AZ-104 cheat sheet — every exam topic on one page

Manage Azure identities and governance

Manage Microsoft Entra Users and Groups (AZ-104)

• Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud identity directory; it has no OUs or Group Policy, unlike on-premises AD.
• Members are internal accounts; guests are B2B users who sign in with their own identity (work account, Microsoft account or email one-time passcode). UserType can be switched between Member and Guest.
• Bulk create, invite and delete users from CSV templates; import, remove or download a group's members from a CSV in the group's bulk operations.
• Synced users are edited in on-premises AD; blocking sign-in keeps the account intact; a deleted user can be restored with the same object ID for 30 days.
• Security groups grant access and can hold devices and nested groups; Microsoft 365 groups provide a group mailbox, calendar and SharePoint site, hold users only and can be Teams-enabled.
• Dynamic membership (P1 per unique member) is rule-only: no manual adds or removes, -and binds before -or, and Validate Rules tests a rule before you save it.
• License in the Microsoft 365 admin center; group licensing skips nested groups, falls back to the tenant location, and needs Reprocess after you fix an error. Move users add-first, remove-last.
• SSPR reset needs Business Standard or P1; writeback (cloud to on-premises) needs P1/P2 or Business Premium and is required for every on-premises-mastered user.

Manage Access to Azure Resources: Azure RBAC (AZ-104)

• A role assignment binds one security principal to one role definition at one scope, optionally narrowed by a condition.
• Owner manages resources and access; Contributor manages resources but its NotActions remove every Microsoft.Authorization write and delete — no role assignments, locks or policy assignments.
• User Access Administrator manages all of Microsoft.Authorization; Role Based Access Control Administrator manages role assignments only and, with a condition, limits which roles a delegate can hand out.
• Prefer job-function roles (Virtual Machine Contributor, Network Contributor) over Contributor; signing in to a VM needs a VM login role, which no management role includes.
• Owner, Contributor and Reader have no DataActions: blob and Key Vault data need data roles such as Storage Blob Data Reader or Key Vault Secrets User; roles that list storage keys hand out a credential that outlives the assignment.
• Assignments inherit downward (including from parent resources to child resources), can only be removed where they were made, and follow the current management-group hierarchy.
• Custom roles: names are unique per tenant, extend them by editing AssignableScopes, built-in roles are cloned not edited, and DataActions roles cannot be assigned at management group scope.
• Allows are additive and NotActions is not a deny; only a deny assignment blocks — created by Azure from deployment stack deny settings, system protected, with exceptions via excluded principals or actions.
• Azure RBAC governs resources; Entra roles govern the directory at tenant or administrative-unit scope. Elevate access gives a Global Administrator User Access Administrator at root scope until it is turned off.
• Trace access with Check access, the (Inherited) Scope column, and az role assignment list --all --include-groups --include-inherited.

Azure Subscriptions, Policy, Locks and Governance (AZ-104)

• The hierarchy is management group → subscription → resource group → resource; policy and role assignments are inherited downward, and a moved subscription takes its new parent's governance and loses its old parent's.
• Subscriptions are billing and quota boundaries (vCPU quotas per subscription per region); changing a subscription's Entra directory deletes its role assignments and breaks managed identities, while a same-directory billing transfer does not.
• Moving a resource changes its resource group, subscription and resource ID but never its region; both groups are locked during the move, dependents move together, and direct role assignments are orphaned.
• A custom policy definition can be assigned only at or below where it is saved; parameters let one definition serve many scopes, and DoNotEnforce evaluates without enforcing.
• Exclusions (notScopes) stop evaluation; exemptions (Waiver or Mitigated, optional expiry) keep the resource visible as Exempt.
• Audit and AuditIfNotExists report, Deny blocks creates and updates, DenyAction blocks deletes, and Modify and DeployIfNotExists remediate through the assignment's managed identity.
• Locks (subscription, resource group or resource — not management group) override RBAC, cover control-plane operations only, and need Owner or User Access Administrator to manage; ReadOnly blocks POST actions such as VM restarts.
• Tags are not inherited; built-in Require-a-tag policies Deny, Inherit-a-tag policies Modify, and Cost Management tag inheritance tags usage records, not resources.
• Budgets only notify unless an action group (subscription or resource group scope) automates a response; the spending limit is a hard stop only on credit-based offers.

