AZ-104 · Domain 2 of 5

AZ-104 Domain 2: Implement and manage storage

This domain covers administering Azure Storage: securing access with firewalls, SAS tokens and access keys, configuring storage accounts and redundancy, and managing Azure Files and Blob Storage with tiers, lifecycle, versioning and soft delete.

Exam weight
15–20%
Official functional groups
3
Estimated questions estimate
7–10
Suggested study time estimate
15–20 hrs

About 10 min read Reviewed October 2026

Overview

Implement and manage storage covers administering Azure Storage end to end. It has three objective groups. Configuring access covers Storage firewalls and virtual networks, shared access signature (SAS) tokens, stored access policies, access keys, and identity-based access for Azure Files. Configuring and managing storage accounts covers creating accounts, redundancy options, object replication, encryption, and moving data with Storage Explorer and AzCopy. Configuring Azure Files and Blob Storage covers file shares, blob containers, storage tiers, soft delete, snapshots, blob lifecycle management and versioning.

At 15–20%, this group tests practical storage administration. The exam rewards choosing the right access method (SAS versus keys versus identity), the right redundancy for a durability requirement, and the right tier and data-protection features such as soft delete and lifecycle policies. These are operational choices an administrator makes daily.

How it's tested

AZ-104 questions in this group describe a storage access, durability or data-management need and ask how to configure it. Check whether the need is about access, durability or cost, because SAS, redundancy and tiers each solve a different one. Note whether the scenario names a container, a blob or the whole account.

  • Right access method

    A storage access need is described, and you choose SAS tokens, access keys, identity-based access or a firewall.

  • Right redundancy

    A durability requirement is described, and you choose LRS, ZRS, GRS or a variant.

  • Right tier or protection

    A cost or data-protection need is described, and you choose a storage tier, lifecycle policy, soft delete or versioning.

Reasoning it through

An application needs temporary, read-only access to a single blob container for 24 hours, without exposing the account's full access. Sharing an account key grants full access and cannot be scoped or time-limited easily. A shared access signature token grants scoped, time-limited access to the specific container with read-only permission, which matches the requirement, so a SAS token is the correct method.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

2.1 Configure access to storageStorage firewalls, SAS tokens, stored access policies, access keys and identity-based access.
What it means
This covers configuring Azure Storage firewalls and virtual network rules, creating and using shared access signature (SAS) tokens, stored access policies to manage SAS, managing account access keys, and configuring identity-based access for Azure Files with Microsoft Entra.
What to understand
Account keys grant full access and are hard to scope, so scoped, time-limited SAS tokens are preferred for delegated access, and stored access policies let you revoke SAS centrally. Storage firewalls restrict which networks can reach the account. Identity-based access uses Entra identities for Azure Files. Choosing the least-privilege access method is key.
How it shows up
A storage access need is described, and you must choose SAS, keys, identity-based access or a firewall rule.
Common confusion
Using account keys where a scoped SAS token is safer; keys grant full access and cannot be easily time-limited or scoped.
2.2 Configure and manage storage accountsStorage accounts, redundancy, object replication, encryption and data movement.
What it means
This covers creating and configuring storage accounts, configuring redundancy (LRS, ZRS, GRS, GZRS and read-access variants), object replication between accounts, storage account encryption, and moving data with Azure Storage Explorer and AzCopy.
What to understand
Redundancy protects data copies: LRS keeps copies in one datacenter, ZRS across zones, and GRS across regions, with read-access variants allowing reads from the secondary. Encryption at rest is on by default. AzCopy and Storage Explorer move data. Choosing redundancy matches the durability and availability requirement.
How it shows up
A durability, replication or data-movement need is described, and you must choose the redundancy, replication or tool.
Common confusion
Confusing LRS, ZRS and GRS; LRS is single-datacenter, ZRS is zone-redundant, and GRS replicates to a secondary region.
2.3 Configure Azure Files and Azure Blob StorageFile shares, blob containers, tiers, soft delete, snapshots, lifecycle and versioning.
What it means
This covers creating file shares in Azure Files and containers in Blob Storage, configuring storage tiers (hot, cool, cold, archive), soft delete for blobs, containers and Azure Files, snapshots, blob lifecycle management policies, and blob versioning.
What to understand
Storage tiers trade access cost against storage cost by access frequency. Soft delete retains deleted data for recovery, and versioning keeps previous versions. Lifecycle management automatically moves or deletes blobs by age. These data-protection and cost features are configured per account or container.
How it shows up
A tiering, cost or data-protection need is described, and you must choose the tier, lifecycle policy, soft delete or versioning.
Common confusion
Confusing soft delete with versioning; soft delete recovers deleted data, while versioning keeps prior versions of changed data.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • SAS tokens

