02 AZ-104 Azure Administrator

AZ-900 teaches you what Azure is. AZ-104 teaches you how Azure is actually operated.

The Microsoft Certified: Azure Administrator Associate — AZ-104 certification is one of the most important technical certifications in the Azure career path because it moves you from basic cloud awareness into practical administration.

For cybersecurity learners, this matters a lot.

Before you can properly secure Azure, you need to understand how administrators actually:

• create resources

• assign access

• manage subscriptions

• configure networking

• deploy compute

• manage storage

• monitor workloads

• troubleshoot operational problems

That operational understanding becomes the foundation for deeper security work later in:

• AZ-500

• Microsoft Entra ID security

• Defender for Cloud

• Microsoft Sentinel

• cloud incident response

• Azure security architecture

🎯 What AZ-104 Is Really About

AZ-104 is not simply about learning Azure portal menus.

The real objective is understanding how an Azure environment is managed.

You should become comfortable with areas such as:

• identity

• governance

• storage

• compute

• networking

• monitoring

From a career perspective, the certification helps answer:

Can you operate and manage Azure resources effectively?

For cybersecurity learners, the next question becomes:

Can you secure what you now know how to operate?

👤 Who Should Take AZ-104?

AZ-104 is suitable for:

• learners who completed AZ-900

• Azure beginners moving into technical roles

• system administrators

• infrastructure engineers

• network engineers

• cloud support engineers

• junior cloud engineers

• cybersecurity professionals who need deeper Azure knowledge

• aspiring Cloud Security Engineers

🌱 If You Are a Beginner

Do not rush directly into complex administration.

Before starting AZ-104, you should be reasonably comfortable with:

• subscriptions

• resource groups

• Entra ID basics

• Azure RBAC basics

• VNets

• subnets

• storage

• virtual machines

If these are still unfamiliar, revisit AZ-900 first.

🎓 If You Are a Student or Fresher

AZ-104 can significantly strengthen your job readiness because it gives you more practical capability than a fundamentals certification alone.

A sensible progression is:

AZ-900
   ↓
AZ-104
   ↓
Hands-On Azure Administration
   ↓
Azure RBAC Lab
   ↓
Azure Network Security Lab
   ↓
Projects
   ↓
Interview Preparation

Possible roles after building practical capability include:

• Junior Azure Administrator

• Cloud Support Engineer

• Infrastructure Support Engineer

• Junior Cloud Engineer

• Technical Support Engineer

You can then progress into:

• Azure Security Engineer

• Cloud Security Engineer

• DevSecOps Engineer

🖥️ If You Already Work in IT

AZ-104 is often a very natural transition.

If you already work with:

• Windows Server

• Active Directory

• networking

• storage

• virtualization

• backups

• monitoring

you already have concepts that map into Azure.

For example:

Traditional IT	Azure
Virtual Machine	Azure VM
VLAN / Network	VNet
Firewall Rules	NSG
Directory	Microsoft Entra ID
File / Disk Storage	Azure Storage / Managed Disks
Monitoring	Azure Monitor
Backup	Azure Backup
Permissions	Azure RBAC

The goal is not to relearn IT.

The goal is to understand:

How does Azure implement and manage these capabilities?

🛡️ If You Are a Cybersecurity Professional

AZ-104 is extremely useful before AZ-500.

Security professionals sometimes want to jump directly into:

• Defender for Cloud

• Sentinel

• Conditional Access

• Key Vault

• security policies

But if you do not understand how Azure resources are deployed and operated, deeper security becomes difficult.

You need to understand:

• subscriptions

• resource groups

• identities

• RBAC

• VNets

• VMs

• storage

• monitoring

before you can assess:

• privilege

• exposure

• configuration

• logging

• attack surface

📚 How to Use This Certification Path

Use your GoHackersCloud recorded course as the primary structured learning source.

Then use this page for:

• certification strategy

• practical review

• job readiness

• troubleshooting

• security connections

• interview preparation

• labs

• runbooks

Recommended workflow:

Recorded AZ-104 Course
        ↓
Hands-On Administration
        ↓
Practice Scenarios
        ↓
Weak-Area Review
        ↓
Certification Exam
        ↓
Azure Labs
        ↓
Runbooks
        ↓
Projects
        ↓
Interview Preparation

🧭 Core Skill Area 1 — Identity and Governance

This is one of the most important areas for both administrators and security professionals.

You should understand:

• Microsoft Entra ID

• users

• groups

• role assignments

• subscriptions

• resource groups

• management groups

• Azure RBAC

• Azure Policy

• resource locks

🪪 Microsoft Entra ID

Understand how identities are used to access Azure.

