Microsoft Azure Administrator AZ-104 Training

Start with a user, group or workload and describe what it needs to do. Separate directory administration from Azure resource permissions. Then trace role assignments through scope and inheritance. Compare a human sign-in problem with a workload authorization failure: resetting a password does not repair a missing data-access role.

Your practice outputCreate a principal–role–scope table for a support engineer and a reporting application. Include an action each identity may perform and one it must be denied.

• Azure RBAC vs Microsoft Entra roles →
• Security defaults vs Conditional Access vs MFA and SSPR →
• Managed identity vs service principal →
• Key Vault RBAC vs access policies →

Design a small resource hierarchy with ownership, tags and a cost-review process. Distinguish a permission boundary from a configuration rule or deletion lock. For an existing noncompliant resource, investigate the policy effect and remediation prerequisites instead of assuming a new assignment automatically repairs it.

Your practice outputWrite a change note for a tagging requirement: assignment scope, a justified exception, how existing resources are handled and evidence that an allowed deployment still works.

• Azure Policy vs RBAC vs resource locks →
• Azure Policy effects and remediation tasks →
• Azure Policy scope, exclusions and exemptions →

Compare blob containers with file shares using a workload's access pattern. Plan authorization and network restrictions separately. Consider redundancy, lifecycle rules, versioning and soft delete as different controls. Review the scope and expiry of a SAS before sharing it, and plan how copied sample data will be checked after an AzCopy or Storage Explorer transfer.

Your practice outputBuild a storage decision sheet for active reports and archived exports. Record the required failure boundary, allowed identity, recovery method and a test that detects accidental over-permission.

• Storage LRS vs ZRS vs GRS vs GZRS →

Trace name resolution, the destination IP, routes, effective security rules and the return path. Separate peering connectivity from traffic filtering. For private service access, verify DNS and the endpoint's target subresource. For load balancing, inspect the frontend, backend health and probe path before blaming the application.

Your practice outputDraw a client-to-private-storage request path. Label where DNS, NSGs, routes and service authorization are checked, and identify the first observation that would narrow a failure.

• VNet vs NSG vs Azure Firewall →
• Private Endpoint vs Service Endpoint →
• Load Balancer vs Application Gateway vs Front Door →

Read an ARM template or Bicep file as a description of the intended state. Identify its parameters and dependencies before modifying it. Compare VM size, disks, placement and scale-out choices against the workload. Explain which failure a zone or availability set addresses, and what remains the application's responsibility.

Your practice outputAnnotate a sample deployment with its inputs, dependency order, availability decision and rollback assumptions. Describe how you would confirm the resulting resources match the plan.

• Availability sets vs zones vs VM Scale Sets →

Compare a VM, App Service, Container Instances and Container Apps by the control and operational work required. Map an image registry to its consumer. For an App Service change, review the plan, scaling, TLS, custom domain, networking and deployment-slot behavior before release. Treat each deployment as a change that needs validation, not just a successful button click.

Your practice outputPrepare a release checklist for a sample web application: hosting choice, configuration, access, health checks, expected scaling behavior and a recovery action if the new version fails.

Begin with the question an operator must answer. Separate resource configuration events from service operations and numerical measurements. Route the required logs to a workspace, inspect the available table and time range, and only then design the query and alert. An empty query result may mean missing collection, not a healthy workload.

Your practice outputWrite a troubleshooting record containing the signal, resource, collection route, query window, alert condition and person who should respond. Include a controlled test of the notification path.

• Activity Log vs resource logs and alerts →

Separate high availability, point-in-time restore and disaster-recovery failover. Choose a recovery point that fits the incident and explain how restored data will be validated without overwriting healthy resources. Combine the earlier units into a small administration runbook, then use practice results to identify concepts that need another worked example.

Your practice outputProduce a recovery checklist with a target recovery time, acceptable data loss, restore destination, validation evidence and cleanup plan. Keep a mistake log that explains decisions rather than answer letters.

• Azure Backup vs Site Recovery →