Is the AZ-104 Exam Hard? Format, Passing Score and What Trips People Up

AZ-104 is hard in a specific way. It is not a trivia exam; it is a breadth exam with a long checklist, and it assumes you have actually clicked through the Azure portal and run a few commands. Candidates with six months of hands-on Azure administration usually describe it as fair. Candidates coming straight from AZ-900 with no portal time usually fail it once.

This guide covers the current version of Microsoft's Azure Administrator exam: how it is scored, what each domain really asks, where most people lose points, and a study plan that matches the skills outline instead of a video course's table of contents.

The AZ-104 exam at a glance

Two things in that table are misread constantly. First, 700 out of 1000 is not 70 percent. Microsoft scales scores, and questions carry different weights, so you cannot reverse-engineer how many you need to get right. Second, the one-year validity is not a one-year expiry: you renew by passing a shorter free assessment on Microsoft Learn any time in the six months before the date. Nobody re-sits the full exam to stay certified.

What AZ-104 actually tests

Microsoft publishes a skills outline with five functional groups. The percentages are the share of the exam, and they are the single best guide to where your study hours should go.

Manage Azure identities and governance (20 to 25 percent). Users, groups and licences in Microsoft Entra ID; role-based access control at every scope; subscriptions, management groups, resource groups, tags, locks and Azure Policy; cost management. This is the domain people underestimate because it looks administrative. It is also where the exam hides its most precise questions: which built-in role, at which scope, gives exactly the permission described and nothing more.

Implement and manage storage (15 to 20 percent). Storage accounts and their redundancy options, access keys and shared access signatures, Azure Files and Blob storage, lifecycle management, soft delete, and the difference between the storage firewall and a private endpoint. Expect redundancy questions that depend on reading one detail, such as whether a region pair is involved.

Deploy and manage Azure compute resources (20 to 25 percent). Virtual machines and their sizes, disks, availability sets versus zones versus scale sets, extensions, Azure Bastion, Azure Container Instances, and the App Service plan tiers. ARM and Bicep templates appear here too, mostly as "what does this template do" reading questions rather than authoring tasks.

Implement and manage virtual networking (15 to 20 percent). Virtual networks, subnets, peering, network security groups and application security groups, user-defined routes, Azure DNS, load balancers, and the private access story (service endpoints and private endpoints). This is the domain with the highest failure rate among people who came up through the portal alone, because NSG rule evaluation, route precedence and peering transitivity are conceptual, and the portal hides the concepts.

Monitor and maintain Azure resources (10 to 15 percent). Azure Monitor metrics, logs and alerts, Log Analytics workspaces and a little Kusto, Network Watcher, Azure Backup and Site Recovery. Smaller weight, but the backup and recovery questions are cheap points if you have set up a Recovery Services vault once.

Those ranges add up to more than 100 because each is a band. Read them as priorities: identity, compute and networking together are around two thirds of the exam.

Where candidates lose points

Across the people we see coming through our own AZ-104 bank, the same four traps account for most of the failures.

Scope. Half the RBAC questions are really about scope. A role assigned at the resource group does not help with a resource in another group, and a role assigned at the subscription applies everywhere below it. Deny assignments and resource locks override what you expect. If you cannot draw the management group, subscription, resource group and resource hierarchy from memory, stop and learn it.

NSG evaluation order. Rules are evaluated by priority, lowest number first, the first match wins, and the default rules sit at the bottom. Inbound and outbound are separate. A subnet NSG and a NIC NSG both apply, and traffic has to pass both. Exam questions give you a rule table and ask what happens to a packet; work it through mechanically.

Redundancy names. LRS, ZRS, GRS, GZRS, RA-GRS, RA-GZRS. Each answers two questions: how many copies, and where. The exam pairs a business requirement ("must survive a regional outage and must be readable during it") with the one option that fits.

Case studies. The case study set gives you several screens of company background and a series of questions you cannot go back to once you leave. People burn 25 minutes reading everything. Skim the requirements, answer, and only return to the detail a question actually asks about.