Focus on:

• users

• groups

• identities

• authentication

• directory relationships

🔐 Azure RBAC

RBAC controls:

Who can perform which actions at which scope?

Understand the scope hierarchy:

Management Group
      ↓
Subscription
      ↓
Resource Group
      ↓
Resource

🧠 RBAC Security Mindset

Do not ask only:

Which role does this user have?

Ask:

At what scope?

A Contributor role at:

One Resource Group

is very different from Contributor at:

Entire Subscription

🔑 Common Built-In Roles

Be familiar with roles such as:

• Reader

• Contributor

• Owner

Understand the difference.

Reader

Can view resources.

Contributor

Can manage resources but does not have full access-management authority.

Owner

Includes broad resource management plus access-control authority.

🚨 Security Advice

Avoid granting Owner simply because:

“The user needs to manage Azure.”

Ask what they actually need.

🏛️ Azure Policy

Azure Policy helps enforce or evaluate configuration standards.

Examples:

• permitted Regions

• required tags

• allowed resource types

• security configuration requirements

🧠 Azure Policy vs RBAC

Be able to explain:

RBAC
→ Who can do something?

Azure Policy
→ What configuration is permitted or required?

This distinction is important in both exams and interviews.

🔒 Resource Locks

Understand:

• CanNotDelete

• ReadOnly

These help protect resources from accidental changes.

Do not confuse resource locks with IAM-style authorization.

🧭 Management Groups

Management Groups become useful when organizations have multiple subscriptions.

Think:

Enterprise
    ↓
Management Groups
    ↓
Subscriptions
    ↓
Resource Groups

This becomes much more important later in:

• governance

• security architecture

• SC-100

🧩 Core Skill Area 2 — Azure Storage

You should understand Azure storage options and how to manage them.

Key areas include:

• storage accounts

• Blob Storage

• Azure Files

• access controls

• redundancy

• storage tiers

• managed disks

📦 Storage Accounts

Understand that storage accounts can host services such as:

• blobs

• files

• queues

• tables

From a security perspective, ask:

Is the storage publicly accessible?

Who has access?

How is data protected?

🔐 Storage Access

Understand the difference between access methods such as:

• identity-based access

• shared access mechanisms

• account-level keys

Security professionals should generally prefer stronger identity-driven approaches where appropriate.

🧠 Storage Security Principle

Avoid designing application access around highly privileged shared secrets if a managed identity and scoped permissions can solve the requirement.

📁 Blob Storage

Understand common use cases:

• files

• backups

• objects

• application data

• archives

🗂️ Azure Files

Useful where shared file-system style access is required.

💾 Managed Disks

Used with Azure Virtual Machines.

Understand:

• disk types

• performance

• availability

• encryption concepts

🧠 Administrator Question

Ask:

Which storage option matches the workload?

Not:

Which storage service do I remember from the course?

🖥️ Core Skill Area 3 — Compute

Azure Administrators need strong understanding of compute.

Focus on:

• virtual machines

• availability

• VM Scale Sets

• App Service

• containers

• deployment options

🖥️ Azure Virtual Machines

You should understand how to:

• deploy VMs

• configure networking

• attach storage

• manage access

• monitor health

• stop/start/deallocate

🔐 VM Security Connection

For cybersecurity learners, always ask:

• does it have a public IP?

• which NSG rules apply?

• how is administrative access performed?

• which identity does the VM use?

• are disks encrypted?

• is monitoring enabled?

🏗️ Availability

Understand the purpose of:

• Availability Zones

• availability concepts

• VM Scale Sets

📈 VM Scale Sets

Useful for managing and scaling multiple VMs.

Think:

consistent compute capacity that can scale

rather than:

one manually managed server.

🌐 Azure App Service

Understand it as a managed application-hosting platform.

Security professionals should recognize the difference between:

• managing an entire OS

• using a managed application platform

The operational and security responsibilities differ.

🐳 Containers

Understand Azure container concepts at a high level.

You may encounter:

• container instances

• Kubernetes services

AZ-104 is not primarily a Kubernetes-security certification, but administrators should understand the ecosystem.

🌐 Core Skill Area 4 — Virtual Networking

Networking is one of the most important AZ-104 areas.

You should understand:

• VNets

• subnets

• NSGs

• route tables

• DNS

• peering

• private connectivity

• load balancing

🌐 Azure Virtual Network

A VNet provides network isolation for Azure resources.

You should understand:

• address spaces

• subnets

• IP addresses

• connectivity

🧠 Security Question

Ask:

Which workloads should be able to communicate?

