AZ-104 study plan: 6-week & 10-week schedules

Here's a concrete, week-by-week plan for Microsoft AZ-104 (Azure Administrator), in two tracks: 6 weeks if you already work in Azure or hold AZ-900 or an AWS associate cert, and 10 weeks if you're new to Azure administration. Both run on the same daily routine of about an hour (roughly 6–8 hours a week), both follow the official skill-area weights, both put hands-on time in a real subscription into every week, and both finish with timed mocks. Book the exam when you're consistently scoring 80%+ on fresh questions.

AZ-104 isn't a "describe" exam; it's a "configure and troubleshoot" exam. Most questions describe a task and ask which setting, scope, rule or command gets it done, and the wrong answers are real options that would work for a slightly different task. So this plan pairs Microsoft Learn's free learning path with practice questions and hands-on labs from week one, and ends with four cheat sheets and a table of the Azure CLI commands worth knowing cold.

The exam you're planning for

Identities and governance and compute are tied for the biggest areas, but storage and networking aren't far behind, and networking questions are where hands-on practice shows most. Because the 700/1000 score is scaled and Microsoft doesn't publish the question count, aim higher than the mock pass line: 80%+ on fresh questions in every skill area, not 70%.

Which track are you on?

Those line up with the typical ranges of about 4–6 weeks and 8–12 weeks. Our guide to how long to study for AZ-104 has the timeline by background and the per-skill-area hour split.

The daily routine (every study day)

• 20 minutes — learn: the matching module in Microsoft Learn's free AZ-104 learning path. Read for what happens when you change this setting, not just what the service is.
• 20 minutes — hands-on: do the thing you just read about, in a real Azure subscription or in a CrushCert CLI lab. Portal one day, az commands the next.
• 15 minutes — practice questions on that day's sub-objective on CrushCert, plus a few mixed questions from earlier weeks so nothing goes cold.
• 5–10 minutes — review misses and flashcards: read the explanation for every wrong answer and say what each wrong choice would be right for; then run the flashcards on the lists that blur together (NSG defaults, SAS types, Policy effects, vault types).

Track 1: the 6-week plan (already in Azure, or AZ-900 / AWS associate holder)

• Week 1 — identities and governance (1.1–1.3): start with a 30-question mixed set to find your gaps. Then Entra users (member vs guest, bulk create, restore within 30 days) and groups (security vs Microsoft 365, assigned vs dynamic), licensing and usage location, B2B guests, SSPR; RBAC roles, scopes and inheritance, custom roles, Azure RBAC vs Entra roles; Azure Policy effects and remediation tasks, locks, tags, management groups, budgets. Run the Grant Least-Privilege Access and Match the Azure Policy Effect labs.
• Week 2 — storage (2.1–2.3): storage firewalls, service vs private endpoints, the three SAS types and stored access policies, key rotation; account types, redundancy, object replication, encryption; Azure Files snapshots and soft delete, access tiers and rehydration, lifecycle rules, versioning and point-in-time restore. Run Create a Locked-Down Storage Account and Choose the Storage Access Method.
• Week 3 — compute (3.1–3.4): ARM template sections, Bicep syntax, incremental vs complete mode, what-if and decompile; VM disks, resizing, availability sets vs zones, scale sets and autoscale, moving VMs, Azure Disk Encryption; Container Registry, Container Instances, Container Apps; App Service plans, scaling, slots, custom domains and TLS. Run Preview and Deploy a Bicep File and Deploy, Resize and Scale VMs.
• Week 4 — virtual networking (4.1–4.3): address spaces, subnets and the 5 reserved IPs, peering and gateway transit, user-defined routes, Standard public IPs; NSG evaluation and ASGs, Azure Bastion, service endpoints vs private endpoints; Azure DNS and private DNS zones, Azure Load Balancer and its troubleshooting. Run Build a VNet and Subnets, Lock Down a Subnet with an NSG and Pick the Network Watcher Tool.
• Week 5 — monitoring and maintenance (5.1–5.2): metrics vs logs, activity log, diagnostic settings, the Azure Monitor Agent and data collection rules, KQL, alert rules, action groups and alert processing rules; the two vault types, backup policies, restore options, soft delete, Site Recovery. Run Order the Site Recovery Failover. End the week with a 50-question mixed quiz and record your score per skill area.
• Week 6 — mocks and the exam: Microsoft's free practice assessment, then a full 50-question CrushCert mock on the 100-minute timer. Drill the weakest skill area with fresh questions, take a second mock, and book once you're at 80%+.

Track 2: the 10-week plan (new to Azure administration)

About an hour a day, six days a week. Use the seventh to catch up or rest.

Weeks 1–2 — identities and governance

• Week 1 — set up and identity (1.1): get a free or low-cost subscription, open Cloud Shell, create your first resource group with az group create. Then Microsoft Entra users and groups, dynamic membership (needs Entra ID P1), licenses and usage location, B2B guests and SSPR.
• Week 2 — access and governance (1.2–1.3): RBAC (principal + role + scope), Owner vs Contributor vs User Access Administrator, control plane vs data plane, Check access; Azure Policy, initiatives and remediation; locks, tags, management groups, moving resources, budgets and Advisor. Run Grant Least-Privilege Access and Match the Azure Policy Effect.