Implement and manage storage

Configure Access to Azure Storage: SAS, Keys & Firewalls (AZ-104)

• Storage access has two layers: networking (firewall rules, exceptions, private endpoints) and authorization (keys, SAS, Entra RBAC) — decide them separately.
• Prefer Microsoft Entra ID with Azure RBAC data roles whenever the caller can have an identity; use a SAS only for callers that cannot.
• IP rules take public addresses only (no RFC 1918, no /31 or /32 prefixes) and never match same-region traffic; use a virtual network rule with a Microsoft.Storage service endpoint, a private endpoint, or a resource instance rule instead.
• A private endpoint serves one sub-resource (blob, file, queue, table, dfs, web) with its own privatelink DNS zone, which must be linked to every client virtual network.
• Trusted access for managed-identity services needs managed identity authentication plus a data role; a resource instance rule admits one named resource.
• Access keys are all-or-nothing; rotate with two keys, and regenerating one immediately invalidates every SAS it signed. A key expiration policy only flags keys; disallowing Shared Key blocks keys, account SAS and key-signed service SAS.
• A user delegation SAS is signed with an Entra-issued key valid for at most seven days, grants only what both its sp and the signer's RBAC allow, and is revoked by revoking all user delegation keys or the signer's role.
• A stored access policy makes a service SAS revocable and editable (changes take up to 30 seconds); each of start, expiry and permissions lives in the token or the policy, never both.
• Azure Files uses one identity source per account; effective SMB access is the more restrictive of the share-level permission and NTFS ACLs, and an identity with both a default share-level permission and its own SMB role gets the higher of the two.
• A SAS expiration policy applies to every SAS type and is checked when a token is used: Log allows and records out-of-policy requests, Block denies them, and a SAS with no start time counts as out of policy.

Configure & Manage Azure Storage Accounts and Redundancy (AZ-104)

• Standard GPv2 is the default account kind; premium kinds (block blob, SSD file shares, page blob) give SSD latency but support only LRS and ZRS (page blobs only LRS) — never geo-redundancy.
• Account names are 3–24 lowercase letters and digits, globally unique; the name, performance tier, region and account-level infrastructure encryption are fixed at creation, while redundancy, default access tier and key source can change.
• GRS and GZRS copy asynchronously to the paired region, where data is stored as LRS; only RA-GRS and RA-GZRS let you read the secondary (the read-only -secondary endpoint) without a failover.
• The archive tier works only with LRS, GRS and RA-GRS — not with ZRS, GZRS or RA-GZRS.
• Unplanned customer-managed failover loses writes after the Last Sync Time, deletes the old primary copy and leaves the account LRS; planned failover needs both regions up, loses nothing and keeps geo-redundancy. Microsoft-managed failover cannot be requested per account.
• Geo and read-access changes are a setting; zone changes are a conversion (no downtime, same endpoints and keys, no completion SLA) or a manual migration; LRS to GZRS takes two steps.
• Object replication needs versioning on both accounts and change feed on the source, does not support hierarchical namespace, makes the destination container read-only (409 on writes) and copies only new blobs unless the rule's copy scope includes existing ones.
• CMK needs a managed identity with get/wrapKey/unwrapKey (user-assigned at creation) and a vault with soft delete and purge protection; omit the key version for automatic rotation pickup. Encryption scopes give per-container keys and can add infrastructure encryption.
• Storage Explorer is the GUI; AzCopy is the scriptable CLI — with Entra auth it needs a Storage Blob Data role, sync deletes only with --delete-destination, and resumed jobs need their SAS tokens again.

