Is AZ-104 hard for beginners?

Yes, if you are truly new to cloud. AZ-104 assumes hands-on Azure operational experience and does not teach networking fundamentals. Complete beginners should build lab experience (and optionally do AZ-900 first) before attempting it.

How long should I study for AZ-104?

Plan for about 6 to 8 weeks of focused study if you have some cloud background, or roughly 6 months of general Azure exposure. If you already administer Azure daily, 4 to 5 weeks of practice exams plus targeted labs is often enough.

What score do I need to pass AZ-104?

You need 700 out of 1000. It is a scaled score that accounts for question difficulty and weighting, so it does not translate directly to answering 70 percent of questions correctly.

How many questions are on the AZ-104 exam?

Roughly 40 to 60 questions, with about 100 to 120 minutes of working time. The exact count and mix vary per delivery and can include case studies, drag-and-drop, and hotspot items.

How much does the AZ-104 exam cost?

Approximately USD 165 in the United States. The price varies by country and currency and does not include local taxes. Discounts sometimes apply through student programs or Microsoft training events.

Which AZ-104 domain is the hardest?

Virtual networking is the toughest for most candidates and often decides pass or fail. NSG rule evaluation and choosing between Azure Load Balancer and Application Gateway are common trouble spots. Compute is the next heaviest domain.

What happens if I fail AZ-104?

You wait 24 hours before a second attempt, then 14 days before each subsequent attempt, up to five attempts in a 12-month period. Each attempt requires a new registration and fee.

Does the AZ-104 certification expire?

Yes, after one year. Microsoft offers a free online renewal assessment on Microsoft Learn within six months of expiration. It is unproctored with unlimited retries, so it is straightforward if you stay current with Azure.

Do I need to know Azure CLI or PowerShell for AZ-104?

You do not need to write commands from memory, but you should be able to read and understand Azure CLI and PowerShell snippets, since some questions present commands and ask what they do or which option is correct.

How Hard Is the AZ-104 Exam? Difficulty, Topics, and How to Prepare

The AZ-104 (Microsoft Azure Administrator Associate) exam sits in an awkward middle zone. It is not a beginner test like AZ-900, but it is not a deep architecture or security specialty either. That makes 'how hard is it?' a genuinely useful question, because the honest answer is: harder than most people expect, but very learnable if you actually use Azure instead of only reading about it.

This guide breaks down the role, the five skill domains and how tough each one tends to be, the exam format, a realistic 6-to-8-week study plan, a hands-on lab checklist, the mistakes that fail people, and the logistics (cost, retakes, and renewal) as of 2026.

What the AZ-104 role and exam actually are

AZ-104 certifies that you can administer Azure day to day. That means managing identities and governance, provisioning and securing storage, deploying and maintaining compute (VMs, scale sets, containers, App Service), configuring virtual networking, and monitoring and backing up resources. Passing grants the 'Microsoft Certified: Azure Administrator Associate' credential.

The key word is administrator. Microsoft is not testing whether you can design a globally distributed system (that is AZ-305, the Architect exam). It is testing whether you can operate and troubleshoot the resources an organization already runs. Expect scenario questions like 'a user cannot access a storage account, what do you check?' rather than open-ended design questions.

Who it is for and realistic prerequisites

There is no formal prerequisite. You can sit AZ-104 without AZ-900 first, and many people do. But Microsoft assumes real operational experience, and the exam reflects that.

You should be comfortable with the Azure portal, and at least able to read Azure CLI and Azure PowerShell commands even if you cannot write them from memory.
You should understand core networking (IP addressing, subnets, DNS, routing) because the networking domain assumes it and does not teach it.
You should have touched Microsoft Entra ID (formerly Azure Active Directory), RBAC, and ARM or Bicep templates conceptually.
Realistically, plan for around 6 months of hands-on Azure exposure, or a focused 6-to-8 weeks of intensive lab study if you are strong on cloud fundamentals from another platform.

AZ-900 is a helpful confidence builder if you are new to cloud, but it is optional. If you already administer AWS or GCP, you can often skip straight to AZ-104 and focus on Azure-specific naming and behavior.

The five skill domains and how hard each one is

Microsoft periodically rebalances the weightings, so treat the percentages below as approximate and confirm against the current skills-measured outline. The relative difficulty, however, is fairly stable across candidates.

1. Manage Azure identities and governance (about 20-25%)

Covers Microsoft Entra ID users and groups, administrative units, self-service password reset, and joining or registering devices; role-based access control (built-in roles, custom roles, scope inheritance from management group down to resource); subscriptions and management groups; Azure Policy (definitions, initiatives, remediation); resource locks and tags; and cost management with budgets and alerts.

