AZ-104 practice test — type the az commands, don't just pick answers
The AZ-104 tests whether you can actually administer Azure, so CrushCert lets you practice the commands, not only the multiple choice. Six Azure CLI command labs put you in a Cloud Shell-style terminal where you type real az commands to build a VNet, lock down a subnet with an NSG, create a locked-down storage account, grant least-privilege access, deploy and scale VMs, and preview and deploy a Bicep file. Alongside them: four drag-and-drop labs, 400 original practice questions at the official skill-area weights with an explanation on every one, flashcards with spaced repetition, and a 50-question, 100-minute timed mock exam.
7 days free · No card required · Built to pass you on the first try
Up to date: written to Microsoft's skills outline of October 26, 2023 — still the current version in November 2026 — using current names (Microsoft Entra ID, Standard SKU load balancers, Azure Monitor Agent).
How CrushCert gets you exam-ready
Six Azure CLI command labs
Type real az commands in a Cloud Shell-style terminal. Flags can go in any order and the -g / -n short forms are accepted; a wrong attempt tells you which flag is missing or wrong. Plus four drag-and-drop labs on Azure Policy effects, Network Watcher tools, storage access methods and Site Recovery failover. The labs are simulated, so nothing is deployed and nothing is billed.
Adaptive practice
Quizzes prioritize questions you haven't seen and questions you missed, so your weak skill areas get more reps and every session moves your score.
Realistic mock exams
Timed tests of 50 questions on a 100-minute countdown, with a question navigator, mark-for-review, and a 70% pass line that mirrors the real 700-out-of-1000 bar.
Every answer explained
All 400 questions are original, tagged to their sub-objective (1.1 through 5.2), and went through three independent expert review passes before launch. Each explanation covers why the right answer is right and why every wrong choice is wrong.
What studying looks like
Real screens from the CrushCert AZ-104 track, not mockups.
What's on the AZ-104 exam
Exam AZ-104, Microsoft Azure Administrator, earns the Microsoft Certified: Azure Administrator Associate credential. It costs $165 in the US and gives you about 100 minutes. It is a role-based exam: Microsoft exams typically have 40 to 60 questions, and AZ-104 may include case studies. The passing score is 700 out of 1000 (scaled). The certification renews yearly with a free online renewal assessment, and Microsoft offers a free official practice assessment and a free AZ-104 learning path on Microsoft Learn. You do not need AZ-900 first. The five skill areas and their weights:
| Skill area | CrushCert questions | Exam weight |
|---|---|---|
| Manage Azure identities and governance | 97 | 20–25% |
| Implement and manage storage | 76 | 15–20% |
| Deploy and manage Azure compute resources | 97 | 20–25% |
| Implement and manage virtual networking | 76 | 15–20% |
| Monitor and maintain Azure resources | 54 | 10–15% |
These are the skills measured as of October 26, 2023, still the current version of the exam in November 2026. CrushCert's 400 questions follow the official weights, and every question is tagged to one of the 15 sub-objectives. The bank includes NSG-rule, route-table and subnet-math questions, ARM and Bicep snippets, KQL queries and az / azcopy command questions. Topic coverage includes:
Train on every skill area above
Adaptive practice questions and hands-on labs mapped to these exact skill areas. 7 days free, no card required.
Start free trialThe 10 hands-on AZ-104 labs
Six of the ten labs are Azure CLI command labs: you type the az commands an administrator would run, and each step is checked. The other four are drag-and-drop labs that drill the decisions the exam keeps asking about.
Type the commands
Build a VNet and Subnets · Lock Down a Subnet with an NSG · Create a Locked-Down Storage Account · Grant Least-Privilege Access (RBAC + resource lock) · Deploy, Resize and Scale VMs · Preview and Deploy a Bicep File (what-if, deploy, decompile).
Make the right call
Match the Azure Policy Effect · Pick the Network Watcher Tool · Choose the Storage Access Method · Order the Site Recovery Failover.
azure:~$ az network nsg rule create -g RG1 --nsg-name NSG1 -n AllowHTTPS --priority 100 --direction Inbound --access Allow --protocol Tcp --destination-port-ranges 443
# flags in any order · -g / -n short forms accepted · a wrong attempt names the missing or wrong flag
The CLI labs are a simulation: nothing is deployed, and you don't need an Azure subscription to use them. For real portal practice, pair CrushCert with a free or low-cost Azure subscription.
Free AZ-104 practice questions: are you ready?