Configure Azure Files and Azure Blob Storage (AZ-104)

• Azure Files gives SMB/NFS shares with file locking that many VMs mount at once; Blob Storage gives HTTPS object storage with optional anonymous read — Azure Files never allows anonymous access.
• NFS 4.1 needs an SSD (premium) FileStorage account and is secured only at the network level (private endpoint or VNet rule); keys, SAS and Kerberos do not authorize NFS mounts.
• Transaction optimized, hot and cool exist only on pay-as-you-go standard (HDD) shares and are price options, not speed; moving to SSD means a new FileStorage share and a data copy.
• Share snapshots restore individual files (Previous Versions on Windows); file share soft delete — on by default, 7 days, 1–365 — restores a deleted share with its snapshots.
• A port 445 block on the client network is fixed with a VPN or ExpressRoute path to a private endpoint, not with storage firewall rules or service endpoints.
• Container anonymous access needs Allow Blob anonymous access on the account and still obeys the storage firewall; Blob level allows reads by URL, Container level also allows listing.
• Time-based retention ends after a set period and, once locked, can only be extended; a legal hold has no end date and lasts until cleared.
• Archive is offline, needs rehydration (Standard up to 15 hours; High can finish under an hour for blobs under 10 GB) and is only on LRS/GRS/RA-GRS; early-deletion charges are prorated and apply to tier changes too.
• Soft delete expires after its window and Undelete never promotes a version; versioning keeps every prior state until deleted; container soft delete restores only to the original name.
• Lifecycle prefixes start with the container name, tiering applies to block blobs only, last-access conditions need access tracking, and new rules can take up to 24 hours to act.

Deploy and manage Azure compute resources

ARM Templates and Bicep: AZ-104 Deployment Guide

• An ARM template requires only $schema, contentVersion and resources; parameters, variables, functions and outputs are optional.
• Bicep transpiles to ARM JSON: same engine and resource coverage, no state file, plain expressions and string interpolation instead of bracketed template expressions.
• Symbolic references create implicit dependencies; a resourceId() string does not, so add dependsOn or switch to the symbolic reference. Use existing with a scope to read resources you must not change.
• reference() and list*() run only in resource properties and outputs, and references to a conditional resource need an if() guard.
• Only @secure() keeps a value out of deployment history. Key Vault references need enabledForTemplateDeployment on the vault and deploy/action for the deployer; in Bicep, getSecret() feeds only a @secure() module parameter.
• Redeploys reapply every declared property, reverting manual drift; declare subnets inside the virtual network, not as separate child resources.
• Incremental (default) leaves undeclared resources alone; Complete deletes them, but not at subscription scope, not from the portal, not for nested templates and not past a lock. Deployment stacks are the recommended replacement.
• what-if previews changes, validate checks acceptability, lint checks source quality; --confirm-with-what-if or -Confirm previews and approves in one command.
• Resource groups are declared at subscription scope (az deployment sub create); scope a module to the new group to fill it.
• Linked templates are fetched by Resource Manager (SAS needed for private blobs); template specs and modules avoid hosted URIs, and deploying a spec needs Template Spec Reader on the spec plus deploy rights on the target scope.
• Exporting a resource group captures current state; exporting from deployment history returns the original template. Decompile converts JSON to Bicep; build goes the other way.

Azure Virtual Machines: Sizes, Disks, and Zones (AZ-104)

• Availability set membership and an ephemeral OS disk are fixed when a VM is created; size, data disk type and caching can change later.
• SSH public key authentication at creation supplies only the public key and disables password sign-in; VMAccess can add a key without disabling passwords, and Entra ID login uses Entra-issued certificates.
• cloud-init in custom data configures Linux at first boot; the Custom Script Extension runs scripts on Windows or Linux from a template; Windows does not execute custom data.
• Generalize with Sysprep or waagent before capture, and keep versioned, region-replicated, RBAC-shared images in Azure Compute Gallery.
• Spot VMs are deeply discounted, have no SLA and can always be evicted for capacity; max price -1 only removes price eviction.
• B is burstable on CPU credits, D general purpose, E memory optimized, F compute optimized, L storage optimized; a missing size on a running VM appears after deallocation (all VMs, in an availability set).
• Premium SSD v2 (up to 80,000 IOPS) and Ultra Disk (up to 400,000) tune IOPS independently and are data disks only; new data disks must be initialized and formatted in the guest.
• The temp disk survives a reboot but not deallocation, redeploy or a move to new hardware.
• Zones give 99.99% across datacenters, availability sets 99.95% inside one, a single premium-disk VM 99.9%; zones and sets are mutually exclusive.
• Scale sets: Flexible orchestration supports Spot Priority Mix; rolling upgrades need a health signal; each autoscale profile needs its own rules.
• Encryption at host covers temp disk, caches and the host-to-storage flow without guest CPU; register EncryptionAtHost, deallocate existing VMs, and never after ADE, which retires in September 2028.
• Resource group and subscription moves keep the region but change resource IDs; region moves use Azure Resource Mover (prepare, initiate, commit or discard, delete source).