Difficulty: moderate. The hard part is not memorizing roles, it is understanding scope and inheritance, and the difference between RBAC (what you can do to Azure resources) and Entra roles (directory-level admin). Many candidates also confuse Azure Policy (governance and compliance) with RBAC (permissions). Get that distinction crisp.

2. Implement and manage storage (about 15-20%)

Covers storage account types and redundancy (LRS, ZRS, GRS, GZRS and their read-access variants); access control (shared keys, shared access signatures, stored access policies, Entra-based access); blob lifecycle management and tiers (hot, cool, cold, archive); Azure Files and File Sync; and secure transfer, firewalls, and private endpoints.

Difficulty: moderate. The redundancy options and the SAS token model are the usual stumbling blocks. Know exactly which redundancy tier survives which failure (a single datacenter, a zone, or an entire region) and when you would pick each.

3. Deploy and manage Azure compute resources (about 20-25%)

Covers creating and configuring VMs (sizes, disks, availability sets, availability zones); Virtual Machine Scale Sets and autoscale rules; ARM and Bicep templates and deployment; Azure App Service plans and web apps; and container options (Azure Container Instances and Azure Container Apps). Also VM extensions and custom script deployment.

Difficulty: moderate to hard. This is often the heaviest domain by question count. Availability sets versus availability zones versus scale sets trips people up, as does reading an ARM or Bicep template snippet and predicting what it deploys. Autoscale rule logic (metrics, thresholds, cooldown) shows up in scenario questions.

4. Configure and manage virtual networking (about 20-25%)

Covers virtual networks and subnets; Network Security Groups and Application Security Groups (rule priority and evaluation); VNet peering; DNS (Azure-provided and private DNS zones); load balancing (Azure Load Balancer versus Application Gateway); VPN Gateway and connectivity; and Network Watcher for troubleshooting.

Difficulty: hard for many people, and usually the domain that decides pass or fail. NSG rule evaluation (priority order, default rules, and the interaction between subnet-level and NIC-level NSGs) is a favorite. So is choosing the right load balancer for a scenario: Layer 4 (Load Balancer) versus Layer 7 (Application Gateway with WAF). If you are weak on networking generally, budget extra time here.

5. Monitor and maintain Azure resources (about 10-15%)

Covers Azure Monitor (metrics, logs, Log Analytics workspaces, basic Kusto Query Language), alerts and action groups, Application Insights at a high level, and Azure Backup and Recovery Services vaults, plus VM-level backup and restore.

Difficulty: moderate, but easy to under-study because it is the smallest domain. Do not skip it. Knowing the difference between metrics and logs, and the mechanics of setting up an alert (condition, action group, alert rule), is very testable and quick to learn.

Practice AZ-104 questions free

Exam format and logistics

Question count: roughly 40 to 60 questions, and the exact number varies per delivery.
Question types: single-response multiple choice, multiple-response ('select all that apply'), and possibly drag-and-drop ordering, hotspot (select regions of an image or table), and build-list items.
Case studies: AZ-104 may include one or more case-study scenarios where you answer several questions against a shared body of background information; you can move within a case study but confirm before leaving it.
Time: about 100 to 120 minutes of working time, plus a few minutes for instructions and an optional survey.
Passing score: 700 out of 1000. This is a scaled score, not a raw percentage, so it does not mean answering 70 percent of questions correctly. Weighting and question difficulty are baked in.
Cost: approximately USD 165 in the United States; the price varies by country and currency and does not include local taxes.
Delivery: online with proctoring, or at a Pearson VUE test center.

Some questions are unscored trial items mixed in silently, so answer everything as if it counts. You will not know which ones do not.

So, how hard is it really?

AZ-104 is a fair but non-trivial associate exam. People who fail almost always fall into one of two groups: they studied by watching videos without touching the portal, or they under-invested in networking. People who pass comfortably tend to have deployed real resources, broken things, and fixed them. The exam rewards muscle memory over recall.