Ten questions across all five exam domains. Answer each one, see the explanation, and find out which topic to work on first. No account needed.
Free readiness check
A Dynamic user group adds users automatically based on the department attribute, and group-based licensing then gives each member the license. An Assigned group needs manual membership updates, and direct assignment needs manual work for each user. Device groups contain devices, which do not receive user licenses based on department. A bulk create CSV is a one-time action and would not handle future hires automatically. Every CrushCert question includes an explanation like this.
A stored access policy on the container lets you change or delete its settings, which immediately changes or revokes every service SAS that references it. Account SAS tokens can't reference a stored access policy, and lifecycle rules manage blobs, not tokens. Versioning protects blob content, not access tokens. Anonymous Container access would give everyone read access with no revocation control.
Uniform orchestration uses identical instances built from a single model. Flexible mode is designed to mix VM sizes and manage instances more like individual VMs. Isolated is an App Service tier, not a scale set mode. Dedicated refers to dedicated hosts and is not an orchestration mode.
100 Allow TCP 3389 Source 203.0.113.0/24 Destination Any
200 Deny TCP Any Source Any Destination Any
300 Allow TCP 443 Source Internet Destination Any
A client at 198.51.100.7 connects to the VM on TCP 443. What is the result?
NSG rules are evaluated by priority, and rule 100 does not match because the port is 443 and the source is outside 203.0.113.0/24. Rule 200 matches any TCP traffic from any source, so the connection is denied there and evaluation stops. Rule 300 is never reached even though it would allow the traffic. DenyAllInBound is never reached because rule 200 already matched.
Replace existing disks swaps VM1's current disks for the disks from the recovery point while keeping the existing VM resource and its configuration. Creating a new VM produces a separate machine with a new identity. File Recovery only gets individual files and does not roll back the OS. Cross Region Restore restores into the paired region, which is not needed here.
Bulk delete takes a CSV of user principal names and deletes those users in one operation, and they remain restorable for 30 days if a mistake is made. Bulk create only creates users and has no delete action. Changing the user type does not delete or disable accounts. Removing group memberships leaves the accounts in place.
Object replication asynchronously copies block blobs from a source container to a destination container. Page blobs aren't supported by object replication. File shares and queues aren't blob containers, so they're out of scope too.
By default an availability set has 5 update domains, and planned maintenance reboots one update domain at a time, so some VMs keep running. VMs are spread across update domains, not all placed in one. The maximum of 20 update domains is not the default, and fault domains handle hardware failures, not planned maintenance order. Eight update domains would need a non-default setting.
Azure Load Balancer health probes come from the Azure platform address 168.63.129.16, which is represented in NSGs by the AzureLoadBalancer service tag. 169.254.169.254 is the Azure Instance Metadata Service address. 10.0.0.1 would be a subnet's default gateway in a 10.0.0.0 subnet, not the probe source. The frontend IP is the address clients connect to, not where probes come from.
A service principal represents an application in Microsoft Entra ID and can be assigned Azure roles so the app signs in as itself. A guest user is an external person, not an application identity. A Microsoft 365 group would give access to its human members, not to the tool. Devices in a device group are not security principals for Azure RBAC assignments.
Why learners pick CrushCert
You practice the way the exam tests you. The AZ-104 is mostly short scenarios — "you need to… what should you do?" — plus questions that ask which az command or portal setting does a task, and questions that make you read an NSG rule list, a route table, a KQL query or a Bicep snippet. CrushCert's bank includes all of those, every distractor is a real Azure setting or command you could confuse, and every explanation tells you why the other choices are wrong.
It is a practice bank, not a course or a sandbox. CrushCert is practice questions, CLI and drag-and-drop labs and mock exams, not a video course and not a live Azure environment. Pair it with Microsoft Learn's free AZ-104 learning path and, ideally, a free or low-cost Azure subscription for real portal practice, then use CrushCert to find the skill areas you still miss. It suits people who already work with Azure, AZ-900 holders moving up, and AWS associates adding Azure.
You always know your readiness. A live readiness score blends your quiz accuracy, mock results, and lab performance, and points you to exactly what to study next.
A guided plan tells you what to study today. Guided Learning builds a short daily plan from your performance — a warm-up review, a lesson on your weakest topic, and flashcards, with spaced repetition so material comes back right before you'd forget it.
AZ-104 pricing
$15/month
Microsoft Azure Administrator (AZ-104) on its own: all 400 questions, the 10 labs, flashcards, mock exams, the readiness score and Guided Learning.