Provision and Manage Containers in Azure (AZ-104)

• Choose ACI to run a container briefly with no orchestration, Container Apps for managed containers that autoscale (including to zero) with revisions, App Service for web apps that need slots, and AKS only when you need full Kubernetes control.
• ACR stores images; push a local image by tagging it with the login server (<name>.azurecr.io/repo:tag), use az acr build when there is no local Docker, and az acr import to copy an existing image from another registry.
• Every ACR tier is zone-redundant in supporting regions; geo-replication, private endpoints and dedicated data endpoints are Premium-only.
• For ACR access, a managed identity with AcrPull is the passwordless least-privilege pull; repository-scoped tokens with scope maps serve clients outside Microsoft Entra; the admin user is for testing only.
• ACI bills per second on requested vCPU and memory; restart policy Always suits services, OnFailure retries failed jobs, Never runs once; CPU, memory, OS type and restart policy changes need delete and recreate.
• In ACI, secure environment variables hide values from the portal and API, secret volumes deliver files from RAM, and only Azure Files (Linux, storage key) persists data beyond the container group.
• A VNet-deployed ACI group has no public IP or DNS label; publish it through Application Gateway or a load balancer, and send its outbound traffic through a NAT gateway.
• Container Apps: internal vs external environment and custom VNet are fixed at creation; app ingress limited to the environment hides an app from the VNet; external TCP ingress needs a custom VNet.
• Container Apps scale between min 0 and max 10 replicas by default; CPU and memory rules cannot scale to zero; traffic splitting needs multiple revision mode, and secret changes need a revision restart.

Create and Configure Azure App Service (AZ-104)

• Every app on a plan runs on every instance of that plan, so isolating a noisy app needs its own plan; an app can move only to a plan in the same resource group, region and OS.
• Custom domains need Shared; TLS bindings, managed certificates, backups and Always On need Basic; autoscale, slots and IP-based SSL need Standard.
• Scale up for per-request limits, scale out for aggregate load; Basic tops out at 3 manual instances, and every autoscale scale-out rule needs a paired scale-in rule.
• Without Always On an idle app unloads after about 20 minutes, stopping continuous WebJobs; HTTPS Only redirects HTTP, minimum TLS version rejects old handshakes, and ARR affinity pins clients to one instance.
• Subdomain: CNAME to <app>.azurewebsites.net plus TXT asuid.<sub>. Apex: A record to the inbound IP plus TXT asuid. Migrate live names TXT first, CNAME last.
• Managed certificates are free and self-renewing but no wildcard; Key Vault imports follow vault renewals; SNI keeps the shared inbound IP while IP-based SSL assigns a dedicated one.
• Automatic backups are hourly, platform-stored for 30 days and not downloadable; custom backups go to your storage account and need Backup/restore over virtual network integration behind a storage firewall.
• VNet integration is outbound (add route-all plus a NAT gateway for a fixed outbound IP); a private endpoint is inbound and needs public network access disabled to make the app private.
• A swap applies target settings, warms the source, then switches routing; domains, bindings, access rules, scale and managed identities stay with their slot; x-ms-routing-name controls traffic routing.