A realistic 6-to-8-week study plan

Week 1: Baseline and setup. Read the current official skills-measured outline (Microsoft updates it, so use the live version). Create a pay-as-you-go subscription or use the free tier plus credits, and set a budget with a cost alert so you never get surprised. Take a short diagnostic to find weak domains.
Week 2: Identity and governance. Create users, groups, and administrative units in Entra ID. Assign built-in RBAC roles at different scopes and observe inheritance. Build a custom role. Write an Azure Policy and remediate a non-compliant resource. Apply resource locks and tags.
Week 3: Storage. Create storage accounts with different redundancy tiers. Generate a SAS token, apply a stored access policy, and lock the account behind a firewall and private endpoint. Set up blob lifecycle rules across tiers. Mount an Azure Files share.
Week 4: Compute. Deploy VMs with disks and an availability set, then compare against availability zones. Build a Virtual Machine Scale Set with an autoscale rule. Deploy the same VM from an ARM or Bicep template. Stand up an App Service web app.
Week 5: Networking (spend extra time here). Build VNets and subnets, peer two VNets, and configure NSGs and ASGs with careful rule priorities. Deploy a Load Balancer and an Application Gateway and understand when each applies. Configure a private DNS zone. Use Network Watcher to diagnose a blocked connection.
Week 6: Monitoring and backup. Create a Log Analytics workspace, run a basic KQL query, and configure a metric alert with an action group. Set up a Recovery Services vault and back up then restore a VM.
Week 7: Integrated practice. Take full-length timed practice exams, review every wrong answer until you understand why, and re-run any lab that maps to a weak spot. Focus on speed and reading questions precisely.
Week 8: Buffer and polish. Revisit the two weakest domains, re-read tricky topics (SAS, NSG evaluation, redundancy tiers, availability options), do one final timed run, and book the exam once you are consistently above passing on practice tests.

If you already work in Azure daily, compress this into 4-5 weeks by front-loading practice exams and only labbing your weak domains.

Hands-on lab checklist

If you can do every item below from the portal without a walkthrough, you are in strong shape for the exam. Tear resources down afterward to control cost.

Create two VNets with subnets and configure VNet peering between them, then verify connectivity.
Lock down an NSG: add inbound and outbound rules with explicit priorities, test that a blocked port is actually blocked, and understand default rules.
Create an Azure Files share and mount it from a VM (and note the SMB port and firewall implications).
Deploy a Virtual Machine Scale Set with an autoscale rule based on CPU, and watch it scale.
Assign RBAC roles at management group, subscription, resource group, and resource scope, and observe inheritance and how deny and allow resolve.
Configure an Azure Monitor metric alert with an action group that sends an email or triggers a webhook.
Set up Azure Backup: create a Recovery Services vault, back up a VM, then perform a restore.
Create a storage account, generate a SAS token, then restrict access with a firewall rule and a private endpoint.
Deploy a resource from an ARM or Bicep template and then redeploy with a changed parameter.

Common mistakes that fail people

Studying passively. Watching a course end to end without opening the portal is the number one reason capable people fail.
Neglecting networking. It is heavily weighted and unforgiving; NSG rule evaluation and load balancer selection sink many candidates.
Confusing similar concepts: RBAC versus Entra roles, RBAC versus Azure Policy, availability sets versus zones versus scale sets, and Load Balancer versus Application Gateway.
Ignoring the monitoring domain because it is small; those points are among the easiest to earn.
Memorizing exact prices and menu positions. The portal UI changes constantly; understand concepts, not pixel locations.
Misreading multiple-response questions. 'Select two' or 'select all that apply' questions penalize guessing extras; read the stem carefully.
Running up an Azure bill during study because they forgot to delete resources or set a budget alert.

Exam-day tactics

Do case studies deliberately. Read the scenario tabs first, and remember you generally cannot return to a case study once you leave it, so finish it before moving on.
Use the flag and review feature for uncertain questions and come back with fresh eyes.
Answer every question. There is no penalty for a wrong guess, so never leave a blank.
Watch the clock but do not rush; with 40-60 questions in 100-120 minutes you usually have enough time if you avoid getting stuck.
Eliminate obviously wrong distractors first; most questions become a two-way choice once you remove the clearly incorrect options.
For online proctoring, prepare early: clear your desk, check your ID, test your webcam and network, and close background apps before check-in.

Retake policy

If you fail, you must wait 24 hours before your second attempt. After a second failure you wait 14 days, and the same 14-day wait applies before the fourth and fifth attempts. You may take the exam a maximum of five times within a 12-month period. Each attempt requires a new registration and fee, so treat the first sitting as the real thing rather than a free look.

Certification renewal

The Azure Administrator Associate certification is valid for one year. Microsoft lets you renew it for free through a short online assessment on Microsoft Learn, available in the six months before your expiration date. The renewal assessment is unproctored, open to unlimited retries, and focused on staying current, so as long as you keep using Azure it is a light lift. Renewing early does not cost you time, because the new expiration is set relative to your existing expiry date.

Bottom line

AZ-104 is moderately hard: demanding enough to be meaningful, but very passable with disciplined hands-on preparation. Weight your effort toward networking and compute, do not neglect the small monitoring domain, and practice against realistic timed questions until your scores are consistently comfortable above 700. Do that, and the exam becomes a formality rather than a gamble.

Start practicing AZ-104 now