Study guide · Core notes
Reference notes for AZ-104: the identity and the rule, the storage and the compute, the network path, and the backup you can actually restore.
How to read these notes: Items tagged Extra are outside the April 17, 2026 skill list, such as VPN Gateway, ExpressRoute, and Azure Kubernetes Service. Learn the unmarked items first. New to the exam? Start with the overview for the format and domain weights. Shared cloud vocabulary is on the Azure Fundamentals notes.
Microsoft Entra ID is the directory. A cloud user is created in that directory. A guest is an external user you invite. The invitation has to be redeemed before the guest can sign in. Set the user type, the job information, and the usage location. Usage location is required before a license can be assigned.
A security group is the usual group for resource access and for licenses. A Microsoft 365 group also provisions collaboration resources. Group-based licensing assigns a license to members of a group, including members added later. Dynamic membership uses a rule instead of a manual list.
SSPR lets a user reset their own password after they register the authentication methods you require, such as a phone or an email. Enable it for a selected group or for everyone. The user must be allowed to use SSPR and must have registered enough methods. Password writeback, which pushes the new password to on-premises Active Directory, is the hybrid piece of that configuration.
It does not reset the local administrator password inside a virtual machine. It does not replace a role assignment. A user who has never registered a method cannot complete the reset.
A role assignment is a security principal, a role definition, and a scope.
| Role | Can manage resources | Can assign roles |
|---|---|---|
| Owner | Yes | Yes |
| Contributor | Yes | No |
| Reader | No. View only. | No |
| User Access Administrator | No | Yes |
Scopes, from widest to narrowest, are management group, subscription, resource group, and resource. A child scope inherits an assignment made above it. Access control shows that assignment as inherited. Allow assignments add up: if any assigned role permits the action, the action is allowed. A deny assignment overrides an allow.
To see why someone can or cannot act, read the assignments at the resource and at every parent scope. A Contributor on the subscription can create a virtual machine in every resource group in that subscription. A Contributor on one resource group cannot. Putting the person in a group and assigning the role to the group is easier to review than a pile of direct user assignments.
Policy decides whether a resource may exist. A deny effect blocks a noncompliant create or update. Audit reports it. Append and modify add or change a property, such as a tag. DeployIfNotExists can deploy a related resource and needs a remediation task for resources that already exist. Assign a policy or an initiative at a management group, subscription, or resource group. An exclusion skips a scope. An exemption is a time-bound waiver with a reason.
CanNotDelete lets you read and change the resource and blocks delete. ReadOnly blocks changes and delete. Locks inherit downward. A lock on a resource group locks the resources in it. Owner and User Access Administrator can create or remove a lock. Contributor cannot. Remove the lock before you delete the resource. A lock is a control-plane guard. It is not a substitute for a network rule.
A tag is a name and a value. It does not grant access. Tags do not inherit unless a policy copies them. A resource group is a lifecycle container. Its location stores the group's metadata. Resources in the group can live in other regions. Deleting the group deletes the resources. A subscription is a billing and quota boundary. Management groups organize subscriptions. The tenant has one root management group, and the hierarchy under it can be six levels deep.
A budget watches actual or forecast spend at a subscription or resource group and fires an alert at the thresholds you set. Azure Advisor recommends changes that can reduce cost, such as an idle resource or a better size. The budget is the alert. Advisor is the recommendation. Extra The pricing calculator estimates a bill before you deploy. It is an AZ-900 tool, not an AZ-104 objective.
Decide who may call the storage account, then how many copies of the data exist.
| Method | Use it when | Revoke it by |
|---|---|---|
| Microsoft Entra ID | A user or workload should receive a data role such as Storage Blob Data Contributor. | Removing the role assignment. |
| Account key | A legacy client needs shared-key access. Two keys exist so you can rotate one at a time. | Rotating the key. Every client using that key breaks. |
| Service SAS plus a stored access policy | You want a limited URL you can revoke without rotating the key. | Changing or deleting the stored access policy. |
| Account SAS | One token must cover more than one service. It cannot use a stored access policy. | Rotating the account key that signed it. |
| User delegation SAS | Blob access should be signed with Entra ID instead of an account key. | Revoking the user's Entra permission or waiting for the delegation key to expire. |
The storage firewall limits the public endpoint by virtual network and by public IP. You can allow trusted Azure services through that firewall. A private endpoint is a different path: a private IP in your subnet. Identity-based Azure Files needs an identity source on the account, which is Active Directory Domain Services, Microsoft Entra Domain Services, or Microsoft Entra Kerberos, plus a share-level role and the file-system permissions.