    Scoped, time-limited delegated access to storage.

    Remember
    Preferred over account keys for delegated access.
    Tested as
    Access questions.
    Trap
    Using account keys instead.

  • Account access keys

    Full-access keys to a storage account.

    Remember
    Powerful and hard to scope; rotate and limit use.
    Tested as
    Access questions.
    Trap
    Sharing keys for delegated access.

  • Stored access policies

    Server-side policies that manage and can revoke SAS.

    Remember
    They allow central revocation of SAS.
    Tested as
    Access questions.
    Trap
    Issuing SAS with no revocation path.

  • Storage firewalls

    Restrict which networks can reach the account.

    Remember
    They limit access to specified networks.
    Tested as
    Access questions.
    Trap
    Leaving the account open to all networks.

  • Redundancy (LRS, ZRS, GRS)

    Single-datacenter, zone-redundant and geo-redundant copies.

    Remember
    More redundancy means more durability and cost.
    Tested as
    Durability questions.
    Trap
    Confusing the redundancy levels.

  • Read-access geo-redundancy

    GRS variant allowing reads from the secondary region.

    Remember
    It adds read availability in the secondary.
    Tested as
    Durability questions.
    Trap
    Expecting secondary reads without the RA variant.

  • Storage tiers

    Hot, cool, cold and archive by access frequency.

    Remember
    Match the tier to access frequency.
    Tested as
    Cost questions.
    Trap
    Keeping cold data in hot.

  • Blob lifecycle management

    Policies that move or delete blobs by age.

    Remember
    They automate tiering and cleanup.
    Tested as
    Cost questions.
    Trap
    Managing tiering manually.

  • Soft delete

    Retains deleted data for a retention period.

    Remember
    It enables recovery of deleted data.
    Tested as
    Data-protection questions.
    Trap
    Confusing it with versioning.

  • Blob versioning

    Keeps previous versions of blobs.

    Remember
    It recovers overwritten data.
    Tested as
    Data-protection questions.
    Trap
    Confusing it with soft delete.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

SAS token vs. account key vs. identity-based access

ConceptMeaningKey differenceCommon trap
SAS token Scoped, time-limited access Delegated, revocable via policy Using account keys instead
Account key Full access to the account Powerful, hard to scope Sharing for delegated access
Identity-based access Entra identities for Azure Files Least privilege via identity Overlooking it for file shares

LRS vs. ZRS vs. GRS

ConceptMeaningKey differenceCommon trap
LRS Copies in one datacenter Cheapest, least durable Using it for regional resilience
ZRS Copies across zones in a region Zone-fault tolerant Confusing with GRS
GRS Replicated to a secondary region Survives a regional outage Confusing with ZRS

Soft delete vs. versioning vs. snapshots

ConceptMeaningKey differenceCommon trap
Soft delete Retains deleted data Recover deletions Confusing with versioning
Versioning Keeps prior versions Recover overwrites Confusing with soft delete
Snapshots Point-in-time read-only copies Manual recovery points Expecting automatic retention

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Key for delegated access

    What candidates pick
    Share the storage account key to give an app temporary read access.
    Why it looks right
    The key works immediately.
    Why it's wrong
    A key grants full access and cannot be easily scoped or time-limited; a SAS token grants scoped, time-limited access.

    Clue to watch for The access should be temporary and limited in scope.

  2. ZRS for regional outage

    What candidates pick
    Use zone-redundant storage to survive a whole-region failure.
    Why it looks right
    ZRS adds redundancy.
    Why it's wrong
    ZRS replicates across zones within one region; GRS replicates to a secondary region for regional resilience.

