AZ-104 Review – Microsoft Azure Administrator
The natural next step after AZ-900: identities, storage, compute, networking and monitoring, seen from the administrator who works hands-on in Azure. Cards written from the official skills outline in effect since April 17, 2026. Voyelle is not affiliated with Microsoft. AZ-104 and Microsoft Azure are trademarks of their respective owners.
- 208 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Manage Azure identities and governance24 %
- Implement and manage storage19 %
- Deploy and manage Azure compute resources24 %
- Implement and manage virtual networking19 %
- Monitor and maintain Azure resources14 %
A few cards from the deck
A consultant from a partner firm needs access to a few resources in your tenant using her own work account. What should you do?
- Create a member account for her with a temporary password.
- Deploy Microsoft Entra Domain Services for her.
- Invite her as a guest user through Microsoft Entra B2B collaboration.
- Synchronize her directory with Microsoft Entra Connect.
Show the answer
Invite her as a guest user through Microsoft Entra B2B collaboration.
B2B collaboration creates a guest account that signs in with its home identity: you have no password to manage, and access goes away cleanly when you delete the guest. Creating a member account duplicates the identity, and Entra Connect synchronizes your own on-premises directory, not a partner's.
Which sections must an ARM template contain?
Show the answer
$schema,contentVersionandresources.parameters,variables,functionsandoutputsare optional. A minimal template can deploy a single resource without any parameters.In a SAS token, the `…
parameter gives the expiry time andsp` the granted permissions.Show the answer
In a SAS token, the
separameter gives the expiry time andspthe granted permissions.stis the start time,sethe end (signed expiry),spthe permissions (r, w, d, l…) andsigthe signature. A short expiry limits the damage if the token leaks.An application must generate SAS tokens for blobs without using the account key. Which SAS type is recommended?
- A service SAS signed with key1
- An ad hoc SAS with no expiry date
- A user delegation SAS
- An account SAS
Show the answer
A user delegation SAS
A user delegation SAS is signed with Microsoft Entra credentials, not an account key. Microsoft recommends it as the most secure option. It applies only to Blob Storage, including Data Lake Storage.
How can you revoke a service SAS without regenerating the account key?
Show the answer
By having associated it with a stored access policy: you delete or modify that policy, and every SAS that depends on it becomes invalid.
An ad hoc SAS can only be revoked by regenerating the key that signed it, which also breaks every application that uses that key.
SSPR password writeback to on-premises Active Directory goes through … or Microsoft Entra Cloud Sync.
Show the answer
SSPR password writeback to on-premises Active Directory goes through Microsoft Entra Connect or Microsoft Entra Cloud Sync.
These are the two hybrid synchronization tools. Without them, a password reset in the cloud would never be sent back to the domain controller.
Cards are written from the official outline published for the exam, never from real exam questions. Voyelle is not affiliated with Microsoft. AZ-104 is a trademark of its owner.