Azure AZ-104 study plan

Create Entra ID users, security groups, and at least one dynamic membership group in a sandbox tenant

Assign built-in Azure RBAC roles at subscription, resource group, and individual-resource scope, then verify effective permissions with the access check tools

Configure self-service password reset and multifactor authentication for a pilot group of lab users

Map three common job functions to least-privilege role assignments and justify each choice in writing

Differentiate Entra ID directory roles from Azure RBAC roles using two concrete lab scenarios

Design and implement a management group hierarchy and place resources under it

Author a custom Azure Policy with a tagging requirement and an allowed-locations rule, then remediate noncompliant resources

Apply resource locks and consistent tag schema to a resource group and test the effect of each lock type

Configure a Cost Management budget with an alert threshold and tags-based cost filtering

Export a policy compliance report and interpret which resources remain noncompliant

Author a reusable Bicep or ARM template that deploys a virtual network, network interface, and Linux VM from parameters

Deploy the same workload into an availability zone and into an availability set, and state the failure-domain difference

Attach and resize managed data disks, then change the VM size and confirm the expected downtime behavior

Deploy a virtual machine scale set with autoscale rules based on CPU and validate scale-out under synthetic load

Select an appropriate VM size and disk type for three given cost and performance scenarios

Create an App Service plan and web app, then configure a deployment slot and perform a slot swap

Bind a custom domain and TLS certificate to an App Service app and enforce HTTPS only

Deploy a containerized workload to Azure Container Instances and compare it against App Service and AKS for two scenarios

Configure App Service application settings and connection strings, and explain which ones are slot-sticky

Complete a timed 50-question practice set covering domains 1 and 3 and log every missed objective

Create storage accounts with LRS, ZRS, and GRS replication and explain the durability and failover differences

Configure blob access tiers, a lifecycle management rule, soft delete, and versioning, then verify a blob moves to cool storage

Generate account SAS, service SAS, and stored access policies, then test each permission boundary

Create an Azure Files share, take a snapshot, and mount the share from a lab VM

Move data with AzCopy and compare it with Storage Explorer and the Azure CLI for the same task

Build a hub-and-spoke topology with virtual network peering and demonstrate which traffic does and does not flow by default

Author network security groups with prioritized rules and validate them with IP flow verify and effective security rules

Configure an Azure DNS private zone and confirm name resolution from a VM in a peered network

Deploy a load balancer with a health probe and backend pool, then remove one backend and observe probe failure

Configure a VPN gateway connection for a site-to-site design and document the required address space and gateway subnet

Create a Log Analytics workspace and route VM diagnostic data and activity logs into it

Write and save five KQL queries covering failed sign-ins, VM performance counters, and resource changes

Create metric alerts and log search alerts with an action group and trigger at least one on purpose

Configure Azure Backup for a VM, run a backup, and execute a file-level restore to a new location

Enable Network Watcher connection monitor or NSG flow logs and interpret the output

Complete two full-length timed practice exams under exam conditions and review every incorrect answer

Rebuild the two weakest labs from memory without referencing notes to confirm retention

Re-read only the objectives flagged as missed across weeks 1 through 7 and close each gap with a hands-on task

Rehearse the exam interface features and time allocation for case-study style questions