Weeks 3–4 — storage, then templates

• Week 3 — storage accounts and access (2.1–2.2): account types and naming, redundancy, encryption, Storage Explorer and AzCopy; firewalls, service endpoints, SAS types and stored access policies, keys, identity-based access for Azure Files. Run Create a Locked-Down Storage Account and Choose the Storage Access Method.
• Week 4 — Files, Blob, ARM and Bicep (2.3, 3.1): share snapshots and soft delete, access tiers and rehydration, lifecycle rules, versioning; then ARM template sections, Bicep, deployment modes, export and decompile. From here on, deploy your labs from a Bicep file. Run Preview and Deploy a Bicep File.

Weeks 5–6 — compute

• Week 5 — virtual machines (3.2): what a VM needs, disk types and the temporary disk, resizing and deallocation, Azure Disk Encryption, moving VMs, availability sets vs zones, scale sets and autoscale. Run Deploy, Resize and Scale VMs.
• Week 6 — containers and App Service (3.3–3.4): Container Registry SKUs, Container Instances and restart policies, Container Apps scale rules; App Service plans and tiers, scale up vs out, deployment slots and sticky settings, custom domains and TLS, backup, VNet integration vs private endpoint.

Weeks 7–8 — virtual networking

• Week 7 — VNets and secure access (4.1–4.2): address spaces, subnet math and reserved IPs, peering, UDRs and next hop types; NSGs (learn cheat sheet 1 below), ASGs, Bastion, service endpoints, private endpoints and private DNS. Run Build a VNet and Subnets and Lock Down a Subnet with an NSG.
• Week 8 — name resolution, load balancing, troubleshooting (4.3): Azure DNS delegation and alias records, private DNS zones and auto-registration, Azure Load Balancer components and probes, and Network Watcher (cheat sheet 2). Run Pick the Network Watcher Tool. Break something on purpose and find it with IP flow verify.

Weeks 9–10 — monitoring, backup, mocks

• Week 9 — monitoring and recovery (5.1–5.2): metrics, logs and KQL, diagnostic settings, the Azure Monitor Agent, alerts and action groups; Recovery Services vault vs Backup vault (cheat sheet 4), backup policies, restores, Site Recovery test failover. Run Order the Site Recovery Failover. Finish with a 50-question mixed quiz and record your score per skill area.
• Week 10 — review, mocks and the exam: your weakest skill area with fresh questions; Microsoft's free practice assessment; a full CrushCert mock on the 100-minute timer; drill what it exposed; a second mock. Two in a row at 80%+ and you're ready to book.

Cheat sheet 1: NSG rule evaluation

• Your rules use priority 100–4096. Lower number is processed first, and the first match wins; nothing after it is checked.
• Default rules can't be deleted, but any rule of yours overrides them because your priorities are always lower numbers.
• NSGs are stateful: if inbound traffic is allowed, the reply is allowed automatically.
• Subnet and NIC: for inbound traffic the subnet NSG is evaluated first, then the NIC NSG; for outbound, the NIC NSG first, then the subnet NSG. Traffic has to be allowed by both.
• Use service tags and ASGs (Internet, VirtualNetwork, AzureLoadBalancer, or your own WebServers group) instead of hard-coded IPs. All NICs in an ASG must be in the same VNet.

Cheat sheet 2: which Network Watcher tool?

Three more that show up next to these: Connection Monitor watches connectivity and latency continuously end to end (Connection troubleshoot is a one-off check), VPN troubleshoot diagnoses a VPN gateway or connection, and Topology draws your network. If a question says "which NSG rule blocks it," it's IP flow verify; "where does the traffic go," Next hop; "keep monitoring," Connection Monitor.

Cheat sheet 3: SAS types vs stored access policy

A stored access policy is defined on a container, file share, queue or table (up to 5 each), and a service SAS can reference it. Change or delete the policy and every SAS that uses it changes or is revoked, which is the clean way to revoke a SAS. Otherwise, the only way to revoke a SAS is to regenerate the key that signed it, which also breaks every other SAS signed with that key. That's why there are two keys: rotate one while apps use the other. Know the main SAS parameters too: sp (permissions), st/se (start/expiry), sip (allowed IPs), spr (HTTPS), sr (resource) and sig (signature).

Cheat sheet 4: Recovery Services vault vs Backup vault

Details that decide answers: to back up an Azure VM, the vault must be in the same region as the VM. Soft delete keeps deleted backup data for 14 days by default. Cross Region Restore needs a GRS vault with CRR enabled, and a vault's storage redundancy can only be changed before the first item is protected. For Site Recovery, the target Recovery Services vault lives in the target region, and the order is test failover, then failover → commit → re-protect → failback.

Azure CLI commands to know

These are the commands CrushCert's six CLI labs have you type. Learn what each one does and its key flags; the last column is the lab that drills it.

The last day before the exam

• No new topics, no full mocks. A 20-question mixed quiz, the flashcard deck, the four cheat sheets and the CLI table above.
• On exam day: you have about 100 minutes, and case studies may be included. Read every scenario for the word that decides it ("least privilege," "without a public IP," "revoke," "same region," "continuously"), and keep a steady pace so a long case study doesn't squeeze the last questions.

More on AZ-104

Not sure what to practice with? See our honest look at the best AZ-104 practice tests, free and paid. Still deciding whether to sit it at all? Read is AZ-104 worth it? and how long it takes by background. Everything in the prep is laid out on the Azure Administrator practice test page.

Keep reading

Frequently asked questions