An independent study guide for Microsoft Certified: Azure Administrator Associate · by Tony Rough
Know which role, setting or tool does the job, and why.
Free to read with Kindle Unlimited. Opens Amazon in a new tab.
Free glossary of the book's terms
First edition · published September 2026
This independent study guide for the Microsoft Certified: Azure Administrator Associate exam distils what AZ-104 really expects you to understand into the comparisons, limits and gotchas that everyday Azure administration turns on. No padding, no screenshots, no memorised answers: just the reasoning you need to pick the right role, SKU, setting or command, and to know what it can't do.
Fifteen chapters, each readable on its own and together covering all five AZ-104 skills areas:
Azure changes quickly. This edition reflects Microsoft's documentation as of September 2026, including recent retirements and replacements, and notes where the exam's traditional answer and today's product differ.
This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and run Azure with the same confidence long after exam day.
Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.
Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.
Hold Azure Administrator Associate (AZ-104), then pass AZ-305. The series covers every exam it needs:
Choose the right design, and explain why.
Hold Azure Administrator Associate (AZ-104) or an Azure developer associate certification, then pass AZ-400. The series covers every exam it needs:
Know which branch policy, pipeline feature or deployment pattern fits the delivery requirement, in GitHub or Azure DevOps, and why.
Every skill area in Microsoft's AZ-104 outline (as of April 17, 2026), and the chapters that cover it.
| Skill area | Weight | Chapters |
|---|---|---|
| Manage Azure identities and governance | 20–25% | 1, 2, 3, 14 |
| Implement and manage storage | 15–20% | 4, 5, 6 |
| Deploy and manage Azure compute resources | 20–25% | 3, 7, 8, 9, 10 |
| Implement and manage virtual networking | 15–20% | 11, 12, 13, 14 |
| Monitor and maintain Azure resources | 10–15% | 14, 15 |
Plus an appendix glossary of 600+ terms, each linked to Microsoft Learn, with the same terms explained free online for print readers.
Short excerpts from the book, exactly as they appear in it, so you can see how it explains things.
The opening of chapter 1 · Chapter 1: Microsoft Entra ID: users, groups, devices and licences
Every Azure administration task starts with identity: who the users are, how they sign in, which groups they belong to and what they’re licensed to use. This chapter covers the identity service behind Azure and Microsoft 365, from creating users one at a time or in bulk, through hybrid sign-in and group design, to device settings, licensing, guest access and self-service password reset. The aim is to understand why each setting exists, so that you can pick the right one when several look plausible.
A comparison table · Chapter 4: Storage accounts: types, redundancy, encryption and data transfer · Storage account kinds and what they support
The account kind determines which services and features are available. Standard general-purpose v2 covers most needs; the others exist for legacy reasons or for premium performance on a single service.
| Account kind | Blob tiers (Hot/Cool/Cold/Archive) | File shares | Table | Other |
|---|---|---|---|---|
| Standard general-purpose v2 (StorageV2) | Yes (Hot, Cool, Cold, Archive; blob-level tiering) | Standard only (transaction optimised, hot, cool) | Yes | Recommended for most scenarios; ZRS where zones exist; Azure Data Lake Storage (formerly Data Lake Storage Gen2) with hierarchical namespace |
| General-purpose v1 (Storage) | No | Standard | Yes | Legacy; no premium files, no Archive. Retiring on 13 October 2026, after which remaining accounts are migrated to GPv2 automatically |
| BlobStorage (legacy) | Yes | No | No | Blob service only; retiring with GPv1 on 13 October 2026 (auto-migrated to GPv2) |
| FileStorage (premium) | No Blob service | Historically premium (SSD) only; today also HDD provisioned v2 shares. No Hot/Cool tiers | No | Only home of premium file shares |
| Premium block blob (BlockBlobStorage) | No access tiers | No | No | Lifecycle management: delete only |
| Premium page blob (Premium StorageV2) | No Hot/Cool/Archive | No | No |
A common trap · Chapter 1: Microsoft Entra ID: users, groups, devices and licences · Self-service password reset (SSPR)
Common trap: Treating Reports Reader as an administrator role for SSPR - Reports Reader isn’t on the two-gate administrator list, so its holders follow the user policy (configured scope, methods and security questions).
Want more? Amazon offers a longer free sample of the Kindle edition on its Kindle page.
Some sections of the book, free to read online:
Where LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS keep your copies, what each survives, and which account types support them.
The three SAS types, what each can grant, how they're signed, and how to revoke one when a token leaks.
How the storage account firewall decides who gets in: IP rules, VNet rules with service endpoints, private endpoints and the trusted-services exception.
The order Azure applies subnet and NIC network security groups for inbound and outbound traffic, how priority works, and a worked example.
What a private endpoint puts in your subnet, how private DNS zones make names resolve to it, and when to choose it over a service endpoint.
Which App Service tiers allow manual scale-out, autoscale, slots and how many instances, and the difference between scaling up and scaling out.
Fault and update domains, zones, the SLA each gives, and what you can and can't change after a VM is created.
What delete and read-only locks block, how they inherit, and the surprising things a ReadOnly lock stops (like listing storage keys).
A free week-by-week plan through the book at a 4-week or 8-week pace, with the study notes and exam skill areas for each week.
Short videos on the ideas this exam likes to trap, about five minutes each.
Plays from YouTube when you press play · Watch on YouTube
The two questions that pick the right Azure Storage redundancy option, plus the read-access trap and three more. Read the write-up
Plays from YouTube when you press play · Watch on YouTube
How each one locks an Azure service down to your network, the on-premises trap, DNS and data exfiltration, and a five-second way to choose. Read the write-up
Plays from YouTube when you press play · Watch on YouTube
Two questions put the four Azure load-balancing services on a grid: web or not, regional or global. Plus three exam traps. Read the write-up
Plays from YouTube when you press play · Watch on YouTube
Two separate role systems: why a subscription Owner can't reset a password, why a Global Administrator can't see a VM, and the one bridge between them. Read the write-up
Several partner models in Microsoft Foundry now have retirement dates, starting with Llama-4-Maverick on 19 November 2026, and the Log Analytics logging destination for Azure Container Apps is now legacy. Front Door WAF policies can now be attached to a whole profile or a single route, and Azure Backup can restore individual files from Premium SSD v2 and Ultra disks.
Microsoft Entra opens its Choose Your Own Telephony Provider option on 30 October 2026, ahead of Microsoft-provided SMS and voice retiring from 1 February 2027. Standard service endpoints, automatic zone balance for scale sets and keyless TLS on Application Gateway are now generally available.
Microsoft has published retirement dates for Azure Deployment Environments (22 February 2027) and Microsoft Dev Box (18 September 2028). WAF exceptions are now generally available on Application Gateway and Front Door, and AKS now uses a zone-redundant StandardV2 NAT gateway by default for managed NAT.