Azure

10 units, 20 lessons and 41 questions on Azure. Includes a full-length AZ-104 mock exam drawn in the published domain weights, marked with a per-domain breakdown. Free, and open without an account.

The exam it prepares for: Microsoft Azure Administrator (AZ-104), 40 questions in 120 minutes, pass 700 of 1000 (scaled).

What is in it

The scope ladder

Management group, subscription, resource group, resource.

  • Four levels, and what each is for — Management groups organise subscriptions and carry policy. A subscription is the billing and quota boundary. A resource group holds resources with a shared lifecycle. Resources sit at the bottom.
  • RBAC inherits down the ladder — A role assignment applies at its scope and everything beneath. Assign at the resource group and it covers every resource in it; assign at the subscription and it covers every group.

Identity

Entra ID, and identities that are not people.

  • Entra ID is the directory — Microsoft Entra ID, previously Azure Active Directory, holds the identities. A subscription trusts one directory. It is not a domain controller and does not do Kerberos or group policy.
  • Managed identities — A managed identity gives an Azure resource an identity in Entra ID with no credential to store. System-assigned lives and dies with the resource; user-assigned is independent and shareable.

Compute and storage

What to run it on, and what to keep it in.

  • VMs, App Service, Container Apps, Functions — Virtual machines when you need the machine. App Service for a web app without one. Container Apps for containers with scale-to-zero. Functions for event handlers. AKS when you need Kubernetes itself.
  • Blob access tiers — Hot, Cool, Cold and Archive trade storage price against retrieval cost and minimum retention. Archive is offline: reading it means a rehydration that takes hours.

Networking and resilience

The virtual network, and what a Region pair buys you.

  • VNets and NSGs — A virtual network is regional. Network security groups filter traffic and can be attached to a subnet or a network interface. Peering joins two VNets, including across Regions.
  • Availability zones and Region pairs — Zones protect against a data centre failing within a Region. Region pairs are fixed couplings used for some platform replication and for staggered maintenance.

Cost and guidance

Reservations, the licence benefit, and the framework.

  • Reservations and Hybrid Benefit — Reserved instances trade a one or three year commitment for a discount. Azure Hybrid Benefit reuses Windows Server and SQL Server licences you already own, and the two stack.
  • The Well-Architected Framework — Five pillars: reliability, security, cost optimisation, operational excellence and performance efficiency. Azure Advisor produces concrete findings against your own subscription.

Skill 1 · Manage identities and governance

Entra ID users and groups, role assignments, and the subscription controls: Policy, locks, tags, cost. 20–25% of the exam.

  • Roles and the scope they are assigned at — An Azure RBAC assignment is a role, a principal and a scope. Scopes nest — management group, subscription, resource group, resource — and an assignment is inherited downwards. Entra ID roles are a separate system governing the directory itself.
  • Locks, tags and cost control — A CanNotDelete lock stops deletion but allows changes; a ReadOnly lock stops both. Tags are inherited by nothing automatically — Azure Policy is what makes them appear. Budgets alert; they do not stop spend.

Skill 2 · Implement and manage storage

Storage account access, redundancy, Files and Blob, lifecycle and soft delete. 15–20% of the exam.

  • Redundancy options — LRS keeps three copies in one datacentre; ZRS spreads them across zones in the Region; GRS adds an asynchronous copy in the paired Region; GZRS combines the two. RA-GRS makes the secondary readable.
  • Granting access to blobs — Account keys open everything; a SAS grants a scoped, expiring permission; a stored access policy makes a SAS revocable; Entra ID authorisation with RBAC avoids keys entirely and is the recommended default.

Skill 3 · Deploy and manage compute

ARM templates and Bicep, virtual machines, scale sets, containers and App Service. 20–25% of the exam.

  • Availability sets and zones — An availability set spreads VMs across fault and update domains inside one datacentre; availability zones spread them across datacentres. The SLA differs, and so does what each protects against.
  • App Service and containers — An App Service plan is the compute you pay for; deployment slots let a new version warm up before it takes traffic. Container Instances suit a single short-lived container, Container Apps a scaling service.

Skill 4 · Implement and manage virtual networking

Virtual networks and peering, NSGs, Bastion, private endpoints, DNS and load balancing. 15–20% of the exam.

  • Network security groups and effective rules — An NSG is a numbered list of allow and deny rules, evaluated lowest first, applied at the subnet or the NIC or both. Default rules permit traffic within the virtual network and deny inbound from the internet.
  • Private access to PaaS, and load balancing — A service endpoint keeps traffic on the Azure backbone but the service keeps its public address; a private endpoint gives the service an address inside your virtual network. Load Balancer works at layer 4, Application Gateway at layer 7.

Skill 5 · Monitor and maintain Azure resources

Azure Monitor metrics, logs and alerts, Network Watcher, and backup and site recovery. 10–15% of the exam.

  • Metrics, logs and alerts — Metrics are numeric and near-real-time; logs go to a Log Analytics workspace and are queried with KQL. An alert rule needs a condition and an action group to do anything.
  • Backup and recovery — Azure Backup protects VMs, files and workloads into a Recovery Services vault on a policy; Site Recovery replicates a whole machine to another Region for failover. One restores data, the other restores service.

Open the Azure course · sit the AZ-104 mock exam · try 10 practice questions first