The az 104 syllabus is organized into five functional domains, each carrying a published weight: identities and governance, storage, compute, virtual networking, and monitoring. Microsoft breaks each domain into objective statements describing specific tasks, such as configuring storage redundancy or assigning Azure roles. Use the weights below to prioritize study time across domains.
Microsoft publishes the az 104 syllabus as a set of functional domains, each with an official weight and a list of objective statements. The table below reproduces the domain weights, and the sections that follow list every objective statement exactly as Microsoft states them in the exam guide, grouped by domain.
Before diving into the detail, it helps to see the shape of the whole exam. See the exam format and scoring page for how these domains translate into exam structure, and the study plan for a week-by-week way to work through them.
Domain weights at a glance
| Domain | Weight |
|---|---|
| Manage Azure identities and governance | 24% |
| Implement and manage storage | 20% |
| Deploy and manage Azure compute resources | 24% |
| Implement and manage virtual networking | 18% |
| Monitor and maintain Azure resources | 14% |
Identities and governance and compute resources carry the largest share of the exam at 24% each, so a study plan that shortchanges either one is taking on real risk. Monitoring carries the smallest share at 14%, but it still appears on every attempt, so it cannot be skipped.
Manage Azure identities and governance (24%)
This domain focuses on Microsoft Entra ID and the governance controls that sit on top of Azure subscriptions. The objective statements are:
- Manage Microsoft Entra users and groups - Create users and groups
- Manage Microsoft Entra users and groups - Manage user and group properties
- Manage Microsoft Entra users and groups - Manage licenses in Microsoft Entra ID
- Manage Microsoft Entra users and groups - Manage external users
- Manage Microsoft Entra users and groups - Configure self-service password reset (SSPR)
- Manage access to Azure resources - Manage built-in Azure roles
- Manage access to Azure resources - Assign roles at different scopes
- Manage access to Azure resources - Interpret access assignments
- Manage Azure subscriptions and governance - Implement and manage Azure Policy
- Manage Azure subscriptions and governance - Configure resource locks
- Manage Azure subscriptions and governance - Apply and manage tags on resources
- Manage Azure subscriptions and governance - Manage resource groups
- Manage Azure subscriptions and governance - Manage subscriptions
- Manage Azure subscriptions and governance - Manage costs by using alerts, budgets, and Azure Advisor recommendations
In practice, this means you should be comfortable creating and managing users and groups from the Azure portal, PowerShell, or the Azure CLI, assigning built-in roles at the right scope, and using policy, locks, and tags to keep a subscription under control.
Implement and manage storage (20%)
- Configure access to storage - Configure Azure Storage firewalls and virtual networks
- Configure access to storage - Create and use shared access signature (SAS) tokens
- Configure access to storage - Configure stored access policies
- Configure access to storage - Manage access keys
- Configure access to storage - Configure identity-based access for Azure Files
- Configure and manage storage accounts - Create and configure storage accounts
- Configure and manage storage accounts - Configure Azure Storage redundancy
- Configure and manage storage accounts - Configure object replication
- Configure and manage storage accounts - Configure storage account encryption
- Configure and manage storage accounts - Manage data by using Azure Storage Explorer and AzCopy
- Configure Azure Files and Azure Blob Storage - Create and configure a file share in Azure Files
- Configure Azure Files and Azure Blob Storage - Create and configure a container in Azure Blob Storage
- Configure Azure Files and Azure Blob Storage - Configure storage tiers
- Configure Azure Files and Azure Blob Storage - Configure soft delete for blobs and containers
Expect scenario questions that ask you to pick the right access method (SAS token, access key, or identity-based access), the right redundancy option, or the right blob tier for a given cost or durability requirement.
Deploy and manage Azure compute resources (24%)
- Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files - Interpret an Azure Resource Manager template or a Bicep file
- Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files - Modify an existing Azure Resource Manager template
- Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files - Modify an existing Bicep file
- Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files - Deploy resources by using an Azure Resource Manager template or a Bicep file
- Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files - Export a deployment as an Azure Resource Manager template or convert an Azure Resource Manager template to a Bicep file
- Create and configure virtual machines - Create a virtual machine
- Create and configure virtual machines - Configure encryption at host for Azure virtual machines
- Create and configure virtual machines - Move a virtual machine to another resource group, subscription, or region
- Create and configure virtual machines - Manage virtual machine sizes
- Create and configure virtual machines - Manage virtual machine disks
- Create and configure virtual machines - Deploy virtual machines to availability zones and availability sets
- Create and configure virtual machines - Deploy and configure an Azure Virtual Machine Scale Sets
- Provision and manage containers in the Azure portal - Create and manage an Azure Container Registry
- Provision and manage containers in the Azure portal - Provision a container by using Azure Container Instances
This is the largest domain alongside identities and governance, so budget real hands-on time for ARM templates, Bicep files, virtual machine configuration, and basic container provisioning.
Implement and manage virtual networking (18%)
- Configure and manage virtual networks in Azure - Create and configure virtual networks and subnets
- Configure and manage virtual networks in Azure - Create and configure virtual network peering
- Configure and manage virtual networks in Azure - Configure public IP addresses
- Configure and manage virtual networks in Azure - Configure user-defined routes
- Configure and manage virtual networks in Azure - Troubleshoot network connectivity
- Configure secure access to virtual networks - Create and configure network security groups (NSGs) and application security groups
- Configure secure access to virtual networks - Evaluate effective security rules in NSGs
- Configure secure access to virtual networks - Implement Azure Bastion
- Configure secure access to virtual networks - Configure service endpoints for Azure platform as a service (PaaS)
- Configure secure access to virtual networks - Configure private endpoints for Azure PaaS
- Configure name resolution and load balancing - Configure Azure DNS
- Configure name resolution and load balancing - Configure an internal or public load balancer
- Configure name resolution and load balancing - Troubleshoot load balancing
Networking questions tend to reward candidates who understand the difference between service endpoints and private endpoints, and who can read an NSG rule set to work out effective access.
Monitor and maintain Azure resources (14%)
- Monitor resources in Azure - Interpret metrics in Azure Monitor
- Monitor resources in Azure - Configure log settings in Azure Monitor
- Monitor resources in Azure - Query and analyze logs in Azure Monitor
- Monitor resources in Azure - Set up alert rules, action groups, and alert processing rules in Azure Monitor
- Monitor resources in Azure - Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights
- Monitor resources in Azure - Use Azure Network Watcher and Connection monitor
- Implement backup and recovery - Create a Recovery Services vault
- Implement backup and recovery - Create an Azure Backup vault
- Implement backup and recovery - Create and configure a backup policy
- Implement backup and recovery - Perform backup and restore operations by using Azure Backup
- Implement backup and recovery - Configure Azure Site Recovery for Azure resources
- Implement backup and recovery - Perform a failover to a secondary region by using Site Recovery
- Implement backup and recovery - Configure and interpret reports and alerts for backups
- Implement backup and recovery - Last updated on 2026-03-19
This domain is the smallest by weight, but it covers two distinct skill sets: reading Azure Monitor data and running Azure Backup and Site Recovery, so do not leave it for the last afternoon before your attempt.
Once you have read through every objective statement, check the career path page to see how AZ-104 connects to the next certification in an Azure administrator track, and the prerequisites page to confirm your background matches what Microsoft recommends before you book a seat.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.