AZ-104 Study

Week 1 — Identity Basics & Access Control (Entra ID)

Exam Domain: Manage Azure identities and governance

What to Study / Learn

• What Microsoft Entra ID (Azure AD) is and what it is not

• Difference between:

  • Users vs Groups

  • Cloud-only vs synced users

  • Security groups vs Microsoft 365 groups

• Authentication vs Authorization

• RBAC:

  • What a role definition is

  • Scope levels: subscription → resource group → resource

  • Built-in roles (Owner, Contributor, Reader, User Access Admin)

Tasks

• Create users manually in Entra ID

• Create security groups and assign users

• Assign RBAC roles at:

  • Resource group level

  • Resource level

• Observe how permissions change based on scope

🧪 Weekly Lab

Lab: Least-Privilege Access

1. Create:

   • 2 users

   • 1 security group

2. Assign Reader role at resource group level

3. Test access:

   • Can user view resources?

   • Can they modify anything?

4. Change role to Contributor → retest

Outcome: You understand how access is actually enforced.

📝 Weekly Quiz (Sample)

• What happens if two roles conflict?

• Can RBAC deny access?

• What scope takes precedence?

• Difference between authentication and authorization?

Week 2 — Governance: Policies, Locks, Subscriptions, Cost

Exam Domain: Manage Azure identities and governance

What to Study / Learn

• Subscriptions vs Management Groups

• Why enterprises split subscriptions

• Azure Policy:

  • Definitions

  • Assignments

  • Effects (deny, audit, deployIfNotExists)

• Resource Locks:

  • ReadOnly vs CanNotDelete

• Tags and why they matter

• Cost Management:

  • Budgets

  • Alerts

  • Azure Advisor

Tasks

• Create a policy that:

  • Restricts resource locations

• Apply tags (Environment, Owner)

• Create a budget alert

🧪 Weekly Lab

Lab: Prevent Bad Admin Behavior

1. Create a resource group

2. Apply a policy that blocks non-US regions

3. Attempt to deploy outside allowed region

4. Add a CanNotDelete lock

5. Attempt to delete a resource

Outcome: You understand guardrails, not just access.

📝 Weekly Quiz

• Policy vs RBAC differences?

• When does a lock override RBAC?

• Audit vs Deny policies?

Week 3 — Storage Accounts & Security

Exam Domain: Implement and manage storage

What to Study / Learn

• Storage account types

• Redundancy options (LRS, GRS, ZRS)

• Public vs private storage

• Authentication methods:

  • Access keys

  • SAS tokens

  • Entra ID (preferred)

• Storage firewalls & private endpoints

Tasks

• Create a storage account

• Disable public access

• Grant access via:

  • SAS

  • RBAC

• Compare behaviors

🧪 Weekly Lab

Lab: Secure a Storage Account

1. Create a storage account

2. Upload a blob

3. Test access:

   • With account key

   • With SAS token

   • With Entra ID role

4. Restrict network access

Outcome: You know how storage actually gets breached.

📝 Weekly Quiz

• When should you use SAS vs RBAC?

• What happens if keys are rotated?

• Which auth method is most secure?

Week 4 — Blob, File, Lifecycle & Replication

Exam Domain: Implement and manage storage

What to Study / Learn

• Blob containers vs file shares

• Hot vs Cool vs Archive tiers

• Snapshots & soft delete

• Lifecycle management rules

• Replication strategies

Tasks

• Create lifecycle rules

• Enable soft delete

• Test restoring deleted data

🧪 Weekly Lab

Lab: Storage Optimization

1. Upload test files

2. Create lifecycle rule:

   • Move to Cool after X days

3. Delete a blob → restore it

4. Take snapshot → restore from it

Outcome: You can manage data safely and cheaply.

📝 Weekly Quiz

• When does archive tier make sense?

• Snapshot vs backup?

• GRS vs LRS tradeoffs?

Week 5 — Virtual Machines & Compute

Exam Domain: Deploy and manage Azure compute resources

What to Study / Learn

• VM components (NIC, disk, NSG)

• VM sizes and pricing logic

• OS disks vs data disks

• VM Scale Sets

• App Services vs VMs

• Containers (ACI vs ACR)

Tasks

• Deploy a VM

• Attach a data disk

• Resize VM

• Enable auto-shutdown

🧪 Weekly Lab

Lab: Production VM Setup

1. Deploy a Linux or Windows VM

2. Attach data disk

3. Configure NSG inbound rules

4. Resize VM

5. Enable auto-shutdown

Outcome: You can safely run VMs like a real admin.

📝 Weekly Quiz

• When use App Service instead of VM?

• OS disk vs data disk?

• What breaks when resizing?

Week 6 — Virtual Networking

Exam Domain: Configure and manage virtual networking

What to Study / Learn

• VNets and subnets

• CIDR and IP planning

• NSGs vs ASGs

• VNet peering

• Private endpoints

• Load balancers vs Application Gateway

• Azure DNS basics

Tasks

• Build a VNet with subnets

• Apply NSGs

• Test connectivity

🧪 Weekly Lab

Lab: Network Isolation

1. Create VNet with 2 subnets

2. Apply NSG rules

3. Block traffic between subnets

4. Verify via VM connectivity tests

Outcome: You understand why networking breaks.

📝 Weekly Quiz

• NSG vs firewall?

• Service endpoint vs private endpoint?

• Peering limitations?

Week 7 — Monitoring, Backup & Recovery

Exam Domain: Monitor and maintain Azure resources

What to Study / Learn

• Azure Monitor components

• Metrics vs logs

• Log Analytics

• Alerts and action groups

• Backup vs Site Recovery

Tasks

• Create alerts

• Enable VM backup

• Restore a VM/file

🧪 Weekly Lab

Lab: Disaster Recovery Lite

1. Enable VM backup

2. Trigger alert on CPU

3. Simulate failure

4. Restore data

Outcome: You can protect workloads.

📝 Weekly Quiz

• Metrics vs logs?

• Backup vs Site Recovery?

• Alert vs action group?

Week 8 — Review & Exam Readiness

Tasks

• Full practice exams

• Redo weak labs

• Practice CLI & PowerShell equivalents

• Review architecture questions

🧪 Final Lab

Capstone:
Deploy:

• VNet

• VM

• Secure storage

• Monitoring

• Backup

• RBAC + policy

📝 Final Quiz

• Mixed scenario-based questions

• Time-boxed (exam style)