Implement and manage virtual networking

Azure Virtual Networks, Subnets, Peering & User-Defined Routes

• Azure reserves five addresses per subnet (.0, .1 gateway, .2 and .3 DNS, and the last address), so a /24 yields 251 usable hosts, .4 is the first assignable address and /29 is the smallest subnet.
• A VNet can hold several non-contiguous ranges; add a range to grow it, and change a subnet's range only while it is empty.
• NSGs, route tables and NAT gateways attach to subnets, ASGs to NICs; static and secondary private IPs are set on the NIC's IP configurations in Azure, never by changing the guest OS address.
• Peering is non-transitive and works across regions, subscriptions and tenants; it needs non-overlapping ranges and a link on each VNet created with rights on that VNet.
• Allow forwarded traffic goes on the receiving VNet's link (each spoke's link to the hub for hub-relayed traffic); hub allows gateway transit, spoke uses remote gateways and can't have its own gateway.
• Resize a peered VNet in place and sync the peering after every resize — never delete and recreate it.
• Basic public IPs are retired; Standard is static and blocks inbound until an NSG allows it; Standard v2 currently pairs only with the Standard v2 NAT gateway; a NAT gateway is outbound-only.
• Route choice: longest prefix first, then user-defined > BGP > system at an equal prefix; overridden routes show Invalid, and next hop None drops traffic.
• Keep an NVA in its own subnet, never route its subnet to itself, and use symmetric UDRs on both subnets to inspect traffic inside a VNet.

Azure NSGs, Bastion, Service Endpoints & Private Endpoints

• NSG priorities run 100-4096, lower is evaluated first, the first match wins, and priorities must be unique per direction within one NSG.
• NSGs are stateful: return traffic of an allowed flow needs no reverse rule, and removing a rule may not cut existing connections.
• Default rules allow VirtualNetwork and AzureLoadBalancer inbound, allow internet only outbound, and deny the rest at priority 65500.
• VirtualNetwork includes peered and gateway-connected ranges; AzureLoadBalancer is only the 168.63.129.16 health-probe source; you cannot define your own service tags.
• A narrow allow restricts nothing on its own: add an explicit deny above the 65000 defaults to block the remaining VNet or internet traffic.
• With subnet and NIC NSGs, inbound is checked subnet then NIC, outbound NIC then subnet, and a deny in either wins.
• ASGs are assigned to NICs, a NIC can join several ASGs, and NICs in a rule's ASGs must share one VNet.
• Effective security rules are per NIC and list the merged rule set; IP flow verify gives a verdict for one flow; next hop answers routing.
• Azure Bastion needs AzureBastionSubnet /26 or larger, reaches directly peered VNets from Basic up, and the VM NSG must allow 3389/22 from that subnet.
• Native client, IP-based connection, shareable links and host scaling need Standard; session recording and private-only need Premium.
• Service endpoints keep the public endpoint, cover only the enabled subnet (not on-premises) and switch the subnet's source IP for that service.
• A private endpoint maps one resource sub-resource to a private IP and needs a privatelink DNS zone linked to the VNet; disable public access separately.

Azure DNS and Load Balancer: AZ-104 Networking Guide

• A public Azure DNS zone becomes authoritative only when the registrar's NS records point at its four Azure name servers; child zones are delegated with an NS record set in the parent zone.
• The apex cannot hold a CNAME: use an alias A/AAAA record set for a Standard public IP, Traffic Manager, CDN or Front Door; alias records empty themselves when the target is deleted. App Service subdomains use a CNAME.
• Azure-provided DNS (168.63.129.16) resolves VM names within one VNet only; after changing a VNet's DNS servers, existing VMs need a DHCP renewal or restart.
• A private zone resolves only for linked VNets — peering shares nothing. Autoregistration is per link, one registration zone per VNet, VMs only; everything else needs manual records.
• Private endpoints use service-specific privatelink zones linked to the consuming VNets; clients keep the normal FQDN, and on-premises clients forward the public service zone to a DNS Private Resolver inbound endpoint.
• A same-named private zone overrides the public zone for linked VNets with no fallback; fallback to internet works only for Private Link zones.
• Basic Load Balancer was retired on 30 September 2025. Standard is secure by default (an NSG must allow inbound internet traffic to a public frontend) and needs a zone-redundant frontend to survive a zone failure.
• HA ports (internal Standard, port 0, protocol All) suits NVAs; floating IP lets several frontends share a backend port; idle timeout defaults to 4 minutes, up to 100.
• An internal load balancer gives backends no internet access: add a NAT gateway (preferred, and it wins over instance public IPs and outbound rules) or use outbound rules on a public Standard load balancer.
• Pick the distributor by layer and scope: Load Balancer for any TCP/UDP in one region, Application Gateway for HTTP path- or host-based routing and WAF in one region, Traffic Manager for DNS-based routing across regions (priority, weighted, performance, geographic), Front Door for global HTTP/S.
• Probes need a TCP handshake or an HTTP 200; AllowAzureLoadBalancerInBound (65001) loses to a lower-numbered custom deny; use Health Probe Status split by backend IP and Data Path Availability to locate the fault.