Do not design networks where everything can reach everything.

🔐 Network Security Groups

NSGs help control traffic.

Understand:

• inbound rules

• outbound rules

• priorities

• source

• destination

• port

• protocol

🚨 Common Finding

RDP 3389
Source: Internet

or:

SSH 22
Source: Any

should always receive scrutiny.

🧠 NSG Review Mindset

For each rule ask:

Why does this exist?

Is the source too broad?

Does this need to be public?

Can administrative access be private?

🛣️ Route Tables

Understand how user-defined routes influence traffic flow.

Administrators should be able to reason about:

Source
 ↓
Route
 ↓
Network Control
 ↓
Destination

🔗 VNet Peering

Understand how VNets can communicate.

Ask:

Does this connectivity need to exist?

Peering can expand trust between environments.

🔒 Private Connectivity

Understand concepts such as:

• Private Endpoints

• private service access

From a security perspective, this is important because many services do not need public exposure.

⚖️ Load Balancing

Understand the broad roles of:

• Azure Load Balancer

• Application Gateway

Do not memorize names only.

Understand:

• layer

• traffic type

• use case

📊 Core Skill Area 5 — Monitoring and Maintenance

An Azure Administrator needs visibility into the environment.

Focus on:

• Azure Monitor

• metrics

• logs

• alerts

• Log Analytics

• backup

• recovery

👀 Azure Monitor

Think:

How are Azure resources behaving?

It can provide:

• metrics

• logs

• alerts

📜 Activity Logs

Understand their value in determining:

Which Azure management action occurred?

This becomes important later in cloud-security investigations.

🔎 Log Analytics

Log Analytics allows querying collected data.

This is a strong foundation for later work with:

• Microsoft Sentinel

• KQL

• security operations

🚨 Alerts

Administrators should configure useful alerts around:

• resource health

• performance

• availability

• operational failures

Security teams may later build on the same telemetry.

💾 Backup and Recovery

Understand:

• Azure Backup

• recovery considerations

• business continuity

Administrators should not treat backup as:

“It exists.”

You should understand:

• what is backed up

• when

• retention

• recovery process

🧠 Operational Security Connection

Availability is part of security.

A secure system that cannot recover from failure is not resilient.

🧩 Understanding Azure Resource Hierarchy

AZ-104 learners should be very comfortable with:

Tenant
  ↓
Management Group
  ↓
Subscription
  ↓
Resource Group
  ↓
Resource

Why?

Because several controls depend on scope:

• RBAC

• Azure Policy

• governance

• cost

• organization

🔐 Security Relevance of AZ-104

AZ-104 provides the operational foundation for security areas such as:

Azure Administration
        ↓
Identity
Networking
Compute
Storage
Monitoring
        ↓
Azure Security Engineering

This is why AZ-104 knowledge is so useful before AZ-500.

🧪 Hands-On Skills You Should Build

Do not prepare only with videos and practice questions.

At minimum, practise:

• creating a resource group

• creating users/groups

• assigning RBAC

• creating a VNet

• creating subnets

• configuring NSGs

• launching a VM

• creating a storage account

• reviewing monitoring

• creating alerts

• reviewing activity logs

🏗️ Recommended Practical Project — Simple Azure Environment

Build:

Azure Subscription
│
├── Resource Group
│
├── VNet
│   ├── Web Subnet
│   └── Application Subnet
│
├── Virtual Machine
├── Storage Account
└── Azure Monitor

Then ask:

• who can manage it?

• who can view it?

• which ports are exposed?

• what is logged?

• how would you troubleshoot it?

🔐 Recommended Security Exercise

Create:

User
 ↓
RBAC Role
 ↓
Resource Group
 ↓
Resources

Then intentionally create an access problem.

For example:

user has Reader but needs to start a VM.

Investigate:

• role

• scope

• required action

This builds real troubleshooting skill.

🌐 Recommended Networking Exercise

Build:

VNet
│
├── Public / Frontend Subnet
└── Private / Application Subnet

Then:

• review NSGs

• restrict unnecessary traffic

• document intended communication

📚 Recommended AZ-104 Study Strategy

Use:

Phase 1
Complete Recorded Course
        ↓
Phase 2
Review Objectives
        ↓
Phase 3
Build Resources Yourself
        ↓
Phase 4
Troubleshoot Problems
        ↓
Phase 5
Practice Scenario Questions
        ↓
Phase 6
Track Weak Areas
        ↓
Phase 7
Final Revision
        ↓
Exam

🧠 Build Operational Notes

Instead of:

NSG — controls traffic.

Write:

NSG

Purpose:
Controls inbound/outbound network traffic.

