Associate AZ-104
Every question explains all four options, not just the right one, and a certified Azure administrator approves each explanation before anyone is shown it.
Create your free account No card required to sign up.
No account, no email address. Pick an answer and you will see whether it was right and why — the same explanations you get inside.
Domain 1: Manage Azure identities and governance
Q1. You want to prevent accidental deletion of a critical Azure resource. What should you configure?
Correct.
A CanNotDelete lock blocks deletion for everyone, including subscription owners, until the lock itself is removed — which is exactly the "are you sure?" step accidental deletion needs. RBAC restricts who can act, but an owner can still delete; backup helps you recover afterwards rather than preventing it.
Domain 1: Manage Azure identities and governance
Q2. You must grant a user the ability to create and manage virtual machines in a specific resource group, but not allow them to modify network settings. Which built-in role should you assign?
Correct.
Virtual Machine Contributor grants full management of VMs but explicitly excludes the virtual network and subnet permissions, which is precisely the split described. Contributor and Owner would both allow the network changes you are trying to prevent.
Domain 1: Manage Azure identities and governance
Q3. You need to ensure that only devices compliant with company policies can access Microsoft Entra ID resources. Which feature should you use?
Correct.
Conditional Access evaluates signals — device compliance state, location, risk level — at sign-in and grants or blocks accordingly. Azure Policy governs resource configuration, not sign-in, and PIM governs when privileged roles are activated.
Answer all 3 to see how the explanations read.
Create your free accountFree account
Free
No card required.
Full access
9.99€/month
Cancel anytime.
5-day free trial when you upgrade — credit card required, no charge until day 5, cancel anytime. Then 9.99€/month.
The Microsoft Azure Administrator Associate (AZ-104) is one of the most popular Azure certifications and a key credential for cloud administrators. It validates the ability to manage day-to-day Azure environments: configuring identity and governance, implementing storage solutions, deploying and managing compute resources, configuring virtual networks, and monitoring Azure resources.
The exam covers five domains: Manage Azure Identities and Governance (20–25%), Implement and Manage Storage (15–20%), Deploy and Manage Azure Compute Resources (20–25%), Implement and Manage Virtual Networking (15–20%), and Monitor and Maintain Azure Resources (10–15%). Core services include Microsoft Entra ID (Azure AD), Azure Virtual Machines, Azure App Service, Azure Kubernetes Service, Azure Storage, Virtual Networks, Load Balancer, Network Security Groups, Azure Monitor, Log Analytics, and Azure Backup.
Unlike AWS certifications, Microsoft Azure certifications do not expire. The AZ-104 requires approximately 6 months of hands-on Azure experience and is widely considered the go-to credential for Azure sysadmins, cloud operations engineers, and IT administrators migrating from on-premises environments.
“AZ-104 is not a gentle exam and this made it manageable. Identity, governance, storage, networking — thorough on all of it. Passed first try.”
“I administer Azure every day and still had gaps. The questions were exam-accurate and I could rehearse under time pressure before the real thing.”
Every AZ-104 question is written by someone who holds this certification and works in the field — not scraped from other sites, and not generated and shipped unreviewed. Every explanation you are shown has been read and approved by that same expert first.
Azure administrators, cloud operations engineers, and IT administrators managing Azure subscriptions and resources.
Prerequisites: AZ-900 recommended. 6+ months of hands-on experience managing Azure subscriptions, including compute, storage, networking, and identity.