Microsoft AZ-104: Microsoft Azure Administrator

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Manage Azure identities and governance

   An administrator wants to give a helpdesk group the ability to reset passwords for users in one department only. Which approach follows least privilege in Microsoft Entra ID?

   1. AAssigning a scoped administrative unit role to the helpdesk group for that department's users
   2. BGiving the helpdesk group the built-in Owner role at subscription scope, inherited by every resource group
   3. CAssigning the Global Administrator role to the helpdesk group so it can manage every tenant-wide setting
   4. DSharing a single administrator account with the helpdesk team, storing its password in a shared spreadsheet
   Show answer and explanationHide answer

   Correct answer: A

   Administrative units scope directory roles to a subset of users, which limits the helpdesk to one department. Global Administrator and subscription Owner grant far more rights, and shared accounts are insecure.

2. Question 2Deploy and manage Azure compute resources

   An application running on Azure VMs needs more capacity during peak hours and less at night, with instances added automatically. Which resource should be configured?

   1. AA single larger VM that runs continuously during business hours
   2. BA VM with a reserved static IP and no scaling rules
   3. CVirtual machine scale set with autoscale rules based on metrics
   4. DA managed disk resized to a larger size that adds storage capacity alone
   Show answer and explanationHide answer

   Correct answer: C

   Scale sets with autoscale add and remove instances based on metrics or schedules. A single large VM, a static IP and a larger disk do not scale capacity automatically.

3. Question 3Configure and manage virtual networking

   Two virtual networks in the same region must communicate privately with low latency and no gateway. Which feature connects them?

   1. AA public IP on each VM
   2. BA site-to-site VPN gateway
   3. CA load balancer in the internet
   4. DVirtual network peering
   Show answer and explanationHide answer

   Correct answer: D

   VNet peering connects virtual networks privately without a gateway. Public IPs route over the internet, VPN gateways add an unnecessary hop, and internet load balancers are for public traffic.

4. Question 4Monitor and back up Azure resources

   Which two tools help assess and migrate on-premises workloads to Azure? (Choose two.)

   1. AAzure Site Recovery for replication
   2. BExcel for inventory only
   3. CMicrosoft Paint
   4. DAzure Bastion
   5. EAzure Migrate
   Show answer and explanationHide answer

   Correct answer: A, E

   Azure Migrate discovers and assesses workloads, and Site Recovery replicates them for migration. Spreadsheets, Paint and Bastion do not assess or migrate workloads.

5. Question 5Implement and manage storage

   A company needs storage that is accessible from multiple Linux VMs at the same time using NFS, managed as a service. Which option fits?

   1. AManaged disk attached to one VM
   2. BA local temporary disk on each VM
   3. CAzure Blob Storage hot tier with public access
   4. DAzure Files NFS share
   Show answer and explanationHide answer

   Correct answer: D

   Azure Files NFS shares support shared POSIX-style access from multiple Linux VMs. Blob storage is object storage, a managed disk attaches to one VM, and temporary disks are not durable shared storage.