Applied To:
Network interfaces/subnets depending on design.

Security Question:
Is the rule broader than necessary?

Troubleshooting:
Check priority, source, destination, port, route.

That style is better for both exams and interviews.

🔄 Important Comparisons to Master

Be comfortable comparing:

• Azure RBAC vs Entra roles

• Reader vs Contributor vs Owner

• Azure Policy vs RBAC

• NSG vs Azure Firewall

• public endpoint vs Private Endpoint

• VNet Peering vs VPN-style connectivity

• Azure Monitor vs Log Analytics

• Availability Zone vs Region

• Blob Storage vs Azure Files

• VM vs App Service

🚫 Common AZ-104 Preparation Mistakes

Mistake 1 — Memorizing Portal Steps

Portal navigation changes.

Understand the underlying service.

Mistake 2 — Weak Networking

Networking appears throughout Azure administration.

Learn:

• CIDR

• subnets

• NSGs

• routing

• DNS

• peering

Mistake 3 — Weak RBAC Knowledge

Do not simply memorize built-in role names.

Understand:

• permissions

• scope

• inheritance

Mistake 4 — Ignoring Monitoring

Administrators need operational visibility.

Mistake 5 — Ignoring Governance

Resource management is not just creating VMs.

Understand:

• Policy

• locks

• hierarchy

• access

Mistake 6 — Watching Instead of Doing

Build Azure resources yourself.

Mistake 7 — Using Owner for Everything

This hides RBAC problems and teaches poor security habits.

🎯 Troubleshooting Method

When something does not work, use structured troubleshooting.

For access:

Identity
 ↓
Role
 ↓
Scope
 ↓
Resource
 ↓
Policy / Restriction

For networking:

Source
 ↓
Route
 ↓
NSG
 ↓
Destination
 ↓
Service
 ↓
Return Path

For resource health:

Resource State
 ↓
Metrics
 ↓
Logs
 ↓
Dependencies
 ↓
Configuration

💡 Administrator Mindset

Do not respond to every issue with:

recreate the resource.

Try to understand the root cause.

That skill matters enormously in technical interviews.

💼 Career Value of AZ-104

AZ-104 can support progression toward:

• Azure Administrator

• Cloud Engineer

• Infrastructure Engineer

• Cloud Support Engineer

• DevOps Engineer

• Cloud Security Engineer

For cybersecurity learners, it is particularly valuable because it provides the platform knowledge needed before deeper Azure security.

🟢 Junior Azure Administrator — Expected Skills

Employers may expect:

• resource groups

• storage

• VMs

• VNets

• NSGs

• RBAC

• monitoring

• backup basics

🔵 Azure Administrator — Expected Skills

You should increasingly be able to:

• manage subscriptions

• implement RBAC

• configure networks

• deploy compute

• manage storage

• monitor resources

• troubleshoot access

• troubleshoot connectivity

🛡️ Cloud Security Engineer — Why AZ-104 Matters

Security engineers need to understand administration because security controls sit on top of operational architecture.

You may be asked:

Is this Azure environment secure?

To answer, you need to understand:

• subscriptions

• resource hierarchy

• RBAC

• VNets

• NSGs

• compute

• storage

• monitoring

🎤 AZ-104 Interview Preparation

Practise without notes.

Resource Management

1. What is an Azure subscription?

2. What is a resource group?

3. What is a management group?

4. What is Azure Resource Manager?

RBAC

5. What is Azure RBAC?

6. What is RBAC scope?

7. Reader vs Contributor vs Owner?

8. A user has Contributor at resource-group scope. What can they manage?

9. How would you troubleshoot insufficient permissions?

Storage

10. What is an Azure Storage Account?

11. Blob Storage vs Azure Files?

12. How would you protect a storage account?

13. What risks exist with shared access credentials?

Compute

14. What is an Azure Virtual Machine?

15. What is a VM Scale Set?

16. When would you use App Service instead of a VM?

17. How would you secure administrative access to a VM?

Networking

18. What is an Azure VNet?

19. What is an NSG?

20. How do NSG rule priorities work?

21. What is VNet Peering?

22. What is a Private Endpoint?

23. How would you troubleshoot two VMs that cannot communicate?

Monitoring

24. What is Azure Monitor?

25. What is Log Analytics?

26. What information can Azure Activity Logs provide?

27. How would you monitor a VM?

🚨 Scenario Interview Question 1

A developer needs to manage resources only in one application resource group but currently has Owner at subscription level.