Question formats and how they change the difficulty

AZ-104 uses single-answer multiple choice, multiple-response, drag-and-drop ordering, hot area (click the right part of a screenshot or configuration), and yes/no series where you answer the same statement pattern three times. The yes/no series are the cruel ones: they are scored per statement, there is no partial credit for a set, and they cannot be revisited. The rest of the exam can be reviewed before you submit.

Practice with question types that match. A bank of pure multiple choice trains the wrong reflex for the hot-area and ordering items, which is one reason we keep multi-select items in ours.

Try three real AZ-104 practice questions

The three below are taken straight from our free bank, unedited. Answer each before you open the explanation, and notice how much of the difficulty lives in a single qualifying phrase.

If those felt comfortable, the exam will feel comfortable. If the explanations taught you something, that is the study list.

How long to study

Realistic hours, from candidates we have watched pass:

• Working Azure administrator, six months or more of daily use: 30 to 50 hours over three to four weeks. Most of it goes on the domains you do not touch at work, usually governance and monitoring.
• General sysadmin or engineer, AWS or on-premises background: 60 to 90 hours over six to eight weeks. Concepts transfer; the Azure names, the portal layout and the pricing tiers do not.
• Fresh from AZ-900, no hands-on time: 100 to 150 hours over ten to twelve weeks, and at least a third of it must be in a real subscription.

The number that matters more than hours is portal time. Every domain has tasks you should have done at least once: create a VM with a managed disk and add it to a load balancer, peer two virtual networks and test connectivity, write an NSG rule and watch it block traffic, assign a custom role, set a budget alert, restore a file from a backup.

A study plan that follows the skills outline

Weeks 1 and 2: identity and governance. Build a small hierarchy of management groups and resource groups, assign roles at different scopes, add a policy that denies a VM size, apply a lock and try to delete the resource. Read the built-in role list once; it is long, but the exam only asks about a dozen roles.

Weeks 3 and 4: compute and storage. Deploy VMs from the portal and from a Bicep template, resize one, attach a data disk, snapshot it. Create a storage account of each redundancy type and read the replication descriptions in the portal. Generate a SAS token and use it from Storage Explorer.

Weeks 5 and 6: networking. This is where the free Azure credit gets spent. Two virtual networks, peering, an NSG with deliberately conflicting rules, a route table that sends traffic through a virtual appliance, a private endpoint to a storage account, and Network Watcher to prove what is happening.

Week 7: monitoring, backup, recovery. Alerts on a metric and on a log query, a Recovery Services vault, a backup and a restore, a Site Recovery replication you never fail over.

Week 8: exam practice. Timed sets, then review every wrong answer against the skills outline, not against the explanation alone. Our timed AZ-104 practice exam draws from the same bank as the free questions above and scores you the same way the exam does, by domain.

Exam day

You can take AZ-104 at a Pearson VUE centre or online with a proctor. Online is convenient and strict: a clean desk, one monitor, no talking, and a room scan on a webcam. If your home setup is marginal, the test centre removes a variable.

Budget the 100 minutes. A reasonable split is 60 minutes for the standard questions, 25 for the case study, and the rest for the review pass. Flag anything you are unsure of and move on; the review screen shows flagged items. Do not leave the yes/no series blank; there is no penalty for a wrong answer.

Retakes, renewal and the cost of failing

If you fail, the second attempt is available after 24 hours, the third after 14 days, and each attempt costs the full fee. Your score report shows performance by domain, which is the most useful study guide you will get. Once you pass, the certification is valid for one year and renews free online, so the real cost of AZ-104 is the first attempt and the study time.

Is AZ-104 worth the difficulty?

For anyone whose job title includes "administrator", "cloud engineer" or "support engineer" on Azure, yes, and it is the exam employers actually check for, more than AZ-900. It is also the base for AZ-305 (Solutions Architect Expert), which requires it. The difficulty is mostly a difficulty of breadth, and breadth is fixed by structured hands-on time, not by another video course.

Start with the free AZ-104 exam dumps, all questions with explanations, read the AZ-104 certification guide for the full domain list, and when your practice scores sit above 80 percent by domain, book the exam.