    Clue to watch for The requirement is to survive a regional outage.

  3. Hot tier for archives

    What candidates pick
    Keep rarely accessed archival data in the hot tier.
    Why it looks right
    Hot is the default tier.
    Why it's wrong
    Cool, cold or archive tiers cost less for infrequently accessed data; lifecycle policies can move it automatically.

    Clue to watch for The data is accessed rarely or is an archive.

  4. Soft delete is versioning

    What candidates pick
    Rely on soft delete to recover a blob that was overwritten.
    Why it looks right
    Both protect data.
    Why it's wrong
    Soft delete recovers deleted data; versioning recovers overwritten data by keeping prior versions.

    Clue to watch for The data was overwritten, not deleted.

  5. Account open to all

    What candidates pick
    Leave the storage account reachable from all networks.
    Why it looks right
    It avoids connectivity issues.
    Why it's wrong
    Storage firewalls should restrict access to specified networks for security.

    Clue to watch for The requirement is to limit network access to the account.

Answer framework

For any Domain 2 scenario, use these steps to find the answer AZ-104 expects.

  1. Identify whether the need is access control, account configuration and redundancy, or data management and protection.
  2. For access, prefer scoped, time-limited SAS tokens over account keys, use stored access policies for revocation, and restrict networks with the storage firewall.
  3. For redundancy, choose LRS, ZRS or GRS to match the durability and regional-resilience requirement, using read-access variants where secondary reads are needed.
  4. For cost, set the storage tier by access frequency and use blob lifecycle management to move or delete data automatically.
  5. For protection, enable soft delete to recover deletions and versioning to recover overwrites, and use snapshots for point-in-time copies.

Practice question

An external partner needs read-only access to a single Azure Blob Storage container for the next 24 hours, without being given access to the rest of the storage account. Which access method is MOST appropriate?

Want more like this? The AZ-104 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This is a hands-on storage domain, so configure the features in a free subscription rather than only reading. Start with access control, the most tested area: practice creating scoped SAS tokens, using stored access policies for revocation, and restricting access with the storage firewall, and understand why SAS beats sharing account keys.

Next, learn redundancy cold, since the LRS-versus-ZRS-versus-GRS distinction is a frequent exam item tied to durability and regional-resilience requirements. Then learn the data-management features: storage tiers by access frequency, blob lifecycle policies, and the data-protection trio of soft delete, versioning and snapshots, keeping soft delete (deletions) and versioning (overwrites) distinct.

Because the exam tests configuration, lab each feature once. Because AZ-104 is a hands-on operations exam, lab every task once in the portal and once with PowerShell or the Azure CLI in a free subscription, and review missed practice questions by group to find weak spots. Afterwards, move to Domain 3, deploying and managing compute resources.

FAQ

How much of AZ-104 is Domain 2?

Implement and manage storage is 15–20% of the exam.

When should I use a SAS token instead of an account key?

When you need to grant scoped, time-limited access to specific storage resources. Account keys grant full access and cannot be easily scoped or time-limited, so SAS is safer for delegated access.

What is the difference between LRS, ZRS and GRS?

LRS keeps copies within one datacenter, ZRS replicates across availability zones in a region, and GRS replicates to a secondary region to survive a regional outage.

What is the difference between soft delete and versioning?

Soft delete retains deleted data for a retention period so it can be recovered. Versioning keeps previous versions of a blob so overwritten data can be recovered.

How do I lower storage cost for rarely accessed data?

Move it to the cool, cold or archive tier, and use blob lifecycle management policies to transition or delete data automatically based on age.

What are stored access policies for?

They are server-side policies associated with SAS tokens that let you manage and revoke access centrally, rather than relying on individual SAS tokens with no revocation path.

How does Domain 2 connect to the rest of the exam?

Storage access is secured with the RBAC and governance from Domain 1, consumed by the compute resources in Domain 3, and monitored with the tools in Domain 5.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered storage access, redundancy, tiers and data protection. Test whether you can configure the right storage option under exam conditions.

Take the AZ-104 practice test Check your AZ-104 readiness

Keep going