A strong answer should discuss:

• actual required permissions

• least privilege

• narrower scope

• appropriate built-in/custom role

• removal of unnecessary Owner access

🚨 Scenario Interview Question 2

A VM cannot communicate with another VM in a different subnet. What would you investigate?

Use:

IP Configuration
 ↓
VNet/Subnet
 ↓
Routes
 ↓
NSGs
 ↓
Service
 ↓
Return Path

🚨 Scenario Interview Question 3

A user can see a resource but cannot modify it. Why?

Possible explanation:

Reader-style access rather than Contributor-level access.

But investigate:

• exact role

• scope

• deny/policy controls

🚨 Scenario Interview Question 4

An Azure VM is running but the application is unavailable.

Do not immediately blame Azure.

Review:

• VM status

• NSGs

• routing

• service/process

• OS firewall

• application logs

• Azure Monitor

🚨 Scenario Interview Question 5

A team accidentally deletes important resources frequently. What Azure controls could help?

Discuss:

• RBAC

• resource locks

• governance

• process controls

🧠 Interview Answer Framework

Use:

Requirement
   ↓
Resource
   ↓
Identity
   ↓
Network
   ↓
Configuration
   ↓
Monitoring
   ↓
Troubleshooting

💬 Interview Tip

Avoid:

“I would check Azure.”

Say:

“I would first define the expected behavior, confirm the affected resource and identity, review the relevant RBAC scope or network path, inspect monitoring and activity data, then isolate the specific configuration causing the problem.”

That sounds like an administrator.

📁 Portfolio Project Ideas

Project 1 — Azure Administration Baseline

Build:

• resource groups

• users

• RBAC

• VM

• storage

• VNet

• monitoring

Document the architecture.

Project 2 — Least-Privilege RBAC

Create:

• Administrator

• Developer

• Reader

Apply different scopes.

Document:

• what each identity can do

• why

Project 3 — Segmented Azure Network

Build:

Frontend Subnet
      ↓
Application Subnet
      ↓
Database Tier

Document NSG relationships.

Project 4 — Azure Monitoring Baseline

Configure:

• metrics

• alerts

• logs

• activity monitoring

Document what each telemetry source tells you.

📝 Resume Examples

Instead of:

Knowledge of Azure Administration.

Use:

Built and administered Azure lab environments covering resource groups, RBAC, VNets, NSGs, virtual machines, storage, and Azure Monitor.

Or:

Troubleshot Azure RBAC and network-connectivity issues in hands-on environments and documented root cause and remediation.

⭐ Job-Readiness Check

After AZ-104 preparation, you should increasingly be able to:

• navigate Azure confidently

• manage resource groups

• understand subscription hierarchy

• configure RBAC

• deploy VMs

• manage storage

• create VNets/subnets

• configure NSGs

• troubleshoot connectivity

• monitor resources

• explain common Azure architecture

If you only know which menu to click, you are not ready yet.

The goal is:

Understand why the configuration works and how to troubleshoot it when it does not.

🧪 Labs to Circle Back To

After completing AZ-104, return to the Azure labs.

Recommended:

Azure RBAC
      ↓
Azure Network Security
      ↓
Microsoft Entra ID Security

These labs should now make much more sense.

Later, after security-focused study, continue to:

Microsoft Defender for Cloud
      ↓
Microsoft Sentinel

🏆 What Success Should Look Like

Passing AZ-104 is valuable.

But the stronger outcome is:

I can navigate and manage Azure.

I understand identities and RBAC.

I understand Azure networking.

I can deploy and troubleshoot resources.

I understand monitoring.

I can explain how Azure resources fit together.

That capability creates the foundation for Azure security engineering.

🎯 Final Advice

Do not treat AZ-104 as:

Learn every administration command.

Treat it as:

Learn how Azure works operationally.

For every configuration ask:

Why is this resource here?

Who can manage it?

Which network can reach it?

What happens if it fails?

How is it monitored?

How would I troubleshoot it?

Those questions turn certification study into engineering skill.

First understand Azure. Then learn to operate Azure. Then learn to secure Azure.

🚀 What’s Next?

You now understand Azure administration and how resources, identities, networking, storage, compute, and monitoring fit together.

The next certification takes that operational foundation and applies dedicated security engineering controls.

➡️ Next: 03 — AZ-500 — Azure Security Engineer

In the next page, we will cover:

• who should take AZ-500

• Azure Security Engineer responsibilities

• Microsoft Entra ID security

• Azure RBAC and privileged access

• network security

• workload protection

• Microsoft Defender for Cloud

• data protection

• Key Vault

• security monitoring

• certification preparation strategy

• job-readiness expectations

• hands-on security skills

• scenario-based security interview questions