inside this domain

    • Configure access to storage
    • Configure and manage storage accounts
    • Configure Azure Files and Azure Blob Storage

    Watch for Key for delegated access

    Functional groups
    3
    Questions est.
    7–10
    Study time est.
    15–20 hrs
  3. Domain 03 20–25%

    Deploy and manage Azure compute resources

    This domain covers deploying and running compute: ARM templates and Bicep for automated deployment, virtual machines and scale sets, containers with Container Instances and Container Apps, and Azure App Service for web apps.

    Inside this domain

    • Automate deployment of resources by using ARM templates or Bicep files
    • Create and configure virtual machines
    • Provision and manage containers in the Azure portal
    • Create and configure Azure App Service

    Watch for Set for datacenter outage

    Functional groups
    4
    Questions est.
    9–14
    Study time est.
    20–25 hrs
  4. Domain 04 15–20%

    Implement and manage virtual networking

    This domain covers Azure networking: virtual networks, subnets, peering, public IPs and routing; securing access with network security groups, Bastion and private and service endpoints; and name resolution and load balancing.

    Inside this domain

    • Configure and manage virtual networks in Azure
    • Configure secure access to virtual networks
    • Configure name resolution and load balancing

    Watch for Public IP and open RDP

    Functional groups
    3
    Questions est.
    7–10
    Study time est.
    15–20 hrs
  5. Domain 05 10–15%

    Monitor and maintain Azure resources

    This domain covers keeping Azure healthy: monitoring with Azure Monitor metrics, logs, alerts and Insights and Network Watcher, and protecting data with Azure Backup and Azure Site Recovery for backup, restore and regional failover.

    Inside this domain

    • Monitor resources in Azure
    • Implement backup and recovery

    Watch for Backup for regional failover

    Functional groups
    2
    Questions est.
    5–8
    Study time est.
    10–15 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 80–105 hrs of study.

  1. 1 Manage Azure identities and governance 20–25% · 20–25 hrs
  2. 3 Deploy and manage Azure compute resources 20–25% · 20–25 hrs
  3. 2 Implement and manage storage 15–20% · 15–20 hrs
  4. 4 Implement and manage virtual networking 15–20% · 15–20 hrs
  5. 5 Monitor and maintain Azure resources 10–15% · 10–15 hrs

Try one

Practice questionDomain 1: Manage Azure identities and governance

A team needs to create and manage virtual machines within a single resource group named RG-Prod, but must not be able to grant access to others or affect resources outside that resource group. Which role assignment follows least privilege?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Owner for resource management

    Clue The team manages resources but does not need to grant access.

  • Domain 2

    Key for delegated access

    Clue The access should be temporary and limited in scope.

  • Domain 3

    Set for datacenter outage

    Clue The requirement is to survive a datacenter failure within a region.

  • Domain 4

    Public IP and open RDP

    Clue Secure remote access is needed without exposing VMs.

  • Domain 5

    Backup for regional failover

    Clue The requirement is regional failover of running workloads.

Other Cloud Computing certifications

Study guides for exams that overlap with AZ-104.

Practise what you read

AZ-104 domains: common questions

How many domains are in the AZ-104 exam?

AZ-104 has 5 domains with 15 official functional groups between them: Manage Azure identities and governance, Implement and manage storage, Deploy and manage Azure compute resources, Implement and manage virtual networking and Monitor and maintain Azure resources.

Which AZ-104 domain carries the most weight?

Manage Azure identities and governance is the heaviest at 20–25%, followed by Deploy and manage Azure compute resources (20–25%). The lightest is Monitor and maintain Azure resources (10–15%). Weights come from Microsoft's official outline.

What is the AZ-104 exam format?

Questions: 40–60 (varies). Time allowed: 100 minutes. Passing score: 700 / 1000.

How long should I study for AZ-104?

Our planning estimate is 80–105 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Manage Azure identities and governance, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Skills measured as of 17 April 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (Skills measured as of 17 April 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.