General-purpose v2 is the usual account. Redundancy is a property of the account. Locally redundant storage keeps three copies in one datacenter. Zone-redundant storage spreads them across zones in the region. Geo-redundant storage adds an asynchronous copy in the paired region. Geo-zone-redundant storage combines zones with that paired-region copy. Read-access geo-redundant options let you read the secondary. Encryption at rest is on by default with Microsoft-managed keys. Customer-managed keys live in a key vault you control. Infrastructure encryption adds a second encryption layer.
Object replication copies block blobs asynchronously to another account. The source and destination need blob versioning, and the change feed has to be enabled. Archive blobs are not replicated until they are rehydrated. AzCopy and Storage Explorer move data. AzCopy is the command-line copy. Storage Explorer is the graphical client.
A file share mounted over SMB or NFS. Set a quota. Premium file shares use SSD. Standard shares use transaction-optimized, hot, or cool. A snapshot is a point-in-time copy of the share. Soft delete keeps a deleted share for the retention period so you can restore it.
A container holds blobs. Public access can be private, blob, or container, and you can disable public access on the account so nobody can turn it on. Access tiers for block blobs are hot, cool, cold, and archive. Archive data is offline until you rehydrate it. Rehydration takes time. A lifecycle rule moves a blob to a cooler tier or deletes it when an age condition is met.
Blob soft delete keeps a deleted blob or snapshot for a retention window. Container soft delete does the same for a deleted container. Versioning stores a previous version when a blob is overwritten or deleted. A snapshot is a copy you take on purpose. They solve different recovery cases. Turn on the one the requirement names.
If you can deploy it once, you should be able to read the template that deploys it again.
An ARM template is JSON with parameters, variables, resources, and outputs. The default deployment mode is incremental: resources in the template are created or updated, and resources that are not in the template are left alone. Complete mode deletes resources in that resource group that the template does not contain. Use it only when that is the intent. Bicep is a language that compiles to an ARM template. You edit the Bicep file, deploy it with the same tools, and you can decompile an exported ARM template back to Bicep. Export a deployment from the resource group when you need a starting template.
A virtual machine needs a size, an image, disks, a network interface, and a virtual network. Managed disks have their own SKU. The OS disk and the data disks are separate. You can detach a data disk and attach it to another VM. Encryption at host encrypts the temporary disk and the disk caches on the host. It is not Azure Disk Encryption inside the guest, and it is not the server-side encryption that managed disks already use. The subscription feature has to be registered, and the size has to support it.
The Move operation moves a VM to another resource group or subscription in the same region. It does not change region. Azure Resource Mover moves a VM and its dependencies to another region. Resizing stays on the current hardware when the size is available there. If it is not, deallocate the VM and resize it. A VM goes in an availability zone or in an availability set, not both. A zone is a separate datacenter group in the region. An availability set spreads VMs across fault domains and update domains inside one datacenter. A scale set runs a group of VM instances and can scale on a metric, a schedule, or a manual count.
Azure Container Registry stores images. Prefer Entra authentication over the admin user. Geo-replication is a Premium feature. Azure Container Instances runs a container group for a job that should start quickly and stop. You set CPU, memory, and a restart policy. Azure Container Apps runs containers as revisions in an environment, with ingress and scale rules that can scale to zero. Extra Azure Kubernetes Service is not in the April 17, 2026 skill list.
The plan is the compute: region, operating system, SKU, and instance count. Apps on the same plan share it. Scale up changes the SKU. Scale out adds instances. Autoscale rules belong on the plan, and only some SKUs support them. Bind a certificate and set the minimum TLS version. A free managed certificate needs a custom domain. Map a custom name with a CNAME or an A record, prove you own it, and add the hostname binding.
App Service backup copies the app to a storage account on a schedule. It needs Standard or higher. Virtual network integration is the outbound path. A private endpoint is the inbound private path. Access restrictions filter inbound public traffic. A deployment slot is a second copy of the app, such as staging. Swap exchanges it with production. A setting marked as a deployment slot setting stays on the slot and does not swap. Slots need Standard or higher.
Draw the address space before you draw the security rule.
A virtual network has an address space and subnets. Subnets must fit inside that space and must not overlap. Peering connects two virtual networks over the Microsoft backbone. The address spaces cannot overlap. Peering is not transitive: if A peers with B and B peers with C, A does not automatically reach C. Peering can cross regions and subscriptions. Gateway transit is optional and is a separate setting.