Monitor and maintain Azure resources

Azure Monitor: Metrics, Logs, Diagnostic Settings & Alerts (AZ-104)

• Platform metrics are numeric, agentless and near real time, kept for 93 days; logs are records in a Log Analytics workspace queried with KQL.
• In metrics explorer, Max exposes spikes that Avg hides, Sum gives totals and Count is the number of samples; filter restricts what is counted, split draws one series per dimension value.
• The activity log records control-plane operations automatically for 90 days; data-plane reads need resource logs and sign-ins are in Microsoft Entra logs.
• Resource logs exist only through a diagnostic setting: one destination of each type per setting, category groups pick up new categories, and Azure Policy DeployIfNotExists plus remediation covers resources at scale.
• Workspace interactive retention defaults to 30 days and goes up to two years; older data in long-term retention is reached with search jobs or restore.
• Metric and activity log alerts need no workspace; log search alerts query one. Dynamic thresholds learn seasonality, and the number of violations controls persistence.
• Alert rules reference action groups for recipients and actions; alert processing rules suppress or apply action groups on a scope and schedule without editing rules.
• Host VM metrics including available memory are agentless; guest disk free space, event logs and syslog need the Azure Monitor Agent and a data collection rule.
• IP flow verify checks NSG rules only, next hop shows routing (None = dropped), connection troubleshoot is one-off and Connection monitor is continuous; virtual network flow logs replace NSG flow logs.

Azure Backup & Site Recovery: Vaults, Policies & Failover (AZ-104)

• Recovery Services vault: Azure VMs, Azure Files, SQL/SAP HANA in VMs, MARS/MABS and Site Recovery. Backup vault: Blobs, managed disks (agentless Disk Backup) and PostgreSQL. Create the vault in the workload's region.
• Vault redundancy (LRS, ZRS, GRS) locks once backup is configured for any item; changing it later means a new vault. ZRS keeps data in-region across zones; GRS copies to the paired region.
• Cross Region Restore needs a GRS vault, is enabled in Backup Configuration, and allows paired-region restores at any time, cannot be disabled once on; items can take up to 48 hours to appear there.
• A backup policy is a schedule plus daily, weekly, monthly and yearly retention ranges; an item is in one policy at a time, and retention changes apply to existing recovery points.
• Standard policy: one backup a day, 1-5 days of instant restore snapshots. Enhanced policy: every 4-24 hours, 1-30 days of snapshots, required for Premium SSD v2 and Ultra Disks.
• Create new is quick but fixed, Restore disks gives an editable template (availability set, names), Replace existing keeps the VM's name, NIC and IPs, and File Recovery mounts a point for single files.
• Soft delete is on by default: 14 days free, 14-180 days per vault. Undelete returns the item to stop-protection-with-retain-data; Resume backup restarts protection in the same vault.
• Site Recovery uses the Mobility service extension, a source-region cache storage account and a replication policy; recovery plans set order and runbook actions, multi-VM consistency sets a shared point in time.
• Drill with test failover into an isolated network, then Cleanup test failover. Fail back by commit, re-protect, failover to the primary (original VMs shut down), re-protect again.
• Built-in backup alerts notify only through an alert processing rule plus an action group; Backup Reports need vault diagnostic settings to Log Analytics, deployed at scale with a DeployIfNotExists policy.