$24/month
All 23 exams across Cisco, CompTIA, AWS, ISC2 and Microsoft, AZ-104 included — worth it if you're stacking certs.
7-day free trial · No card required · Cancel anytime
Keep learning: AZ-104 reading
Best AZ-104 practice tests in 2026
Microsoft's free practice assessment, Tutorials Dojo, MeasureUp, CertCrush and CrushCert — price, what you get, and who each one suits.
WORTH IT?Is the AZ-104 worth it in 2026?
A $165 associate cert that renews free each year. What it honestly does for you, who it pays off for, and how it leads to AZ-305.
TIMELINEHow long to study for the AZ-104?
Typically 4–6 weeks part-time if you already work with Azure, and 8–12 weeks if you are new to Azure administration.
STUDY PLANAZ-104 study plan
A schedule across the five skill areas, pairing Microsoft Learn's free learning path and hands-on Azure time with practice questions, labs and a timed mock.
NEW TO CLOUD?AZ-900 Azure Fundamentals practice test
AZ-900 is not required for AZ-104, but if you are new to cloud it is a gentler first step: 200 questions, six drag-and-drop labs and a 45-minute timed mock.
Not sure which cert comes next? Take the two-minute Which certification should I take? quiz.
Ready to crush the AZ-104?
400 original questions, six Azure CLI command labs plus four drag-and-drop labs, explanations on every answer, and a timed mock exam — start free for 7 days, no card required.
Start studying freeAZ-104 FAQ
Is the AZ-104 hard?
It is a role-based associate exam, so it is a real step up from AZ-900. Most questions are short scenarios that ask what you should do or use, some ask which az command or portal setting does a task, and the exam may include case studies. What trips people up is configuration detail: NSG rule priority, peering that is not transitive, SAS types and stored access policies, RBAC scope and inheritance, and which backup or monitoring tool fits. You have about 100 minutes and need 700 out of 1000 to pass.
Do I need AZ-900 before AZ-104?
No. AZ-900 is not a prerequisite for AZ-104. Microsoft's fundamentals exam is recommended only if you are new to cloud; if you already work with Azure or hold an AWS associate certification, you can go straight to AZ-104.
How long does it take to study for the AZ-104?
Typically about 4 to 6 weeks part-time, roughly 6 to 8 hours a week, if you already work with Azure or hold AZ-900 or an AWS associate certification, and about 8 to 12 weeks if you are new to Azure administration. Hands-on time in a real Azure subscription matters more here than it does for AZ-900. Those are typical ranges, not a guarantee.
How many questions are on the AZ-104 exam?
Microsoft exams typically have 40 to 60 questions, and AZ-104 may include case studies. You get about 100 minutes and need 700 out of 1000 (scaled) to pass. CrushCert's mock exam is 50 questions on a 100-minute timer with a 70% pass line that mirrors 700 out of 1000.
Are the Azure CLI labs a real Azure subscription?
No. The six Azure CLI command labs run in a simulated Cloud Shell-style terminal: you type real az commands and each one is checked, but nothing is deployed and no Azure subscription or cost is involved. Flags can go in any order, the -g and -n short forms are accepted, and a wrong attempt tells you which flag is missing or wrong. For real portal practice, pair CrushCert with a free or low-cost Azure subscription.
Which version of the AZ-104 should I study, and is the bank updated when Microsoft refreshes the outline?
There is one current version: the study guide's skills measured as of October 26, 2023, which is still current in November 2026, with no newer outline or retirement announced. Every CrushCert question is written to that version using current names such as Microsoft Entra ID, Standard SKU load balancers and public IPs, the Azure Monitor Agent and VNet flow logs. Because the outline is old, a refresh is possible, and we will update the bank when Microsoft refreshes the outline.
Does the Azure Administrator certification expire?
Yes, it renews yearly. Microsoft Certified: Azure Administrator Associate is renewed with a free online renewal assessment on Microsoft Learn, so you do not pay for the exam again. The exam itself costs $165 in the US.
Is CrushCert enough on its own to pass the AZ-104?
Use it alongside Microsoft Learn, not instead of it. CrushCert is practice questions, ten labs and mock exams, not a video course and not a live Azure sandbox. Work through Microsoft Learn's free AZ-104 learning path, spend time in a real Azure subscription, take Microsoft's free official practice assessment, then use CrushCert to drill the skill areas you still miss.