A public IP address has a SKU and an assignment. A Standard public IP is static and zone-redundant, and it is closed until a network security group allows traffic. The SKU has to match the load balancer SKU. A user-defined route overrides the system route when the prefixes are equal, and the longest prefix still wins. A route for 0.0.0.0/0 with next hop Virtual appliance sends default-bound traffic through that appliance. Next hop None drops the matching traffic. To see which route a packet would use, read the effective routes on the network interface or use Network Watcher next hop.
A network security group rule names source, destination, port, protocol, and a priority. The lowest priority number that matches wins. Default inbound rules allow virtual network traffic and Azure Load Balancer probes, then deny the rest. Default outbound rules allow internet. An application security group groups network interfaces so a rule can name the group instead of an address. If both the subnet and the interface have an NSG, both must allow the flow. A deny on either one blocks it. For inbound traffic the subnet is evaluated first. For outbound traffic the interface is evaluated first.
Azure Bastion is a managed jump host. Clients use TLS on port 443, and the VM does not need a public IP. The subnet must be named AzureBastionSubnet and must be /26 or larger. A service endpoint extends your virtual network's identity to a platform service over the backbone. The service still has a public address. A private endpoint places a private IP for that service in your subnet and lets you disable public access. Clients resolve the service name to that private IP through a private DNS zone.
An Azure DNS public zone hosts records for a domain you own. A private zone resolves names inside the virtual networks you link to it. Link the zone that matches a private endpoint or the client will keep using the public address. An Azure Load Balancer is a layer-4 balancer. A public balancer has a public frontend IP. An internal balancer has a private frontend IP. You need a backend pool, a health probe, and a rule. Standard balancers are closed until an NSG allows the probe, including traffic from the AzureLoadBalancer service tag. A failed probe usually means the port, the path, or that NSG. Extra Application Gateway is layer 7 and is not the load balancer named in this skill.
A metric tells you the number changed. A backup tells you the data still exists.
| Tool | What it answers |
|---|---|
| Metrics | A numeric series, such as CPU or transactions, near the time it happened. |
| Diagnostic setting | Where resource logs and metrics are sent: a Log Analytics workspace, a storage account, or an event hub. |
| Log query | A Kusto query against logs in the workspace. |
| Alert rule and action group | The condition, and then the email, webhook, or automation that runs when it fires. |
| Alert processing rule | A window that suppresses notifications or adds action groups. It does not delete the alert rule. |
| Insights | A curated view of VM, storage, or network health. VM insights needs the Azure Monitor Agent sending data to a workspace. |
| Network Watcher | IP flow verify for an NSG decision, next hop for the route, and connection troubleshoot for a path. |
| Connection monitor | A repeating reachability test, with a report of where the path fails. |
Create a Recovery Services vault to back up Azure virtual machines, Azure Files, and SQL Server running in a virtual machine. The vault and an Azure VM backup live in the same region. Create a Backup vault for blobs, Azure disks, and Azure Database for PostgreSQL. A backup policy sets the schedule and the daily, weekly, monthly, and yearly retention. Restore can create a new VM, restore disks, or recover files, depending on the workload. Instant restore uses recent snapshots and is faster than a restore from the vault.
Azure Site Recovery replicates an Azure VM to another region. For Azure-to-Azure replication, create the Recovery Services vault in the target region. A test failover brings the replica up in an isolated network and leaves production running. A planned failover shuts the source down cleanly so you do not lose data that has not replicated. An unplanned failover is for an outage and can lose the unreplicated tail. After a real failover you commit, then reprotect if you want replication in the other direction. Backup reports and alerts come from the vault diagnostics and from Backup center. A failed job should raise an alert you have actually routed to an action group.
Contributor. That role can create and change resources at the assigned scope and cannot grant roles to other people. Owner can manage resources and assign roles. User Access Administrator can assign roles and cannot create the resources.
A private endpoint gives a platform service a private IP address in your subnet, so you can turn off public access. A service endpoint keeps the service's public address and lets the service recognize traffic from your virtual network.
A Recovery Services vault backs up Azure virtual machines, Azure Files, and SQL Server in a virtual machine, and it is also the vault for Site Recovery. A Backup vault is the vault used for blobs, disks, and Azure Database for PostgreSQL.
Drill the distinctions, then test them under a timer.
Exam format, the 700 passing score, domain weights, and a study plan.
Reference notes for identity, storage, compute, networking, monitoring, and recovery.
50 recall cards in five decks, plus memory notes for access, storage, compute, and recovery.
200 original questions with custom exams, explanations, and a score report by domain.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Convert structured data between JSON and YAML with formatting and validation.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Compare two text blocks and highlight added, removed, and changed content.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.
Certi